GlobalMart wants centralized name resolution for private zones: private DNS zones will be managed in a hub subscription and should resolve for spokes without creating identical zones in each spoke. What's the recommended configuration to provide centralized resolution from the hub to all spoke VNets?

The correct solution centralizes private DNS zone management in the hub, linking spoke VNets to these zones for resolution. Using non-registration links for spokes prevents duplicate records, while auto-registration on the hub VNet ensures resources within the hub automatically register their records. This setup provides efficient, centralized private name resolution across the hub and spoke architecture. Creating private DNS zones only in each spoke would defeat the purpose of centralized management. Azure does not automatically merge zones across peered VNets. Setting the private DNS zone to public would expose internal resolution to the internet, which is a security risk and not for private resolution. Deploying individual DNS forwarder VMs in each spoke is more complex and less integrated than Azure Private DNS, and querying a public DNS zone for private resolution is incorrect.