Apex domain in Azure Front Door via bicep template never validates

[Gansted]

Bicep version
0.16.1

Describe the bug
We have an issue registering our apex domain as a custom domain in Azure Front Door via our bicep template.

We can register the domain from the portal without any issue but when we redeploy our bicep template the association in Front Door is removed, and the domain does not validate unless we manually update it from the portal.

To Reproduce
Add the following to your bicep template with frontDoorProfile set as resource reference to your frontdoor profile, and customDomains containing at least one apex/root domain :

resource custom_domains 'Microsoft.Cdn/profiles/customDomains@2020-09-01' = [for (customdomain, index) in customDomains: {
  name: replace(customdomain, '.', '-')
  parent: frontDoorProfile
  properties: {
    hostName: customdomain
    tlsSettings: {
      certificateType: 'ManagedCertificate'
      minimumTlsVersion: 'TLS12'
    }
  }
}]

Additional context
No errors are thrown during provisioning but the domain never validates. If customDomains contains subdomains these validate without issue.

[brwilkinson]

Hi @Gansted

In order for the domain to validate, it requires that you create a TXT record to show that you own the domain.

Did you complete that step ?

If you are using Azure DNS, you can generate the DNS TXT record in your Bicep deployment.

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/FD.CDN-Profiles-AFDEP-EP.bicep#L83-L115

here is a sample of using the output from the customDomains creation

//  to do figure out to the check domain validation, move this to nexted deployment
var createTXTVerify = custom_domains.properties.domainValidationState == 'Approved' ? false : true

So based on this if it's deployed and not approved, you can take this other value and create the DNS entry with the validationToken.

Name: '_dnsauth'
Value: custom_domains.properties.validationProperties.validationToken

If you are not using Azure DNS, then you can manually create this TXT record in your DNS Server and it will validate once it is able to read the records.

• edit: not sure if apex is supported via other DNS, docs aren't clear, more below.

[brwilkinson]

Adding docs link

• https://learn.microsoft.com/en-us/azure/frontdoor/front-door-how-to-onboard-apex-domain?pivots=front-door-standard-premium

Apex domains are at the root of a DNS zone and don't contain subdomains. For example, contoso.com is an apex domain. Azure Front Door supports adding apex domains when you use Azure DNS. For more information about apex domains, see Domains in Azure Front Door.

• https://learn.microsoft.com/en-us/azure/frontdoor/apex-domain#txt-record-validation

[brwilkinson]

full sample standalone

main.bicep

param zone string = 'psthing.com'
param profileName string = 'aeu1pectld1cdnshared01'
param zoneResourceGroup string = 'aeu1-pe-ctl-rg-p0'

resource DNS 'Microsoft.Network/dnsZones@2018-05-01' existing = {
  name: zone
  scope: resourceGroup(zoneResourceGroup)
}

resource CDN 'Microsoft.Cdn/profiles@2022-11-01-preview' existing = {
  name: profileName

  resource customDomain 'customDomains' = {
    name: replace(zone, '.', '-')
    properties: {
      hostName: zone
      tlsSettings: {
        certificateType: 'ManagedCertificate'
        minimumTlsVersion: 'TLS12'
      }
      azureDnsZone: {
        id: DNS.id //<-- based on th docs you might want to add this value as well.
      }
    }
  }
}

module verifyDNS 'x.DNS.Public.TXT.bicep' = {
  name: 'dp-AddDNSVerifyTXT-${zone}'
  scope: resourceGroup(zoneResourceGroup)
  params: {
    name: '_dnsauth'
    DomainNameExt: zone
    value: CDN::customDomain.properties.validationProperties.validationToken
  }
}

x.DNS.Public.TXT.bicep

param name string
param value string
param DomainNameExt string

resource DNSExternal 'Microsoft.Network/dnsZones@2018-05-01' existing = {
  name: DomainNameExt
}

resource endpointDNS 'Microsoft.Network/dnsZones/TXT@2018-05-01' = {
  name: name
  parent: DNSExternal

  properties: {
    TTL: 3600
    TXTRecords: [
      {
        value: [
          value
        ]
      }
    ]
    targetResource: {}
  }
}

[brwilkinson]

Hi @Gansted did you make any progress?

[Gansted]

Hi @brwilkinson
Thank you for the answer.
I just got home from a holiday and will test your suggestions ASAP. I will get back to you when I have tested.

[brwilkinson]

@Gansted please let us know if you are able to test.

[aslan-im]

@brwilkinson
Now you cannot refer to the added apex domain by this

name: replace(zone, '.', '-')

cause now Azure adds random string to the customdomain resource name. Is there workaround?

[JamesCuneo]

I tried this solution out and am getting Error BCP159: The resource "CDN" does not contain a nested resource named "customDomain". Known nested resources are: .

[JamesCuneo]

Sorted this issue out. Had problems with name variable as I was creating multiple DNS domains.