Skip to main content
Custom domains let you brand your Azure App Service instead of using the default azurewebsites.net hostname. This guide explains how to prove domain ownership, map hostnames, and secure the domain with SSL/TLS so your app is served over HTTPS. Why it matters: using a custom domain improves trust and discoverability (SEO) and lets you present a consistent brand to users.

​
Overview: domain validation and mapping

Before binding a custom domain to an App Service you must verify ownership. Azure App Service supports both CNAME (recommended for subdomains) and A record (required for apex/root domains) mappings — but both flows start with a TXT verification record (verification ID). Summary of DNS records needed:
DNS changes can take time to propagate. If your DNS is delegated to Azure DNS, propagation and validation may be quicker.

​
Step-by-step: Add a custom domain in the Azure portal

  1. In the Azure portal open your App Service.
  2. Go to Custom domains → Add custom domain.
  3. Select whether the domain is an App Service Domain (purchased through Azure) or from another registrar.
  4. Enter the hostname to add (for example www.furbis.com).
  5. Choose the validation method:
    • For subdomains choose CNAME validation. Azure will show the TXT verification record and the CNAME target.
    • For apex/root domains choose A Record validation. Azure will show the TXT verification record and the A record target (App Service IP).
  6. Add the TXT verification record to your DNS zone (Azure displays the verification ID and the TXT record name/value). Then add the CNAME or A record as shown.
  7. After creating the DNS records, return to the portal and click Validate. Azure will query public DNS to ensure the TXT and mapping records exist.
  8. If validation succeeds click Add to bind the hostname to the App Service.
A screenshot of the Microsoft Azure portal showing the "kodekloudemoapp" Web App Custom domains page. The "Add custom domain" pane is open on the right, showing domain, hostname record type and DNS validation records (CNAME and TXT).
When validation succeeds the hostname appears in your custom domains list. Note: the domain is mapped at this point, but unless you create an SSL/TLS binding the portal will show “No binding” for TLS. I added the required TXT and mapping records, validated them in the portal, and clicked Add. The custom domain was successfully added, but the portal indicates “No binding” because no SSL certificate is assigned yet.
Screenshot of the Microsoft Azure portal on the "Custom domains" page for the web app "kodekloudemoapp," showing the app's IP address and custom domain verification ID. The domain list shows "www.firbish.com" with "No binding" and the default kodekloudemoapp.azurewebsites.net entry marked "Secured."

​
Browsing before SSL is configured

If you visit the custom domain before adding a certificate, browsers may show a security warning because the certificate served by the App Service is not matched to your custom hostname. This is expected until you bind a proper certificate for that hostname.
A browser privacy/security warning page saying "Your connection isn't private" with a red triangle and details about a certificate name mismatch (NET::ERR_CERT_COMMON_NAME_INVALID). It shows the site www.firbish.com and offers buttons to go back or continue (unsafe).

​
Securing the custom domain with SSL/TLS

To remove the “Not secure” warning:
  • Upload a certificate you own (PFX) to App Service and create an SSL binding for the hostname, or
  • Use Azure App Service Managed Certificate (free) if your scenario meets the managed certificate restrictions (note: managed certificates have limitations such as no wildcard support and no root/apex binding in some cases).
After assigning a certificate and creating the SSL binding, the custom domain will serve HTTPS with a valid certificate that matches the hostname.

​
Quick checklist

  • Ensure your App Service plan is Basic or higher.
  • Create TXT verification record in your DNS zone.
  • Create CNAME (subdomain) or A record (apex/root) per Azure portal instructions.
  • Click Validate and Add in the portal.
  • Upload or create an SSL certificate and bind it to the hostname.
  • Test over HTTPS and confirm there are no certificate warnings.
Custom domains require at least the Basic App Service plan. Attempting to add custom domains from Free or Shared tiers will fail.

Watch Video