How to add cname record into a subdomain at DNS zone in Azure

Question

How to add cname record into a subdomain at DNS zone in Azure

Kannusamy, Thaniyarasu 21

Dear Azure Support,

How to add cname record into a subdomain at DNS zone in Azure ?

Here is my issue

1) My client have a domain ("mydomain.com") registered at godaddy.com.
2) I want to deploy app0 under "app0.mydomain.com" subdomain.
3) So i created a public DNS zone for "app0.mydomain.com" at DNS zone in Azure.
4) i have added the 4 NS records from Azure DNS store into Godaddy apex ".mydomain.com".
everything was working fine. i was happy.

But when i want to enable https , i saw a big problem.

My backend is App Service (app0)
My Frontend is FrontDoor.
because FrontDoor is offering free ssl certificate.

but when i set the ssl at front door ,
it asking me to set "app0.azurefd.net" as CNAME record at "app0.mydomain.com"

So i went into DNS zone try to add CNAME record .
but i dont' know how ?
so i went into Godaddy panel , tried to add CNAME "app0.mydomain.com" point to "app0.azurefd.net".
but godaddy is not allowing.

now Azure also not allowing (may be i dont know)
godaddy also not llowing

how can i do that ?

SaiKishor-MSFT 17,336 Reputation points Moderator

2021-04-07T07:02:50.517+00:00

@Kannusamy, Thaniyarasu Have you followed this document to create a cname for the sub-domain?
SaiKishor-MSFT 17,336 Reputation points Moderator

2021-04-09T18:23:01.49+00:00

@Kannusamy, Thaniyarasu Any update?
Varun Deepak Jagadeesh (Nallas) 5 Reputation points

2024-05-27T08:06:03.3966667+00:00
We are encountering a similar issue in our domain as described by @Kannuswamy. The document provided by @SaiKishor-MSFT does not address our specific concern. The main issue revolves around the auto-validation of certificates.

Here’s a detailed overview of the problem:

Current Setup:

Consider our domain, **xyz.com**, registered with GoDaddy.

We have a frontend named **myfe.xyz.com**.

A DNS Zone is created, and the NS record is updated in GoDaddy to route traffic from Azure to GoDaddy.

Problem:

We have NS records for our subdomain in both GoDaddy and Azure.

Due to this setup, we can't create a CName record on both ends Which will show a conflict.

Without this CName mapping, the certificate does not auto-renew.

Comparison with AWS:

AWS provides an option to choose between auto-renewal and manual renewal while creating a certificate. However, this option seems to be missing in Azure, or I might be missing the correct steps to achieve this.

Request for Assistance:

@SaiKishor-MSFT Can you advise on how we can set up auto-renewal of certificates in Azure given our current setup? Specifically, we need guidance on the correct process for creating and managing certificates with auto-renewal in Azure, considering the limitations we are facing with CName records and NS records.
Daniel noyn 1 Reputation point

2024-12-21T00:03:23.3566667+00:00

no matter what you do, it won't work unless you know enough to know why what they tell you to do is impossible, and won't work, and then you also know the work around.

They tell you to create a root level cname record for inclusion into the network. But you can't create a root level CNAME record, unless it is flattened by the DNS provider, like CloudFlare will do.
However, then it becomes an A record from the POV of the DNS servers out there, and is not a CNAME so your website name never resolves and therefore Front Door cannot possible see it. Any resolution for yourdomain.com will fail because there is no record of you, and so the DNS servers won't tell Front Door you exist. It also can't read it as an A record because then it still doesn't propagate, except under www.

So, once you realize that what they have said to do is impossible, then you have to figure out a work around.

1 answer

Your answer

SaiKishor-MSFT 17,336 Reputation points Moderator

2021-04-07T07:02:50.517+00:00

@Kannusamy, Thaniyarasu Have you followed this document to create a cname for the sub-domain?
SaiKishor-MSFT 17,336 Reputation points Moderator

2021-04-09T18:23:01.49+00:00

@Kannusamy, Thaniyarasu Any update?
Varun Deepak Jagadeesh (Nallas) 5 Reputation points

2024-05-27T08:06:03.3966667+00:00

We are encountering a similar issue in our domain as described by @Kannuswamy. The document provided by @SaiKishor-MSFT does not address our specific concern. The main issue revolves around the auto-validation of certificates.

Here’s a detailed overview of the problem:

Current Setup:

Consider our domain, **xyz.com**, registered with GoDaddy.

We have a frontend named **myfe.xyz.com**.

A DNS Zone is created, and the NS record is updated in GoDaddy to route traffic from Azure to GoDaddy.

Problem:

We have NS records for our subdomain in both GoDaddy and Azure.

Due to this setup, we can't create a CName record on both ends Which will show a conflict.

Without this CName mapping, the certificate does not auto-renew.

Comparison with AWS:

AWS provides an option to choose between auto-renewal and manual renewal while creating a certificate. However, this option seems to be missing in Azure, or I might be missing the correct steps to achieve this.

Request for Assistance:

@SaiKishor-MSFT Can you advise on how we can set up auto-renewal of certificates in Azure given our current setup? Specifically, we need guidance on the correct process for creating and managing certificates with auto-renewal in Azure, considering the limitations we are facing with CName records and NS records.
Daniel noyn 1 Reputation point

2024-12-21T00:03:23.3566667+00:00

no matter what you do, it won't work unless you know enough to know why what they tell you to do is impossible, and won't work, and then you also know the work around.

They tell you to create a root level cname record for inclusion into the network. But you can't create a root level CNAME record, unless it is flattened by the DNS provider, like CloudFlare will do.
However, then it becomes an A record from the POV of the DNS servers out there, and is not a CNAME so your website name never resolves and therefore Front Door cannot possible see it. Any resolution for yourdomain.com will fail because there is no record of you, and so the DNS servers won't tell Front Door you exist. It also can't read it as an A record because then it still doesn't propagate, except under www.

So, once you realize that what they have said to do is impossible, then you have to figure out a work around.

Answer 1

msrini-MSFT 9,301 Microsoft Employee

Hi,

In your godaddy, just add CNAME to app0 then point it to app0.azurefd.net.

It is not allowing because, your Godaddy will append the domain to the value which you provide.

Varun Deepak Jagadeesh (Nallas) 5 Reputation points

2024-05-27T08:08:04.6133333+00:00

@msrini-MSFT We can't add a CName over there because we already have an NS record pointing to app0.azurefd.net, So if we try to create a CName it will show a conflict.
Daniel noyn 1 Reputation point

2024-12-17T23:37:49.7166667+00:00

Also Godaddy REQUIRES that a CNAME have an IP Address, and there is no Front Door IP Address.

Share via

How to add cname record into a subdomain at DNS zone in Azure

1 answer

Your answer