An Azure service that enables hosting Domain Name System (DNS) domains in Azure.
For custom domain verification failures, check these items in order:
- Wait and retry. DNS propagation can take at least an hour, and in some cases longer depending on the registrar.
- Verify the DNS record exactly matches what Azure provided. Add the TXT or MX record shown for the domain, and set TTL to 3600 seconds (60 minutes). If the record was entered incorrectly or duplicated, wait for the TTL to expire before retrying.
- Confirm the record is publicly visible.
From Windows Command Prompt, query the TXT record:
If the expected TXT value does not appear, Azure cannot verify the domain.nslookup -q=TXT yourdomain.com - Verify the domain in the correct portal location. In the Microsoft Entra admin center, go to Entra ID > Domain names, select the custom domain, and choose Verify.
- Check whether the domain is already verified in another directory or tenant. A custom domain can only be verified in one directory at a time. If it is still attached to an old directory, it must be removed there before it can be verified again.
- Check for an unmanaged Power BI tenant. If users previously signed up through self-service Power BI, an unmanaged tenant might be holding the domain. That tenant must be taken over before the domain can be reused.
- If this is for Azure App Service, validate the domain again after DNS is correct. In Azure portal > App Service > Custom domains, select Add custom domain, enter the hostname, and select Validate. If the portal reports the domain is already in use or linked to another app, remove it from the other resource first. If access to that old resource is no longer available, a support ticket is required to release the domain.
- If repeated validation still fails in App Service, use diagnostics. Go to App Service > Diagnose and Solve Problems > SSL and Domains > Run All Certificates & Domains Checks.
If the domain was previously used in another tenant and that tenant or resource was deleted without removing the domain first, the old association can block reuse until it is removed or released.