Map existing custom DNS name - Azure App Service

Prerequisites

Create an App Service app , or use an app that you created for another tutorial. The web app's App Service plan must be a paid tier and not Free (F1) . See Scale up an app to update the tier.

Make sure you can edit the DNS records for your custom domain. To edit DNS records, you need access to the DNS registry for your domain provider, such as GoDaddy. For example, to add DNS entries for


    contoso.com

and


    www.contoso.com

, you must be able to configure the DNS settings for the


    contoso.com

root domain. Your custom domains must be in a public DNS zone; private DNS zones are not supported.

If you don't have a custom domain yet, you can purchase an App Service domain instead.

1. Configure a custom domain

In the Azure portal , navigate to your app's management page.

In the left menu for your app, select Custom domains .

Select Add custom domain .

For Domain provider , select All other domain services to configure a third-party domain.

To configure an App Service domain, see Buy a custom domain name for Azure App Service .

For TLS/SSL certificate , select App Service Managed Certificate if your app is in Basic tier or higher. If you want to remain in Shared tier, or if you want to use your own certificate, select Add certificate later .

For TLS/SSL type , select the binding type you want.

Setting Description TLS/SSL Type - SNI SSL : Multiple SNI SSL bindings may be added. This option allows multiple TLS/SSL certificates to secure multiple domains on the same IP address. Most modern browsers (including Internet Explorer, Chrome, Firefox, and Opera) support SNI (for more information, see Server Name Indication ).
- IP SSL : Only one IP SSL binding may be added. This option allows only one TLS/SSL certificate to secure a dedicated public IP address. After you configure the binding, follow the steps in 2. Remap records for IP based SSL .
IP SSL is supported only in Standard tier or above.

For Domain, specify a fully qualified domain name you want based on the domain you own. The Hostname record type box defaults to the recommended DNS record to use, depending on whether the domain is a root domain (like contoso.com ), a subdomain (like www.contoso.com , or a wildcard domain *.contoso.com ).

Don't select Validate yet.

For each custom domain in App Service, you need two DNS records with your domain provider. The Domain validation section shows you two DNS records that you must add with your domain provider. Select the respective Copy button to help you with the next step.

The following screenshot shows the default selections for a www.contoso.com domain, which shows a CNAME record and a TXT record to add.

Warning

While it's not absolutely required to add the TXT record, it's highly recommended for security. The TXT record is a domain verification ID that helps avoid subdomain takeovers from other App Service apps. For custom domains you previously configured without this verification ID, you should protect them from the same risk by adding the verification ID (the TXT record) to your DNS configuration. For more information on this common high-severity threat, see Subdomain takeover .

You can use Azure DNS to manage DNS records for your domain and configure a custom DNS name for Azure App Service. For more information, see Tutorial: Host your domain in Azure DNS .

Find the page for managing DNS records.

Every domain provider has its own DNS records interface, so consult the provider's documentation. Look for areas of the site labeled Domain Name , DNS , or Name Server Management .

Often, you can find the DNS records page by viewing your account information and then looking for a link such as My domains . Go to that page, and then look for a link that's named something like Zone file , DNS Records , or Advanced configuration .

The following screenshot is an example of a DNS records page:

Select Add or the appropriate widget to create a record.

For certain providers, such as GoDaddy, changes to DNS records don't become effective until you select a separate Save Changes link.

Select the type of record to create and follow the instructions. You can use either a CNAME record or an A record to map a custom DNS name to App Service. When your function app is hosted in a Consumption plan , only the CNAME option is supported.

Root domain (e.g. contoso.com) Subdomain (e.g. www.contoso.com) Wildcard (CNAME) The app's IP address shown in the Add custom domain dialog. The domain mapping itself (

typically represents the root domain).


    asuid

The domain verification ID shown in the Add custom domain dialog. For root domain, App Service accesses


    asuid

TXT record to verify your ownership of the custom domain. <subdomain> (for example, www) IP address shown in the Add custom domain dialog. The domain mapping itself. asuid.<subdomain> (for example, asuid.www) The domain verification ID shown in the Add custom domain dialog. App Service accesses the


    asuid.<subdomain>

TXT record to verify your ownership of the custom domain.


    asuid.<subdomain>

(for example,


    asuid.www

) The domain verification ID shown in the Add custom domain dialog. App Service accesses the


    asuid.<subdomain>

TXT record to verify your ownership of the custom domain.

If you configured the TXT record but not the A or CNAME record, App Service treats it as a domain migration scenario and allows the validation to succeed, but you won't see green check marks next to the records.

You should see the custom domain added to the list. You may also see a red X with No binding .

If you selected App Service Managed Certificate earlier, wait a few minutes for App Service to create the managed certificate for your custom domain. When the process is complete, the red X becomes a green check mark with Secured . If you selected Add certificate later , this red X will remain until you add a private certificate for the domain and configure the binding .

If you receive an HTTP 404 (Not Found) error when you browse to the URL of your custom domain, the two most-likely causes are:

The browser client has cached the old IP address of your domain. Clear the cache, and test DNS resolution again. On a Windows machine, you clear the cache with


    ipconfig /flushdns

You configured an IP-based certificate binding, and the app's IP address has changed because of it. Remap the A record in your DNS entries to the new IP address.

If you receive a Page not secure warning or error, it's because your domain doesn't have a certificate binding yet. Add a private certificate for the domain and configure the binding .

(Optional) Automate with scripts

You can automate management of custom domains with scripts by using the Azure CLI or Azure PowerShell .

Azure CLI PowerShell

The following command adds a configured custom DNS name to an App Service app.

az webapp config hostname add \
    --webapp-name <app-name> \
    --resource-group <resource_group_name> \
    --hostname <fully_qualified_domain_name>
For more information, see Map a custom domain to a web app.
The following command adds a configured custom DNS name to an App Service app.
Set-AzWebApp `
    -Name <app-name> `
    -ResourceGroupName <resource_group_name> ` 
    -HostNames @("<fully_qualified_domain_name>","<app-name>.azurewebsites.net")
For more information, see Assign a custom domain to a web app.
Next steps
Purchase an App Service domain.
Secure a custom DNS name with a TLS/SSL binding in Azure App Service