Domain verification failing

Question

Domain verification failing

Malcolm Domecq 0

domain verification taking too long or not completing in Azure App Service.

My domain is managed on the same azure account / subscription where I am trying to obtain the SSL certificate. The TXT has been added to the DNS

TP 162.1K Reputation points Volunteer Moderator

2026-07-22T17:29:43.92+00:00

Hi Malcolm, if you post the FQDN you are trying to add in a comment below I will query it and see if I see any issues. You may edit your comment immediately after posting so that the domain will not be public.
Vinayteja Lellela 110 Reputation points Microsoft External Staff Moderator

2026-07-22T19:18:38.37+00:00
Hello Malcolm,

Domain verification in Azure App Service can sometimes take longer than expected (or fail) even when the TXT record was added. Here are the key things to check based on the standard App Service verification flow and common DNS pitfalls.

What to verify in App Service

In the App Service portal, open the Domain Verification window and note the Domain Verification Token (Azure shows it for you).

Azure supports three verification methods:

HTML file hosted at the web root

DNS TXT record at the root domain

Email verification (via the verification link in email)

Since you’re using the TXT method: make sure the TXT record is created exactly as expected for App Service verification.

**Common causes of “taking too long” / not completing

**1) DNS propagation / propagation delays

Even after adding the TXT record, it can take time to propagate globally. A good practice is to validate using a public DNS tool (for example, DNS checkers) to confirm the TXT record is visible from the internet.

TXT record value formatting (exact match matters)

Azure domain verification expects the TXT value in the exact format Azure generated. Some DNS providers can accidentally introduce formatting issues (extra spaces/quotes, multiple TXT values combined in a way that doesn’t produce a standalone expected record, etc.). So double-check:

The TXT value exactly matches the token/value shown in the App Service Domain Verification UI.

The TXT record is not combined/merged in a way that prevents Azure from seeing the token as a standalone TXT entry.

Make sure there aren’t stale/conflicting DNS records

If you previously had old TXT records (or other conflicting records), verification may behave unexpectedly. Consider removing stale/conflicting TXT entries and retry verification.

Private DNS zones aren’t supported

If you’re using Private DNS for this domain, that can prevent validation. Custom domain binding verification isn’t supported with Private DNS zones—use public DNS resolution for verification.

Private endpoints / name resolution issues

Private endpoints or related routing can interfere with how the verification service reaches DNS. If possible, confirm the domain resolves publicly as expected.

Quick next steps to try

Confirm the TXT record is visible publicly (not just configured in Azure / in your account) and that the TXT value matches exactly what App Service expects.

If changes were just made: wait for propagation and re-run verification.

If you’ve previously tried verification and left older TXT records behind: clean up stale ones and retry.ale ones and retry.

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

If these answer your question, click "Upvote" which may be beneficial to other community members reading this thread.
Vinayteja Lellela 110 Reputation points Microsoft External Staff Moderator

2026-07-24T01:02:39.3633333+00:00

Hello Malcolm, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.
Vinayteja Lellela 110 Reputation points Microsoft External Staff Moderator

2026-07-25T16:48:56.46+00:00

Hello Malcolm, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

1 answer

Your answer

TP 162.1K Reputation points Volunteer Moderator

2026-07-22T17:29:43.92+00:00

Hi Malcolm, if you post the FQDN you are trying to add in a comment below I will query it and see if I see any issues. You may edit your comment immediately after posting so that the domain will not be public.
Vinayteja Lellela 110 Reputation points Microsoft External Staff Moderator

2026-07-24T01:02:39.3633333+00:00

Hello Malcolm, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.
Vinayteja Lellela 110 Reputation points Microsoft External Staff Moderator

2026-07-25T16:48:56.46+00:00

Hello Malcolm, following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

Answer 1

Christos Panagiotidis 3,546

The domain being in the same Azure subscription does not bypass public DNS validation. In the App Service Custom domains blade, copy the app’s Custom Domain Verification ID and compare it with the publicly resolvable TXT record. For an apex name, the TXT host should be asuid; for www.example.com, it should be asuid.www. Also confirm that the registrar delegates the domain to the Azure DNS name servers for the zone you edited; otherwise the TXT record exists in a non-authoritative zone and App Service cannot see it.

The hostname itself must also map to the app: use an A record to the app’s inbound IP for the apex, or a direct CNAME to <app>.azurewebsites.net for a subdomain. After the public records resolve correctly, run Validate again. Managed-certificate issuance can then take a few minutes. If validation still fails, open an App Service support request with the FQDN and validation timestamp.

Malcolm Domecq 0 Reputation points

2026-07-23T08:25:09.1133333+00:00

thank you for the contribution, Christos.

I added the TXT on the Azure DNS Management Record Set as indicated on the instructions for my domain (image 1) but still does not resolve and that is the reason why I initiated the thread.
Using who.is is see that the DNS for my domain domecqconsulting.com still resolves to a previous Azure Web App for Word Press (image 2). I deleted the Azure Web App to see if this removes the bindings / DNS

My Goal is to move it to Power Pages for which I need my new SSL certificate.

Image 1

image 2