AppServices_DanglingDomain

Question

I am getting this warning via Azure Defender and it's a good point. I currently have a subdomain dedicated to an Azure environment, one that is created on demand for testing. When I delete the environment (to save costs) the domain is still registered, and if someone sneaks a peak at the CNAME they could stand up their own Azure AppService and essentially hijack my subdomain. I am basically wanting to save costs by only having the subdomain available when I need it. Is there a way to keep the AppService name reserved for when I do not have it deployed? What is the best practice for my arrangement? If I was able to automate the DNS/CName that would be ideal, but my provider is not Azure -- it's iwantmyname and I am not aware of any automated/API I could use. I would greatly appreciate any suggestions/insight on how I should handle this.

Answer 1

Hi Mike,

How about scaling the app service plan to Free tier when you are not using it? Before you can scale it down you would need to remove features not available with Free. For example, say you have a custom domain with certificate binding. Before scaling down you need to delete the binding.

The other thing to note is Azure automatically reserves the name for a certain period of days after you delete the App Service, so if you only have it deleted for a short time there isn't much risk.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Answer 2

If I understand correctly, I can indeed host the records on Azure and point namespace servers on iwantmyname to Azure: https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns?source=recommendations Once this is done I can modify Bicep to remove the CNAME entries from the Azure-hosted DNS (that iwantmyname is pointing to after editing its configuration).