On-premises DNS servers must resolve Azure private DNS zones over a private connection without maintaining Azure DNS-forwarder VMs. Which managed feature should they forward relevant queries to?

1. An Azure public DNS name server for the private zone
2. An Azure NAT Gateway public address
3. An Azure DNS Private Resolver inbound endpoint
4. A Private Resolver outbound endpoint as an ordinary inbound DNS server