|
| 1 | +--- |
| 2 | +title: 'Apex domains in Azure Front Door' |
| 3 | +description: Learn about apex domains when using Azure Front Door. |
| 4 | +services: frontdoor |
| 5 | +author: johndowns |
| 6 | +ms.service: frontdoor |
| 7 | +ms.topic: article |
| 8 | +ms.workload: infrastructure-services |
| 9 | +ms.date: 02/07/2023 |
| 10 | +ms.author: jodowns |
| 11 | +--- |
| 12 | + |
| 13 | +# Apex domains in Azure Front Door |
| 14 | + |
| 15 | +Apex domains, also called *root domains* or *naked domains*, are at the root of a DNS zone and don't contain subdomains. For example, `contoso.com` is an apex domain. |
| 16 | + |
| 17 | +Azure Front Door supports apex domains, but requires special considerations. This article describes how apex domains work in Azure Front Door. |
| 18 | + |
| 19 | +To add a root or apex domain to your Azure Front Door profile, see [Onboard a root or apex domain on your Azure Front Door profile](front-door-how-to-onboard-apex-domain.md). |
| 20 | + |
| 21 | +## DNS CNAME flattening |
| 22 | + |
| 23 | +The DNS protocol prevents the assignment of CNAME records at the zone apex. For example, if your domain is `contoso.com`, you can create a CNAME record for `myappliation.contoso.com`, but you can't create a CNAME record for `contoso.com` itself. |
| 24 | + |
| 25 | +Azure Front Door doesn't expose the frontend public IP address associated with your Azure Front Door endpoint. So, you can't map an apex domain to an Azure Front Door IP address. |
| 26 | + |
| 27 | +> [!WARNING] |
| 28 | +> Don't create an A record with the public IP address of your Azure Front Door endpoint. Your Azure Front Door endpoint's public IP address might change and we don't provide any guarantees that it will remain the same. |
| 29 | +
|
| 30 | +However, this problem can be resolved by using alias records in Azure DNS. Unlike CNAME records, alias records are created at the zone apex. You can point a zone apex record to an Azure Front Door profile that has public endpoints. Multiple application owners can point to the same Azure Front Door endpoint that's used for any other domain within their DNS zone. For example, `contoso.com` and `www.contoso.com` can point to the same Azure Front Door endpoint. |
| 31 | + |
| 32 | +Mapping your apex or root domain to your Azure Front Door profile uses *CNAME flattening*, sometimes called *DNS chasing*. CNAME flattening is where a DNS provider recursively resolves CNAME entries until it resolves an IP address. This functionality is supported by Azure DNS for Azure Front Door endpoints. |
| 33 | + |
| 34 | +> [!NOTE] |
| 35 | +> Other DNS providers support CNAME flattening or DNS chasing. However, Azure Front Door recommends using Azure DNS for hosting your apex domains. |
| 36 | +
|
| 37 | +## TXT record validation |
| 38 | + |
| 39 | +To validate a domain, you need to create a DNS TXT record. The name of the TXT record must be of the form `_dnsauth.{subdomain}`. Azure Front Door provides a unique value for your TXT record when you start to add the domain to Azure Front Door. |
| 40 | + |
| 41 | +For example, suppose you want to use the apex domain `contoso.com` with Azure Front Door. First, you should add the domain to your Azure Front Door profile, and note the TXT record value that you need to use. Then, you should configure a DNS record with the following properties: |
| 42 | + |
| 43 | +| Property | Value | |
| 44 | +|-|-| |
| 45 | +| Record name | `_dnsauth` | |
| 46 | +| Record value | *use the value provided by Azure Front Door* | |
| 47 | +| Time to live (TTL) | 1 hour | |
| 48 | + |
| 49 | +## Azure Front Door-managed TLS certificate rotation |
| 50 | + |
| 51 | +When you use an Azure Front Door-managed certificate, Azure Front Door attempts to automatically rotate (renew) the certificate. Before it does so, Azure Front Door checks whether the DNS CNAME record is still pointed to the Azure Front Door endpoint. Apex domains don't have a CNAME record pointing to an Azure Front Door endpoint, so the auto-rotation for managed certificate fails until the domain ownership is revalidated. |
| 52 | + |
| 53 | +Select the **Pending revalidation** link and then select the **Regenerate** button to regenerate the TXT token. After that, add the TXT token to the DNS provider settings. |
| 54 | + |
| 55 | +> [!NOTE] |
| 56 | +> Azure Front Door's DNS TXT records for domain name validation need to be updated when the certificate is renewed. When you see the *Pending revalidation* domain validation state, ensure that you generate a new TXT record and update your DNS server. |
| 57 | +
|
| 58 | +## Next steps |
| 59 | + |
| 60 | +To add a root or apex domain to your Azure Front Door profile, see [Onboard a root or apex domain on your Azure Front Door profile](front-door-how-to-onboard-apex-domain.md). |
0 commit comments