Onboard a root or apex domain to Azure Front Door

Apex domains are at the root of a DNS zone and don't contain subdomains. For example, contoso.com is an apex domain. Azure Front Door supports adding apex domains when you use Azure DNS. For more information about apex domains, see Domains in Azure Front Door.

You can use the Azure portal to onboard an apex domain on your Azure Front Door profile, and you can enable HTTPS on it by associating it with a TLS certificate.

Onboard the custom domain to your Azure Front Door profile

  1. Under Settings, select Domains for your Azure Front Door profile. Then select + Add to add a new custom domain.

    Screenshot that shows adding a new domain to an Azure Front Door profile.

  2. On the Add a domain pane, you enter information about the custom domain. You can choose Azure-managed DNS (recommended), or you can choose to use your DNS provider.

    • Azure-managed DNS: Select an existing DNS zone. For Custom domain, select Add new. Select APEX domain from the pop-up. Then select OK to save.

      Screenshot that shows adding a new custom domain to an Azure Front Door profile.

    • Another DNS provider: Make sure the DNS provider supports CNAME flattening and follow the steps for adding a custom domain.

  3. Select the Pending validation state. A new pane appears with the DNS TXT record information needed to validate the custom domain. The TXT record is in the form of _dnsauth.<your_subdomain>.

    • Azure DNS-based zone: Select Add to create a new TXT record with the value that appears in the Azure DNS zone.

    • If you're using another DNS provider, manually create a new TXT record with the name _dnsauth.<your_subdomain> with the record value as shown on the pane.

  4. Close the Validate the custom domain pane and return to the Domains pane for the Azure Front Door profile. You should see Validation state change from Pending to Approved. If not, wait up to 10 minutes for changes to appear. If your validation doesn't get approved, make sure your TXT record is correct and that name servers are configured correctly if you're using Azure DNS.

    Screenshot that shows a new custom domain passing validation.

  5. Select Unassociated from the Endpoint association column to add the new custom domain to an endpoint.

    Screenshot that shows an unassociated custom domain added to an endpoint.

  6. On the Associate endpoint and route pane, select the endpoint and route to which you want to associate the domain. Then select Associate.

  7. Under the DNS state column, select CNAME record is currently not detected to add the alias record to the DNS provider.

    • Azure DNS: Select Add.

    • A DNS provider that supports CNAME flattening: You must manually enter the alias record name.

  8. After the alias record gets created and the custom domain is associated with the Azure Front Door endpoint, traffic starts flowing.

    Screenshot that shows the completed APEX domain configuration.

Note

  • The DNS state column is used for CNAME mapping check. An apex domain doesn't support a CNAME record, so the DNS state shows CNAME record is currently not detected even after you add the alias record to the DNS provider.
  • When you place a service like an Azure Web App behind Azure Front Door, you need to configure the web app with the same domain name as the root domain in Azure Front Door. You also need to configure the back-end host header with that domain name to prevent a redirect loop.
  • Apex domains don't have CNAME records pointing to the Azure Front Door profile.
  • The Microsoft.Network resource provider is required to create alias records.

Enable HTTPS on your custom domain

Follow the guidance for configuring HTTPS for your custom domain to enable HTTPS for your apex domain.

Related content