The safer approach is not to shadow cloud.databricks.com with one private hosted zone. Databricks recommends the privatelink.cloud.databricks.com DNS pattern with conditional forwarding, which avoids hardcoding rotating ELB hostnames and keeps public services like accounts and ui-assets resolvable through normal public DNS.