Your organization has deployed Global Secure Access Private Access to provide remote users access to internal line-of-business web applications hosted on-premises. Users report they can reach applications when you publish them using explicit IP address app segments, but attempts to reach the same applications by their internal FQDN (for example, app.corp.contoso.local) fail to resolve. You need remote clients to resolve and reach these on-premises resources by their private DNS names with minimal administrative effort. What should you configure?