Azure Front Door: AT&T residential customers cannot establish TCP 443 to anycast IPs (ERR_CONNECTION_TIMED_OUT), no requests reach the edge

We run Azure Front Door Premium with four custom domains. Customers on AT&T residential internet (US) cannot reach the site at all. The browser shows ERR_CONNECTION_TIMED_OUT and the connection never completes, so no HTTP response and no X-Azure-Ref is ever produced.

Verified from an affected customer’s machine:

• DNS resolves correctly every time, returning the full CNAME chain to <endpoint>.z02.azurefd.net and valid addresses
• curl -4 and curl -6 both time out at connect after 15 seconds
• Addresses returned at various times include 150.171.109.67, .71, .117, and IPv6 in 2603:1061:14::
• Every device on their network is affected
• All other internet destinations work normally for them, including Microsoft 365 endpoints in 2603:1036::, from the same machine at the same time
• tracert is not usable for diagnosis: their gateway returns “Destination protocol unreachable” for every destination, including 8.8.8.8

Verified from our side:

• All of those addresses serve our site correctly from other networks, returning 302 in under 70ms
• WAF policy is in Detection mode with no block rules and no rate limiting
• All four custom domains are Approved with valid managed certificates
• The origin is healthy and serving every other client
• Front Door access logs show this client’s traffic stopping cleanly at a specific timestamp, with zero entries afterwards on either protocol
• Other AT&T customers continue to reach us normally throughout, so this is not a blanket ISP-level block

The problem has recurred. Restarting the customer’s router restored access once, and it later failed again.

Questions:

1. Are there any known routing or filtering issues between AT&T residential networks and Front Door anycast ranges?
2. Is there any way to see connection attempts that never complete the TCP handshake? Access logs only record requests that arrived, so these failures are completely invisible to us.
3. Since Front Door IPs are shared across tenants, is there any mitigation available when a range becomes unreachable for a subset of users, or is this entirely a matter for the ISP?We run Azure Front Door Premium with four custom domains. Customers on AT&T residential internet (US) cannot reach the site at all. The browser shows ERR_CONNECTION_TIMED_OUT and the connection never completes, so no HTTP response and no X-Azure-Ref is ever produced. Verified from an affected customer’s machine:
   • DNS resolves correctly every time, returning the full CNAME chain to <endpoint>.z02.azurefd.net and valid addresses
   • curl -4 and curl -6 both time out at connect after 15 seconds
   • Addresses returned at various times include 150.171.109.67, .71, .117, and IPv6 in 2603:1061:14::
   • Every device on their network is affected
   • All other internet destinations work normally for them, including Microsoft 365 endpoints in 2603:1036::, from the same machine at the same time
   • tracert is not usable for diagnosis: their gateway returns “Destination protocol unreachable” for every destination, including 8.8.8.8
   Verified from our side:
   • All of those addresses serve our site correctly from other networks, returning 302 in under 70ms
   • WAF policy is in Detection mode with no block rules and no rate limiting
   • All four custom domains are Approved with valid managed certificates
   • The origin is healthy and serving every other client
   • Front Door access logs show this client’s traffic stopping cleanly at a specific timestamp, with zero entries afterwards on either protocol
   • Other AT&T customers continue to reach us normally throughout, so this is not a blanket ISP-level block
   The problem has recurred. Restarting the customer’s router restored access once, and it later failed again. Questions:
   1. Are there any known routing or filtering issues between AT&T residential networks and Front Door anycast ranges?
   2. Is there any way to see connection attempts that never complete the TCP handshake? Access logs only record requests that arrived, so these failures are completely invisible to us.
   3. Since Front Door IPs are shared across tenants, is there any mitigation available when a range becomes unreachable for a subset of users, or is this entirely a matter for the ISP?