Issue with creating custom domain in Static Web App

Jonas Wilkening 40

Attempting to create a custom domain is stuck in validating forever. there is no indication of why it is not working.

Tried different ways of creating the cusotm domain (via azure portal & powershell) and validation (CNAM & TXT) already.

Please assist, thanks!

Praneeth Maddali 12,505 Reputation points Microsoft External Staff Moderator

2026-02-05T11:31:57.2+00:00
Hi @Jonas Wilkening

Thanks again for sharing the domain details. When a Static Web App custom domain stays stuck in “Validating”, it usually means Azure can’t detect the required TXT verification record.

Check the TXT host name

Azure requires the _dnsauth prefix:

Apex domain (example.com): _dnsauth

Subdomain (www.example.com)::"https://www.example.com)/") _dnsauth.www

Make sure the value matches the exact token shown in the portal.

TXT setup examples: https://learn.microsoft.com/azure/static-web-apps/custom-domain?tabs=azure-dns#add-a-custom-domain

A wrong host (like @, asuid, or plain www) will cause validation to hang indefinitely.

2. Verify public DNS

Use WhatsMyDNS or MX Toolbox to confirm the TXT record resolves globally.

DNS validation details: https://learn.microsoft.com/azure/static-web-apps/custom-domain#validate-domain-ownership

Reset validation in Azure

If the DNS is correct but still stuck:

Click Refresh

If available, click Regenerate and update the TXT record

If still stuck, remove the custom domain, wait 15–60 minutes, and re‑add it

Troubleshooting steps: https://learn.microsoft.com/azure/static-web-apps/custom-domain#troubleshooting

4. SSL delay

After validation succeeds, SSL provisioning may take a few hours.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Jonas Wilkening 96 Reputation points

2026-02-09T11:11:52.8+00:00

Hi. Thanks for your response. unfortunately this did not help, validation is still not working
Praneeth Maddali 12,505 Reputation points Microsoft External Staff Moderator

2026-02-09T12:47:32.6366667+00:00

@Hi @Jonas Wilkening

Thanks for reaching out. The error messages you’re seeing usually mean Azure Static Web Apps couldn’t validate the CNAME record during the custom‑domain setup, even if the DNS was created outside Azure DNS. The wording “failed to add records to DNS zone” is generic—Azure always attempts validation and shows this message when the CNAME lookup fails.

reference:

https://learn.microsoft.com/en-us/azure/static-web-apps/custom-domain?tabs=azure-dns#add-a-custom-domain%22https://learn.microsoft.com/azure/static-web-apps/custom-domain?tabs=azure-dns#add-a-custom-domain%22
Jonas Wilkening 96 Reputation points

2026-02-09T13:46:21.86+00:00
Hi, I tried to follow through your steps with a new domain. Here is what I did:

Added subdomain.domain.tld as custom domain to

Selected TXT validation

Hit "generate token"

Added DNS record for: _dnsauth.subdomain.domain.tld in TXT <authtoken> still the verification is not working

Answer accepted by question author

Jonas Wilkening 96

The Problem were missing CAA records for digicert. Thanks for to @Praneeth Maddali for assisting and pointing that out.

TP 162.1K Reputation points Volunteer Moderator

2026-02-10T15:06:51.65+00:00

I mentioned yesterday in my comment that you did not have CAA record, but I didn't ask you to create it since in my experience and it has only made a difference in small number of cases.

For example, right now I have domain that doesn't have CAA record and it validates and is issued certificate under SWA without issue.

Answer accepted by question author

Praneeth Maddali 12,505 Microsoft External Staff Moderator

Hi @Jonas Wilkening

Thanks for the detailed tests so far. Based on the behavior you’re seeing (TXT record correct but validation still failing, and CNAME returning “CNAME record is invalid”), this matches a known issue in Azure Static Web Apps: the domain cannot be validated unless DigiCert is explicitly allowed as a certificate issuer.

Azure uses DigiCert to issue the automatic SSL certificate. If your DNS zone does not include a CAA record for DigiCert, validation can hang indefinitely.

Please add the following DNS record at your DNS provider:

Type: CAA Name: @ Value: 0 issue "digicert.com" TTL: 300

If you already have a CAA record (for example only Let’s Encrypt), simply add an additional entry — multiple CAA records are supported.

After adding the record

Remove the custom domain from your Static Web App
Wait ~5–10 minutes
Re‑add the custom domain using TXT validation
Click Refresh a few times — validation should complete within a few minutes

This exact fix has resolved the same issue for multiple customers where TXT and CNAME validation kept failing even though DNS was correct.

