Domain validation problem - Rejected

Question

Domain validation problem - Rejected

Luis Nishimori 0

I would like to know the detailed reason why one of the domains I registered in AFD was marked as rejected.

I checked using nslookup and the TXT record is configured correctly, including both the host and the value.

Mahmud Elgoueri 0 Reputation points

2026-05-19T11:59:08.88+00:00

Hi Luis,

If your local nslookup is showing the correct TXT record but Azure Front Door (AFD) still marks it as Rejected, it usually comes down to one of these three issues:

1 Microsoft Threat Intelligence Block (Most Common): Azure automatically rejects domains that are newly registered or have a low reputation score to prevent abuse.

Fix: You must open an Azure Support ticket and ask them to manually review and unblock the domain.

2 Validation Token Timeout: If DNS propagation took too long, the original validation token may have simply expired.

Fix: Delete the custom domain from your AFD profile, re-add it to generate a fresh TXT token, and update your DNS.

3 Hidden DNS Formatting Errors: Sometimes registrars append the domain twice without showing it in the GUI (e.g., _dnsauth.yourdomain.com.yourdomain.com).

Verify the record externally using a global tool like MxToolbox or dig rather than just local cached nslookup. Next Step: Try removing and re-adding the domain in AFD first. If the new token is immediately rejected, it’s almost certainly a Threat Intel block, and you'll need to contact Azure Support.
Ravi Varma Mudduluru 12,370 Reputation points Microsoft External Staff Moderator

2026-05-19T13:47:34.1433333+00:00

Hello @Luis Nishimori

Thank you for contacting us about the AFD issue. We have begun looking into it and will share our suggestions with you as soon as possible.
Ravi Varma Mudduluru 12,370 Reputation points Microsoft External Staff Moderator

2026-05-19T13:48:05.3933333+00:00

Hello @Luis Nishimori

Could you please check the private message and share the requested details there?

1 answer

Your answer

Mahmud Elgoueri 0 Reputation points

2026-05-19T11:59:08.88+00:00

Hi Luis,

If your local nslookup is showing the correct TXT record but Azure Front Door (AFD) still marks it as Rejected, it usually comes down to one of these three issues:

1 Microsoft Threat Intelligence Block (Most Common): Azure automatically rejects domains that are newly registered or have a low reputation score to prevent abuse.

Fix: You must open an Azure Support ticket and ask them to manually review and unblock the domain.

2 Validation Token Timeout: If DNS propagation took too long, the original validation token may have simply expired.

Fix: Delete the custom domain from your AFD profile, re-add it to generate a fresh TXT token, and update your DNS.

3 Hidden DNS Formatting Errors: Sometimes registrars append the domain twice without showing it in the GUI (e.g., _dnsauth.yourdomain.com.yourdomain.com).

Verify the record externally using a global tool like MxToolbox or dig rather than just local cached nslookup. Next Step: Try removing and re-adding the domain in AFD first. If the new token is immediately rejected, it’s almost certainly a Threat Intel block, and you'll need to contact Azure Support.
Ravi Varma Mudduluru 12,370 Reputation points Microsoft External Staff Moderator

2026-05-19T13:47:34.1433333+00:00

Hello @Luis Nishimori

Thank you for contacting us about the AFD issue. We have begun looking into it and will share our suggestions with you as soon as possible.
Ravi Varma Mudduluru 12,370 Reputation points Microsoft External Staff Moderator

2026-05-19T13:48:05.3933333+00:00

Hello @Luis Nishimori

Could you please check the private message and share the requested details there?

Answer 1

Hello @Luis Nishimori

when a custom domain shows up as Rejected in Azure Front Door it means the certificate authority actually refused to issue the managed certificate for your domain. It isn’t just a DNS lookup problem—it’s a CA-level rejection. Here’s what you can check and try:

Click the “Rejected” status in the portal

In your Front Door profile under Settings → Domains, click the domain name, then click the Rejected link.
- On the validation page, hit Regenerate. This gives you a fresh TXT validation token.

Verify you’re using the correct TXT record format

For Front Door (both Classic and Standard/Premium), the TXT record name must be _dnsauth.<your-subdomain> (not asuid or any other prefix).
Paste the new token exactly as shown in the portal.
Set TTL to something low (e.g. 3600 seconds) so changes propagate quickly.

Check global propagation

Use a tool like https://dnschecker.org/ to confirm your _dnsauth TXT record is visible worldwide.
Remember stale DNS caches can linger, so you might need to wait up to an hour (TTL) or flush your local DNS cache (ipconfig /flushdns).

Make sure there are no conflicting DNS records

Don’t have other TXT records or CNAME/A records for the same name that could confuse the CA check.
Confirm your CNAME for traffic routing points only to your Front Door endpoint (for example, contoso.z01.azurefd.net or similar).

Re-validate in the portal

After DNS propagates, go back to your domain in Front Door and click Refresh (or Retry).
If the record matches what Front Door expects, the status should go to Approved within minutes.

Reference list:

Domains in Azure Front Door → Domain validation states: https://learn.microsoft.com/azure/frontdoor/domain#domain-validation
Add a custom domain to Azure Front Door: https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain
Troubleshoot custom domain problems in App Service (DNS record patterns): https://learn.microsoft.com/azure/app-service/troubleshoot-domain-ssl-certificates#custom-domain-problems

If the above steps didn't fix the issue, could you please check the private message and share the requested details there?

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Ganesh Patapati 11,915 Reputation points Microsoft External Staff Moderator

2026-06-05T10:48:53.7033333+00:00

Hello Luis,

I see Ravi Varma has addressed your queries.

Just checking in to see if the information was helpful. If you have any further updates on this issue, please feel free to post back.

If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

Share via

Domain validation problem - Rejected

1 answer

Your answer