Azure DNS setup
If your domain’s DNS is hosted in Azure DNS, connecting it to Redirect Supply means adding a few record sets to your DNS zone. Nothing else in Azure needs to change: no Front Door, no App Service, no certificate. Your domain stays wherever it’s registered, and the setup takes about five minutes.
Before you start
You need two things ready before you open the Azure portal.
Add the domain in Redirect Supply
Add your domain in Redirect Supply first. Its settings page shows the records you’ll need, including a TXT value that’s unique to your domain. Keep that page open in another tab. This guide covers a root domain like brand.com. If you’re connecting a subdomain like go.brand.com, the DNS setup guide explains the differences.
Make sure the zone is the live one
Azure DNS only answers for your domain when your registrar points to the name servers assigned to this zone, the ones ending in azure-dns.com, .net, .org and .info. If the zone was ever recreated, they may have changed. Compare the NS record set in the zone with what your registrar shows before you start.
Open your DNS zone
All the changes in this guide happen in one zone.
Find the zone
Sign in to the Azure portal, search for DNS zones, and select your domain’s zone. The overview lists every record set and has a + Record set button at the top.
Records you’ll see there
Every zone has NS and SOA record sets. Leave those alone. If the domain served something on Azure before, you’ll often find an A record set on @, sometimes as an alias record pointing to an Azure resource, and a record set for www. Those use the names Redirect Supply needs. Not sure what else counts? The conflict table on your domain’s page in Redirect Supply lists every record that blocks the setup.
Clear the way
Before adding anything, remove what’s already pointing your domain elsewhere.
Delete old @ and www record sets
Select the A and AAAA record sets on @, including alias record sets, and any record set on www, then delete them. Azure keeps one record set per name and type, so you can also edit an existing A record set on @ instead of deleting it.
Clean up Azure resources later
If you used Front Door, App Service or a storage account to handle redirects before, leave them running until Redirect Supply shows the domain as Active. Then you can remove them.
Leave NS, SOA and email records alone
NS and SOA record sets keep the zone working, and MX and email TXT records keep your email working. None of them affect redirects, so leave them exactly as they are.
Add the Redirect Supply records
You’ll add three record sets with + Record set. Enter @ as the name for the root domain, or just the prefix for anything else. Keep the default TTL.
Name | Type | Value |
|---|---|---|
www | CNAME | proxy.redirect.supply |
@ | A | 188.114.96.9 |
@ | A | 188.114.97.9 |
_cf-custom-hostname | TXT | Value from your domain’s settings page |
Note: Enter both IPs in one A record set.
Add one A record set with two addresses
Select + Record set, enter @ as the name, choose A, and set Alias record set to No. Enter 188.114.96.9 as the first IP address and 188.114.97.9 as the second, then select OK. Azure keeps both addresses in one record set.
Add the www CNAME
Add a record set with name www, type CNAME and alias proxy.redirect.supply. Azure only allows a CNAME when it’s the only record set on that name, so www has to be empty first.
Add the TXT record
Add a record set with name _cf-custom-hostname, type TXT, and paste the value from your domain’s settings page in Redirect Supply. On some less common domain endings, Redirect Supply also asks for an _acme-challenge TXT record. Add it the same way if you see it.
Check the zone
Each record set is live once it’s saved. Look over the zone to make sure there’s one A record set with two addresses on @, the www CNAME and the TXT record, and no alias record set left behind.
Check the status in Redirect Supply
Once the record sets are saved, you’re done in Azure.
Check the conflict table
You don’t have to wait to find out if something’s wrong. Your domain’s page in Redirect Supply shows a conflict table with the records currently on your domain. Anything that blocks the setup, like an old alias record set or a leftover www record, is flagged there along with what to do about it. Fix those first, and the rest is just waiting.
How long it takes
Azure DNS usually applies changes within a minute or two. How quickly the old records disappear depends on their TTL.
When the domain goes Active
Redirect Supply checks your records automatically. When it finds them, the domain switches to Active and HTTPS is issued on its own, with no Azure certificates involved. See Domain statuses for what each status means along the way.
Azure DNS-specific issues
Most problems with Azure DNS come from alias record sets or a zone mix-up.
Records have no effect
Your registrar points to different name servers than this zone uses, often because there’s a second zone for the same domain in another subscription. Point the registrar to the name servers in this zone’s NS record set.
Azure won’t create the record set
A record set with that name and type already exists, often an alias record set. Edit it or delete it, then try again.
Azure won’t create the www CNAME
Another record set already exists on www. Delete it first, because a CNAME has to be the only record set on its name.
The domain is stuck on Pending
Open the conflict table on your domain’s page in Redirect Supply. It shows which record is blocking the setup, usually an old alias record set or an old www record. Remove what it flags and wait a few minutes. Record conflicts covers the common cases.