# DNS traffic for internal domains is routed through Private Access
When you enable the Private Access profile in Global Secure Access but don't publish port 53 (UDP/TCP) in application segments or configure private DNS…
Source: https://maester.dev/docs/tests/ZTA.25400
## Overview
When you enable the Private Access profile in Global Secure Access but don't publish port 53 (UDP/TCP) in application segments or configure private DNS suffixes, the Global Secure Access client can't route DNS queries for internal domain names through the tunnel. As a result, DNS queries for internal FQDNs go to the local resolver on the device, which has no knowledge of internal zones.
Without this configuration:
- FQDN-based application segments fail to match traffic because the client can't resolve internal host names to IP addresses.
- Threat actors operating on the same local network as the remote user can observe unencrypted DNS queries, map internal resource names, and identify targets for later stages of an attack.
- The client might fall back to direct connections that bypass Conditional Access and security profile enforcement applied through Global Secure Access.
## Remediation
- [Configure private DNS suffixes for Quick Access or per-app access](https://learn.microsoft.com/entra/global-secure-access/how-to-configure-quick-access?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) so DNS queries for internal domains go through Global Secure Access.
- [Configure per-app access with application segments](https://learn.microsoft.com/entra/global-secure-access/how-to-configure-per-app-access?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) that include port 53 (UDP/TCP) to an internal DNS server.
- [Learn about Microsoft Entra Private Access](https://learn.microsoft.com/entra/global-secure-access/concept-private-access?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) in Global Secure Access.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Private Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Infrastructure hardening |
| ATT&CK | [T1557.001](/docs/tests?mitre=T1557.001) Name Resolution Poisoning and SMB Relay |
| Licence | AAD_PREMIUM, Entra_Premium_Private_Access |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.