Azure DNS failing to resolve internal ip.

[Schutzhund3]

Describe the bug

Issue type: Technical
Service area: Azure Virtual Network / DNS / Outbound Connectivity
Severity: Production-impacting diagnostic issue; please classify according to subscription support plan

Summary

A Linux execution environment configured to use Azure’s platform DNS address 168.63.129.16 is unable to perform DNS resolution or establish outbound HTTPS connectivity.

The issue prevents installation and execution of Microsoft/Mojang Minecraft Creator Tools (@minecraft/creator-tools) because neither the npm registry nor GitHub release infrastructure can be reached.

This has been reproduced repeatedly on October 5, 2026.

Observed environment

• Node.js: v22.16.0
• npm: 10.9.2
• Linux resolver configuration:
  nameserver 168.63.129.16
• Intended package:
  @minecraft/creator-tools
• Current official Creator Tools release identified through GitHub metadata: v0.19.0

Symptoms

1. Azure-provided DNS does not resolve external hosts

Commands attempting to resolve:

• registry.npmjs.org
• github.com

fail while /etc/resolv.conf points to:

168.63.129.16

npm reports:

EAI_AGAIN registry.npmjs.org

Example:

npm view @minecraft/creator-tools version --loglevel=verbose

Result:

• DNS resolution does not complete.
• Operation eventually times out.
• Observed timeout exit code: 124.

2. Azure platform address itself appears unreachable

Connectivity testing against the configured Azure platform VIP produced:

• 168.63.129.16:80 → connection refused
• 168.63.129.16:53 TCP → connection refused / unavailable

This is notable because 168.63.129.16 is the resolver currently supplied to the environment.

3. Public DNS resolvers are also unreachable

Temporary tests were performed using:

• Cloudflare DNS: 1.1.1.1
• Google DNS: 8.8.8.8

Neither resolver could be reached successfully.

The original /etc/resolv.conf configuration was restored after testing.

4. Direct outbound HTTPS also fails

Attempts to bypass DNS by connecting directly to known external IP addresses while supplying the expected TLS hostname were unsuccessful.

Direct HTTPS connectivity to GitHub could not be established.

This suggests the issue is broader than DNS alone and may involve outbound egress restrictions, network namespace policy, firewalling, or a missing outbound path.

5. Creator Tools cannot be installed

The standard installation path:

npm install -g @minecraft/creator-tools

cannot proceed because registry.npmjs.org cannot be reached.

The fallback approach of downloading the official Mojang Creator Tools v0.19.0 GitHub release package also cannot proceed because direct outbound GitHub access is unavailable.

No preinstalled or cached mct / mctools executable was found locally.

Reproduction steps

1. Start in the affected Linux environment.
2. Confirm /etc/resolv.conf contains:
   nameserver 168.63.129.16
3. Attempt:
   npm view @minecraft/creator-tools version --loglevel=verbose
4. Observe EAI_AGAIN resolving registry.npmjs.org.
5. Attempt DNS resolution for github.com.
6. Observe failure.
7. Attempt connectivity to 168.63.129.16 on ports 53 and 80.
8. Observe failure/refusal.
9. Attempt direct outbound HTTPS connectivity independent of DNS.
10. Observe failure.

Expected behavior

If Azure-provided DNS and outbound networking are enabled for this environment:

• 168.63.129.16 should provide Azure platform DNS resolution.
• External DNS names such as registry.npmjs.org and github.com should resolve.
• HTTPS traffic should reach permitted internet destinations.
• npm install -g @minecraft/creator-tools should at least be able to contact the npm registry.

Actual behavior

• Azure platform DNS does not return usable external resolutions.
• Alternative public DNS servers cannot be reached.
• Outbound HTTPS cannot be established.
• Package installation and external binary downloads are impossible.

Investigation already performed

• Repeated DNS retries.
• Verified active resolver configuration.
• Tested Azure platform DNS address.
• Tested Cloudflare and Google DNS.
• Tested TCP/DNS connectivity.
• Tested direct HTTPS with DNS bypass.
• Tested npm registry access.
• Tested GitHub access.
• Checked for local Creator Tools installation.
• Checked npm cache for an offline Creator Tools package.
• Restored original resolver configuration after testing.

Relevant recent Azure considerations

We reviewed Microsoft’s public Azure status information and did not find evidence of an ongoing Azure-wide DNS outage corresponding to these tests.

We also reviewed the Azure networking change in which newer VNets can use private-subnet behavior that requires an explicit outbound method. Because this environment also cannot communicate normally with the Azure platform address 168.63.129.16, we would like Microsoft to determine whether the observed behavior is caused by:

1. Intentional sandbox/network isolation.
2. Private-subnet/default-outbound changes.
3. Missing NAT Gateway, Azure Firewall, Load Balancer outbound rules, or other egress mechanism.
4. NSG/UDR/firewall policy affecting Azure platform traffic.
5. Host/network namespace restrictions.
6. A regional or platform issue involving Azure DNS or WireServer connectivity.
7. Another recent Azure networking platform change.

Requested Microsoft investigation

Please confirm:

• Whether there were any Azure platform, DNS, WireServer, VNet, or outbound-connectivity incidents or changes on October 5, 2026 that could cause these symptoms.
• Whether 168.63.129.16 should be reachable from this type of workload/environment.
• Whether any recent Azure networking defaults would result in the exact combination of:
  • no Azure DNS response,
  • inaccessible public DNS,
  • and no direct outbound HTTPS.
• Which Azure diagnostics should be collected to identify where traffic is being blocked.
• Whether Azure Network Watcher, NSG flow logs, effective routes, effective security rules, or platform diagnostics can identify the responsible layer.

The primary goal is to determine whether this is expected network isolation or an Azure platform/networking defect.

Related command

Example:

npm view @minecraft/creator-tools version --loglevel=verbose

Errors

EAI_AGAIN registry.npmjs.org
168.63.129.16:80 → connection refused

• 168.63.129.16:53 TCP → connection refused / unavailable

Issue script & Debug output

NA

Expected behavior

Mctools is available

Environment Summary

Openai

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[x-engineering-agent]

Hi Joel (@Schutzhund3), the supplied reproduction shows npm DNS/HTTPS failures, but does not identify an Azure CLI operation. Could you share the affected az ... command and its error output, with credentials and other sensitive details removed?

If no az command is involved, please contact the operator of the Linux execution environment to investigate its DNS and outbound-network policy. The configured resolver address alone does not establish an Azure CLI defect. This issue will be reassessed automatically when you reply with an Azure CLI reproduction.

Posted by x-engineering-agent (Fixer)