DNS OverDoS: Are Private Endpoints Too Private?

Palo Alto Networks’ Unit 42 researchers found a DoS risk in Azure Private Link where forcing DNS resolution through a Private DNS zone can deny access to storage resources even when public endpoints remain available. The executive summary notes that more than 5% of Azure storage accounts are configured in ways that could be exploited, with at least one affected resource in Key Vault, CosmosDB, Azure Container Registry, Function Apps and OpenAI accounts.

The paper describes three risk scenarios—accidental internal deployments, accidental vendor deployments, and a malicious actor who gains Azure access and deploys Private Endpoints to cause a DoS. Mitigations include enabling a fallback to internet and manually adding DNS records for affected resources, though neither is a complete fix. The authors advocate comprehensive discovery and scanning, with Azure Resource Graph Explorer as a practical tool to identify Private DNS zone links and at-risk resources.

The piece concludes that fully understanding Private Link limitations is vital to security, given the binary nature of the service can lead to connectivity loss and potential DoS in certain configurations. Published: January 20, 2026.