Multi Domain SaaS-Platforms on Azure - how to map custom domains?

Question

Today, we have a platform that we make available to customers via their own path example.com/customerA.

To do this, we have an ASP.NET Core-based platform on an App Service behind a Frontdoor. So it's a SaaS platform from the customer's perspective.

We have more and more customers who would like to use their own sub-domain. However, we cannot find any best practice in the Azure Architecture on how best to implement this for a SaaS platform.

-> The Azure App Service has a limit of 500 domains; the setup requires DNS records at the Azure level, which the customer then has to validate. If we change something on the backend, then all customers would have to validate their DNS entries themselves at the same time. This is not reasonable.

-> Same problem with the front door

-> App Gateway has similar limitations

We have looked at other services such as Rebrandly (URL Shortener Service), which have identical requirements for their platform. An infinite number of customers can map an infinite number of domains to the service and the service then interprets the requests itself.

I cannot find an Azure service that responds to CName requests that are not stored directly at Azure level. The app service also only listens to the domains and CName entries that are stored and validated. We see that customers on AWS are using Route 53 here.

If we look at the equivalent on Azure with Azure DNS, we see no support for this scenario.

What is the story on Azure for custom domain SaaS platforms where we can do the CName validation ourselves or the service accepts all CName requests?

Answer 1

Hi @Benjamin Abt ,
Thanks for the question and using MS Q&A platform.
To implement custom domains for a multi-tenant SaaS platform on Azure, you can consider using Azure Front Door. Azure Front Door allows you to manage custom domains and supports various domain types, including subdomains, apex domains, and wildcard domains.

•  You can add custom domains to your Azure Front Door profile. Each domain requires a DNS TXT record for validation and a CNAME record to route traffic to Azure Front Door. This setup allows you to manage traffic effectively while providing your customers with their own domains.
•  If you anticipate a large number of customers, using wildcard domains (e.g., *.yourdomain.com) can simplify the configuration. This way, you can route traffic for any subdomain without needing to configure each one individually.
•  Azure Front Door can manage TLS certificates for your custom domains, which can streamline the onboarding process for new customers. You can either use Azure Front Door to issue and manage certificates or allow tenants to provide their own certificates.
•  While Azure App Service has a limit on the number of custom domains, Azure Front Door can help mitigate some of these limitations by allowing a single instance to route traffic to multiple domains.
• You can add a domain name to your Azure Front Door profile before making DNS changes, which can help avoid downtime during migration or onboarding.

While Azure does not provide a service that accepts all CNAME requests without validation, using Azure Front Door with wildcard domains and proper DNS configuration can help you achieve a scalable solution for your multi-tenant SaaS platform.
ref:
Use Azure Front Door in a multitenant solution

Domains in Azure Front Door

Wildcard domains in Azure Front Door (front-door-standard-premium)
Let me know if you have any assistances.
If the answer is helpful, please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.