App service allows any custom domain

Question

App service allows any custom domain

Lukasz Malec 0

Hello,
Something has changed and domain ownership status is no longer validated correctly. I can pass validation and add custom binding to arbitrary domain that I don't own. Is this a bug?
User's image

edited PII info

Praneeth Maddali 6,935 Reputation points Microsoft External Staff Moderator

2026-04-03T17:40:56.3+00:00
Hi @Lukasz Malec

Thanks for sharing the screenshot and details — I can see exactly what you're seeing with the green "Validation passed" on XXX.fXXX.com.

This isn’t a bug. Azure App Service verifies domain ownership by checking for the specific asuid.dev TXT record containing the unique token it generates. Only someone who controls the domain’s DNS can add that record, which is why the validation passed.

Once added, the binding remains active until you manually remove it (Azure doesn’t re-validate continuously).

Quick fix if this was a test domain you don’t own:

Go to your App Service >Custom domains.

Find XXX.fXXX.com., click the menu > Delete.

For production domains, always ensure the TXT record (asuid.<subdomain>) matches exactly. You can verify it with nslookup -type=TXT asuid.XXX.fXXX.com or use the Diagnose and solve problems → SSL and domains tool in the portal.

Reference:

https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain?tabs=root%2Cazurecli

https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/connection-issues-with-ssl-or-tls/troubleshoot-custom-domain-issues-azure-app-service

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Praneeth Maddali 6,935 Reputation points Microsoft External Staff Moderator

2026-04-06T09:40:41.1833333+00:00

Hi @Lukasz Malec

Just following up to see if your issue has been resolved or if you had a chance to review my earlier comment?

1 answer

Your answer

Praneeth Maddali 6,935 Reputation points Microsoft External Staff Moderator

2026-04-03T17:40:56.3+00:00

Hi @Lukasz Malec

Thanks for sharing the screenshot and details — I can see exactly what you're seeing with the green "Validation passed" on XXX.fXXX.com.

This isn’t a bug. Azure App Service verifies domain ownership by checking for the specific asuid.dev TXT record containing the unique token it generates. Only someone who controls the domain’s DNS can add that record, which is why the validation passed.

Once added, the binding remains active until you manually remove it (Azure doesn’t re-validate continuously).

Quick fix if this was a test domain you don’t own:

Go to your App Service >Custom domains.

Find XXX.fXXX.com., click the menu > Delete.

For production domains, always ensure the TXT record (asuid.<subdomain>) matches exactly. You can verify it with nslookup -type=TXT asuid.XXX.fXXX.com or use the Diagnose and solve problems → SSL and domains tool in the portal.

Reference:

https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain?tabs=root%2Cazurecli

https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/connection-issues-with-ssl-or-tls/troubleshoot-custom-domain-issues-azure-app-service

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.
Praneeth Maddali 6,935 Reputation points Microsoft External Staff Moderator

2026-04-06T09:40:41.1833333+00:00

Hi @Lukasz Malec

Just following up to see if your issue has been resolved or if you had a chance to review my earlier comment?

Answer 1

Azure App Service still requires proof of domain ownership; it does not intentionally allow arbitrary domains to be bound.

From the documented behavior:

Domain ownership is validated by checking that the required DNS records (CNAME/A and usually the asuid TXT record) exist in the authoritative DNS zone for the domain and are publicly resolvable.
Validation succeeds only when those records are present and match the values that App Service expects. If the TXT or CNAME/A records are missing, incorrect, or not yet propagated, validation fails with errors such as Cannot verify domain ownership or DNS record could not be located.
Internal or non‑resolvable domains cannot be validated on the public multi‑tenant App Service at all.

If a domain that is not actually owned can be validated and added, that indicates a misconfiguration in DNS (for example, the domain’s DNS already contains the CNAME/TXT values pointing to the app) or a platform issue. The platform is designed to prevent “hijacking” by requiring the TXT verification record and matching CNAME/A records.

Recommended actions:

Confirm which DNS provider is authoritative for the domain and verify the TXT and CNAME/A records there (not just at the registrar UI). Use public DNS tools as described in the troubleshooting guidance to see what Azure is actually reading.
If validation is succeeding without the expected DNS records being present in the authoritative zone, open an Azure Support ticket. Provide:
- The App Service name and region.
- The exact custom hostname.
- DNS query results (TXT and CNAME/A) from public resolvers.

This scenario should be treated as a support case so the Azure App Service team can investigate whether there is a platform bug or stale validation state.

References:

Share via

App service allows any custom domain

1 answer

Your answer