Share via

Best way to handle root apex pointing to an external URL in Azure Public DNS

VERNAL COOPER 20 Reputation points
2026-05-22T12:19:22.23+00:00

In Azure DNS you can't apply a CNAME to the root apex.

What is the best way to handle this.

Moving DNS is not an option.

Azure DNS
Azure DNS

An Azure service that enables hosting Domain Name System (DNS) domains in Azure.

0 comments

Answer accepted by question author

Venkatesan S 9,565 Reputation points Microsoft External Staff Moderator
2026-05-25T14:59:53.63+00:00

Hi VERNAL COOPER,

Thanks for reaching out in Microsoft Q&A forum,

You’re right DNS standards don’t let you slap a CNAME on the naked (apex) domain, so you have to work around it. Here are the most common approaches in Azure DNS without moving your zone:

  1. If your external URL lives on a static IP • Lookup its A (and AAAA) record(s) with nslookup or dig • In your Azure DNS zone, create an “A” record (and “AAAA” if needed) for “@” pointing to that IP • Clients hit your apex domain directly at that IP
  2. If it doesn’t have a stable IP (or you want health-checks/load balancing) a) Use Azure Traffic Manager
  • Create a Traffic Manager profile
    • Add an “External Endpoint” pointing to your external URL
    • In Azure DNS, create an Alias A record at “@” targeting the Traffic Manager profile
    • DNS will return the TM endpoint IP and TM will forward to your URL
    b) Or use Azure Front Door similarly 
      - Add your apex domain as a custom domain in Front Door  
  
  
  - Front Door backend points to the external URL
    • Create an Alias A record in Azure DNS for “@” > your Front Door endpoint
  1. If you just need a simple HTTP redirect (301) • Spin up a tiny Azure App Service or Storage Static Website that issues a permanent redirect to your external URL • Use an Alias A record on “@” pointing at that App Service/Storage endpoint IP or resource

Those Alias record sets avoid the CNAME-at-root restriction by pointing at Azure resources (Traffic Manager, Front Door, CDN, App Service, etc.). Pick the option that fits your needs static IP, health-checks, or simple redirect.

References :

  1. Azure Public DNS overview & alias records https://learn.microsoft.com/azure/dns/public-dns-overview#alias-records
  2. Host load-balanced apps at the zone apex (Traffic Manager + Alias) https://learn.microsoft.com/azure/dns/dns-alias-appservice#create-a-traffic-manager-profile
  3. Use Azure DNS to provide custom domain settings (A records) https://learn.microsoft.com/azure/dns/dns-custom-domain#public-ip-address
  4. Set up an apex domain with Azure DNS in Static Web Apps (Alias + TXT) https://learn.microsoft.com/azure/static-web-apps/apex-domain-azure-dns
  5. What is Azure Public DNS? (alias record capabilities) https://learn.microsoft.com/azure/dns/public-dns-overview

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to 210246-screenshot-2021-12-10-121802.pngand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-05-22T12:19:37.3466667+00:00

    Use an A/AAAA or alias record at the apex instead of a CNAME.

    DNS standards do not allow a CNAME at the zone apex because the apex already contains NS and SOA records. Azure DNS follows these standards, so a CNAME at @ (the root) is blocked.

    In Azure DNS:

    1. Represent the apex using @ as the record name.
    2. Create one of the following:
      • An A record (and optionally AAAA) pointing directly to the IPv4/IPv6 address of the external endpoint.
      • An alias record set (if the external target is an Azure resource such as a Public IP, Traffic Manager profile, or CDN endpoint). The alias record automatically tracks IP changes of the referenced Azure resource.

    Notes:

    • For external services that only expose a hostname (no fixed IP), the only standards-compliant option at the apex is to resolve that hostname to its current IPs and configure those as A/AAAA records in Azure DNS, updating them as needed.
    • CNAMEs remain valid for non-apex names (for example, www.contoso.com) and can point to external hostnames.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.