Catch-All Private Resource to Prevent Exposing Internal Networks
Connection requests by remote devices, including requests for private resources, are typically resolved using public DNS, exposing information about those requests to the public internet. Connection requests for private destinations that are enabled for client-based Zero Trust Access do not go through public DNS and thus do not expose this information.
To avoid exposing information about your network to the public internet via DNS requests:
Add a private resource for your namespace, following the model *.example.com, for Any TCP, Any UDP, for all ports, and enable client-based Zero Trust Access for this resource. This creates a traffic steering rule that routes all client-based traffic to any destination in your namespace through Zero Trust Access. You do not need to create an access rule specifically for this resource, because the default private access rule will block access unless another access rule applies.