Domain validation steps for Azure Front Door Standard SKU certificate renewal

Question

I am using Azure Front Door Standard SKU (Preview) with AFD-managed certificate. My custom domain is proxied through Cloudflare thus running nslookup won't show Front Door's endpoint xxxx.z01.azurefd.net.

When I add a new custom domain to Azure Front Door, it will ask me to add a TXT record _dnsauth.test.example.com with verification token and the domain Provisioning state would be "Succeeded" and Validation state would be "Approved". I then add a CNAME record that points to test.z01.azurefd.net and the connection would work.

When the AFD-managed certificate nearly expires, Front Door would automatically renew the certificate. I understand that before each renewal, it would validate domain ownership. I would like to know if it will check for CNAME record that points to test.z01.azurefd.net or it will check for the same TXT record that I added during custom domain creation?

My concern is that I would like to proxy my domain name though Cloudflare and if it checks for CNAME record, it would fail. But there will be no problem if it checks for the TXT record like it did during custom domain creation.

Which DNS record does it validate?

Thank you.

Answer 1

Hello @Pitawat ,

It will validate the CNAME DNS record. As per the documentation here the auto rotation won't happen if your custom domain points to Azure Front Door through a long chain, for example, putting an Azure Traffic Manager before Azure Front Door and other CDN providers. The domain validation state will become ‘Pending Revalidation’ 45 days before managed certificate expiry or ‘Rejected’ if the managed certificate issuance is rejected by the certificate authority.

You can go through this Domain validation state documentation for required action for each state.

In case of Pending re-validation state. This happens when the managed certificate is 45 days or less from expiry. If the custom domain is pointing to other CNAME records, please click on ‘Pending Revalidation’ and hit ‘Regenerate’ on the ‘Validate the custom domain’ page. Then click on Add or add the TXT record with your own DNS provider’s DNS management.

Hope this helps! Please let me know if you have any additional questions. Thank you!

----------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.