On-premises clients must resolve names hosted in a private Cloud DNS zone. Hybrid IP connectivity already works. Which approach best fits?

1. Configure supported inbound DNS forwarding and on-premises forwarding rules.
2. Configure an appropriate Cloud DNS forwarding zone or outbound forwarding policy.
3. Add or adjust the narrowly scoped applicable ingress firewall rule.
4. Create a private Cloud DNS zone with the appropriate network authorization.