On-premises clients must resolve Azure private DNS names, and Azure workloads must resolve on-premises names. Which approach should be assessed?

1. Publish all private names and addresses publicly
2. Azure DNS Private Resolver with correctly designed inbound/outbound paths and forwarding rules
3. Assume VNet peering automatically configures every DNS forwarding relationship
4. Configure only a resource tag called private-dns