Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
6,943 questions
Mapping app service to domains SAAS application
Anuraj
166
Reputation points MVP
I am building a SAAS application, I am allowing my customers to use their own domain for accessing the application. Here are my questions.
- It is okay to expose the domain name and TXT record?
- Can I ask them to configure only CNAME not TXT record?
- What is the best practice of using custom domains in App Service? Right now I am directly using Custom domains in App Service. Can I do it via Azure DNS or some other service, so that I don't want to expose the app service name or IP Address to customers.
Please help.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 92%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
ajkuma 22,521 Reputation points Microsoft Employee2020-11-26T16:38:34.697+00:00 @Anuraj , Thanks for posting this good question.
1/2:Yes, you may use Azure DNS to configure a custom DNS name for Azure App Service. To do this, kindly checkout this process.
I would not suggest exposing TXT record. To prevent
dangling DNSentries and avoid subdomain takeover, when creating DNS entries for Azure App Service, you may create an asuid.{subdomain} TXT record with the Domain Verification ID. SinceCNAME recordsare particularlyvulnerableto this threat.A subdomain takeover can occur when you have a DNS record that points to a deprovisioned Azure resource. Such records are "dangling DNS" entries.
So, adding domain verification IDs to your custom domain is recommended.
Additionally, you should use CNAME records for all custom DNS names except root domains (for example, mydomain.com) and for root domains, use A records. -
ajkuma 22,521 Reputation points Microsoft Employee
2020-11-26T16:52:31.46+00:00 2/2:
@Anuraj , Kindly check this document Prevent dangling DNS entries and avoid subdomain takeover for more details.
DNS record should be public. So an internal DNS or anything lease that’s not public won’t work
Kindly let us know if you have any further questions or needs clarification, we'll follow-up with you.
P.S: On a side note, I happened to find your blog on a related topic, which is informative to all Azure users👍
Sign in to comment