Please do not forget to click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you

0 comments

1 additional answer

TP 162.1K Reputation points Volunteer Moderator

2026-02-05T09:11:31.1833333+00:00
Hi Jonas,

UPDATE: I queried DNS and your TXT record appears correct. Sometimes the process gets stuck even though you have things correct. Please try below steps:
1. Remove existing TXT record, wait 5 minutes (for TTL to expire)
2. Create CNAME with TTL 300 (5 minutes), use nslookup to verify it exists from your client PC. If not, keep trying nslookup until it shows up. Depending on your provider, the delay may be seconds or several minutes
3. Delete your custom domain from Static Web App, wait for it to complete (usually only seconds)
4. Add -- Custom domain on other DNS, enter your domain, Next, select TXT from dropdown, click Generate code. When code shows up, create new TXT record in your DNS, copy/paste in the value, TTL 300. Verify it exists using nslookup, when it shows up click Close button
5. On the list of custom domains it should Validating. If you want you can View details and then click Refresh button in the flyout window, or you can periodically click Refresh on the list of custom domains
In my experience it typically takes 10 minutes or less for the validation to complete and certificate to be issued. If it hasn't finished within 15 minutes or so I would delete and try again. I just did a new custom domain and it took about 8 minutes.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP
Was this answer helpful?

1 person found this answer helpful.
Jonas Wilkening 40 Reputation points

2026-02-05T10:53:51.2933333+00:00

Hello, custom Domain is <redacted>

TP 162.1K Reputation points Volunteer Moderator

2026-02-05T11:32:54.77+00:00

Thanks. Your TXT record appears correct. Sometimes the process gets stuck even though you have things correct. Please try below steps:

Remove existing TXT record, wait 5 minutes (for TTL to expire)

Create CNAME with TTL 300 (5 minutes), use nslookup to verify it exists from your client PC. If not, keep trying nslookup until it shows up. Depending on your provider, the delay may be seconds or several minutes

Delete your custom domain from Static Web App, wait for it to complete (usually only seconds)

Add -- Custom domain on other DNS, enter your domain, Next, select TXT from dropdown, click Generate code. When code shows up, create new TXT record in your DNS, copy/paste in the value, TTL 300. Verify it exists using nslookup, when it shows up click Close button

On the list of custom domains it should Validating. If you want you can View details and then click Refresh button in the flyout window, or you can periodically click Refresh on the list of custom domains

In my experience it typically takes 10 minutes or less for the validation to complete and certificate to be issued. If it hasn't finished within 15 minutes or so I would delete and try again. I just did a new custom domain and it took about 8 minutes.

Please reply back with you results, whether positive or negative.

Thanks.

Jonas Wilkening 96 Reputation points

2026-02-09T11:09:55.27+00:00

hi, unfortunately this did not helpd. I did everything like you said but now the CNAME is "overriting" those txt records as expected. so this did not do the trick

TP 162.1K Reputation points Volunteer Moderator

2026-02-09T11:30:56.5466667+00:00

What do you mean "overriting"? Did you perform the steps exactly in the order I listed?

Reason I ask is, when I checked few days ago I saw you had created new TXT record, but CNAME wasn't there. In my instructions I have you creating CNAME first, and then generating verification code right afterwards and adding it as TXT record.

Right now I see CNAME is there, but TXT record is gone. Did you delete the TXT record for some reason?

Can you try repeating the steps I gave you above? You don't need to create CNAME since you already have that in place. So start at Step#3

Jonas Wilkening 96 Reputation points

2026-02-09T11:36:24.41+00:00

Hello TP, the CNAME is added at my provider. however it does not show up which makes sense as according to RFC 1034 "If a CNAME RR is present at a node, no other data should be present"

TP 162.1K Reputation points Volunteer Moderator

2026-02-09T12:30:27.47+00:00

Yes, that makes sense if your provider enforces it strictly. I did test while I was writing up those steps and the provider I used doesn't enforce it.

I just performed new test, only had CNAME record, and it validated it in approximately 3 minutes 20 seconds, tested and certificate was issued and default page worked.

In my case I have CAA record with 0 issue "digicert.com" at apex, which you don't have, but CAA record not being there shouldn't cause an issue. In my test I used "test1.mydomain.com" for reference.

The other thing to check is if there are any error details in Activity log that would give clue as to why it is failing.

Jonas Wilkening 96 Reputation points

2026-02-09T12:39:35.97+00:00

hi, I just tried CNAME validation and got the following error:

"Failed to add records to DNS zone and configure Static Web App custom domain with error: Could not add custom domain. CNAME Record is invalid. Please ensure the CNAME record has been created"

I thought this was strikign as it says failed to add records to DNS zone while I was not using the Azure DNS Option. Therefor I also tried to add the zone using Azure CLI which failed as well: "The resource operation completed with terminal provisioning state 'Failed'" , from the control plane it says "An unknown error has occurred while adding your custom domain. Please try again later"

TP 162.1K Reputation points Volunteer Moderator

2026-02-09T13:18:35.7833333+00:00

I see your domain does exist on Azure DNS, even though that is not being used for public lookups.

Did you see Praneeth's comment above regarding TXT verification being required if you are using Enterprise-grade Edge? I don't have that Enterprise-grade Edge enabled on the site I have been testing with.

I know you already have tried with TXT record verification.

Jonas Wilkening 96 Reputation points

2026-02-09T16:22:07.52+00:00

hi, i am not using enterprise edge, unfortunately TXT method is not working either. see above
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Issue with creating custom domain in Static Web App

1 additional answer

Your answer