Cannot delete custom domain CDN

Question

Cannot delete custom domain CDN

Fa-8827 1

Trying to delete a custom domain on a CDN but get the following error. This was a PoC for a bug bounty but can't seem to delete my custom domain on the CDN resource. How would I go about actually deleting it? (Without updating the DNS)

I already tried:

az feature register --namespace Microsoft.Network --name BypassCnameCheckForCustomDomainDeletion

but to no avail.

The error message is:

(Conflict) Cannot delete custom domain "XXXX" because it is still directly or indirectly (using "cdnverify" prefix) CNAMEd to CDN endpoint "XXXX.azureedge.net".
Please remove the DNS CNAME record and try again.

Tomasz Kluczkowski 1 Reputation point

2022-09-26T13:56:53.507+00:00

I have identical issue.
Also run
az feature register --namespace Microsoft.Network --name BypassCnameCheckForCustomDomainDeletion

waited till
az feature list -o table --query "[?contains(name, 'Microsoft.Network/BypassCnameCheckForCustomDomainDeletion')].{Name:name,State:properties.state}"

shows that the feature got registered,
still unable to delete the endpoint

Did anyone figure out why this happens?
WWH 5 Reputation points

2023-02-02T23:00:44.19+00:00

It's absurd the way Microsoft behaves with DNS entries. They are completely out of touch with how DNS work is performed in the real work. There are plenty of scenarios where one organization is in control of DNS and another separate organization is in control of the cloud environment. Requiring DNS changes before making changes prevents a lot of prework and sometimes makes using certain services impossible because some organizations I work with have an issue with creating these fake "verify" records. They just flat out won't do it. AWS doesn't do anything like this, because they are intelligent enough to know that if you don't control DNS (the REAL DNS server) you can't do anything harmful to the masses if you setup a service on a DNS name you do not own. Sure you can prevent the real owners of the DNS name from using it, but that's an easy solve. Let the owners have an override method to prove ownership. If I can create a CNAME record with an Azure endpoint I own, that should be all that is required to prove I own it and allow me to override. It's this backwards thinking that has me closing my Azure account and moving to AWS and not looking back. While the interface takes some getting used to by comparison, the AWS service is lightyears ahead of Azure.
Alex Dresko 11 Reputation points

2023-03-28T12:33:48.75+00:00

az feature register --namespace Microsoft.Network --name BypassCnameCheckForCustomDomainDeletion is not the correct fix for a CDN custom domain. The correct fix is az feature register --namespace Microsoft.Cdn --name BypassCnameCheckForCustomDomainDeletion.

6 answers

Your answer

Tomasz Kluczkowski 1 Reputation point

2022-09-26T13:56:53.507+00:00

I have identical issue.
Also run
az feature register --namespace Microsoft.Network --name BypassCnameCheckForCustomDomainDeletion

waited till
az feature list -o table --query "[?contains(name, 'Microsoft.Network/BypassCnameCheckForCustomDomainDeletion')].{Name:name,State:properties.state}"

shows that the feature got registered,
still unable to delete the endpoint

Did anyone figure out why this happens?
WWH 5 Reputation points

2023-02-02T23:00:44.19+00:00

It's absurd the way Microsoft behaves with DNS entries. They are completely out of touch with how DNS work is performed in the real work. There are plenty of scenarios where one organization is in control of DNS and another separate organization is in control of the cloud environment. Requiring DNS changes before making changes prevents a lot of prework and sometimes makes using certain services impossible because some organizations I work with have an issue with creating these fake "verify" records. They just flat out won't do it. AWS doesn't do anything like this, because they are intelligent enough to know that if you don't control DNS (the REAL DNS server) you can't do anything harmful to the masses if you setup a service on a DNS name you do not own. Sure you can prevent the real owners of the DNS name from using it, but that's an easy solve. Let the owners have an override method to prove ownership. If I can create a CNAME record with an Azure endpoint I own, that should be all that is required to prove I own it and allow me to override. It's this backwards thinking that has me closing my Azure account and moving to AWS and not looking back. While the interface takes some getting used to by comparison, the AWS service is lightyears ahead of Azure.
Alex Dresko 11 Reputation points

2023-03-28T12:33:48.75+00:00

az feature register --namespace Microsoft.Network --name BypassCnameCheckForCustomDomainDeletion is not the correct fix for a CDN custom domain. The correct fix is az feature register --namespace Microsoft.Cdn --name BypassCnameCheckForCustomDomainDeletion.

Answer 1

Tom Plant 16

CDNs are in the Microsoft.Cdn namespace, so you need to register its equivalent feature:

az feature register --namespace Microsoft.Cdn --name BypassCnameCheckForCustomDomainDeletion

Answer 2

Will 保哥 61

I think the following command works. You just need to wait for more than 10 minutes to effect.

az feature register --namespace Microsoft.Network --name BypassCnameCheckForCustomDomainDeletion

You can check the registering status by this:

az feature list -o table --query "[?contains(name, 'Microsoft.Network/BypassCnameCheckForCustomDomainDeletion')].{Name:name,State:properties.state}"

Nick Rochetti 6 Reputation points

2022-07-29T15:17:21.613+00:00

Thank you, this worked for me.

Answer 3

SaiKishor-MSFT 17,336

We are working offline with the customer regarding this issue and will update with the resolution once we have it. Thank you!

Answer 4

Anonymous

I am having the same issue, any information on this?

Answer 5

Sander de Koning 1

Same issue here. I'm not in control of the DNS registrations.

Share via

Cannot delete custom domain CDN

6 answers

Your answer