You have an Azure subscription that contains a virtual network named VNet1 and a virtual...

You can add a virtual network link only to zone3.com , the Azure Private DNS zone. Microsoft states that after creating a private DNS zone in Azure, you link a virtual network to it so that virtual machines hosted in that virtual network can resolve records in the private DNS zone. The documentation further explains that every private DNS zone has a collection of virtual network link child resources, where each link represents a connection to a virtual network.

The standard primary DNS zone zone1.com is hosted inside the Windows Server DNS role on VM1. It is not an Azure Private DNS zone resource and therefore does not support Azure virtual network links. The Azure DNS zone zone2.com is a public DNS zone, used for authoritative public DNS hosting, and it is not linked to VNets by using private DNS virtual network links. Only Azure Private DNS zones provide VNet linking for private name resolution and optional autoregistration. This maps to AZ-104 Configure and manage virtual networking , specifically DNS name resolution, Azure DNS, Azure Private DNS zones, and virtual network links.