You are designing a secure hybrid network architecture for an Azure OpenAI resource. Virtual machines inside a spoke virtual network must access the OpenAI service via a Private Endpoint. Additionally, domain name resolution must rely on an enterprise private DNS server hosted on-premises connected via ExpressRoute. Which DNS zone must you configure in Azure?