Contoso wants to publish the same domain 'app.contoso.com' publicly to the internet (resolving to Front Door) but inside their VNets they need 'app.contoso.com' to resolve to internal private endpoint IPs. They consider using Azure DNS public zone and a Private DNS zone of the same name. Will Azure support this split-horizon (same zone name public + private) design and how will resolution behave?

Azure DNS fully supports split-horizon DNS by allowing you to create both a public and a private DNS zone with the exact same name. When a VNet is linked to a private DNS zone, any DNS queries originating from resources within that VNet for records in that zone will be resolved by the private DNS zone. This ensures that internal traffic resolves to internal private endpoint IPs. Conversely, DNS queries originating from the internet (or from VNets not linked to the private zone) for the same domain name will be resolved by the public Azure DNS zone, directing traffic to public endpoints like Azure Front Door. This design provides the desired internal and external resolution behavior. The other options are incorrect because Azure DNS explicitly allows this configuration and prioritizes the private zone for linked VNets, and Traffic Manager is for traffic distribution, not split-horizon DNS resolution.