Hi TENDK,

That is expected behavior and does not necessarily mean something is wrong. Here is what is happening:

When you run nslookup from inside a Databricks notebook, the notebook is executing on a cluster that sits inside the Databricks-managed VNet (or your VNet-injected network). The DNS resolution from within that network context may resolve to the public IP of the storage account because:

1. The private DNS zone may not be linked to the Databricks VNet. For private endpoint DNS resolution to work from inside the Databricks workspace, the Azure Private DNS zone (e.g., privatelink.blob.core.windows.net) must be linked to the VNet where the Databricks clusters run. If it is only linked to your on-premises network or a different VNet, the clusters will fall back to public DNS resolution.
2. VNet injection is required. If you are not using VNet injection (i.e., you are using the default managed VNet), you cannot link your private DNS zones to it, and private endpoint resolution from inside the workspace will not work as expected.

What to check:

• Confirm that VNet injection is configured for this workspace
• Verify the Private DNS Zone (privatelink.blob.core.windows.net or the relevant zone for your storage type) is linked to the VNet used by Databricks
• If using a custom DNS server, ensure it forwards privatelink.* queries to Azure DNS (168.63.129.16)

If the private endpoint is working from your on-premises network but not from inside the workspace, the DNS zone linkage to the Databricks VNet is almost certainly the issue.

Reference: Azure Private Link concepts for Databricks

* This reply used an agent system I built to research and draft this response based on the wide set of documentation I have available and previous memory. I personally review the draft for any obvious issues and for monitoring system reliability and update it when I detect any drift, but there is still a small chance that something is inaccurate, especially if you are experimenting with brand new features.

If this answer resolves your question, could you mark it as "Accept as Solution"? That helps other users quickly find the correct fix.