How to change the nameservers of an Azure App Service Domain (2026)

Question

How to change the nameservers of an Azure App Service Domain (2026)

HG Tok 0

We finally have a confirmed working method from Microsoft Support in 2026.

This is especially for those, like me, who are unable to recover any username and password from https://dcc.secureserver.net/domains

Thank you for your patience. Following our internal review, we have identified a self-service workaround to update your domain’s name servers to an external DNS provider, such as Cloudflare, without transferring the domain out of Azure. Although the portal is not allowing the change, the name servers can be updated using an Azure Resource Manager (ARM) PATCH request against your App Service domain resource. This allows you to retain the domain under your Azure subscription. Before proceeding, please ensure:

Your domain is active and successfully provisioned.

Your DNS records have been configured at the external provider to avoid disruption to your website, email, or other services.

You have the exact name servers assigned by your external DNS provider. Important: Do not include dnsZoneId in the request body. If your domain currently uses Azure DNS, this update will remove its existing Azure DNS delegation and point the domain to the specified external name servers. Please proceed only if this is your intended configuration. This approach does not require a registrar transfer, so the previously discussed 60-day transfer restriction does not require you to wait before attempting this update.

PATCH https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DomainRegistration/domains/{domainName}?api-version=2024-11-01
{
  "properties": {
    "nameServers": [
      "ns1.example-dns.com",
      "ns2.example-dns.com"
    ]
  }
}

also crossposting to https://stackoverflow.com/questions/65816264/how-do-i-change-nameservers-on-azure-domain

0 comments

1 answer

Your answer

Answer 1

Update the App Service Domain by sending an authenticated ARM PATCH containing only properties.nameServers, and omit dnsZoneId so the domain is delegated to the external DNS provider without being transferred.

1. Prepare the external DNS provider

Before changing delegation:

Add all required website, email, verification, and other DNS records at the external provider.
Copy the exact authoritative nameservers assigned to the domain.
Confirm the App Service Domain is active and fully provisioned.

Changing delegation before recreating the records can interrupt the website, email, and other services.

2. Create the PATCH body

Save this as nameservers.json, replacing the example values:

{
  "properties": {
    "nameServers": [
      "ns1.example-dns.com",
      "ns2.example-dns.com"
    ]
  }
}

Do not add dnsZoneId. If the domain currently uses Azure DNS, this operation is intended to replace that delegation with the listed external nameservers.

The domain PATCH model exposes nameServers as a string array ^1^. Microsoft’s domain update operation targets the App Service Domain resource and uses API version 2024-11-01 by default ^2^.

3. Send the request with Azure CLI

Sign in and select the subscription containing the domain:

az login
az account set --subscription "<subscription-id>"

az rest --method patch \
  --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/[Resource Group] Group]/providers/Microsoft.DomainRegistration/domains/<domain-name>?api-version=2024-11-01" \
  --body @nameservers.json

az rest obtains a Microsoft Entra token from the signed-in Azure CLI session, adds the authorization header, and treats a valid JSON body as application/json ^3^.

Replace:

<subscription-id> with the subscription ID.
<resource-group> with the App Service Domain’s resource group.
<domain-name> with the full registered domain, such as contoso.com.

The operation does not require access to the GoDaddy Domain Control Center and does not transfer the registration away from Azure. Consequently, a registrar-transfer waiting period is not part of this nameserver update.

4. Verify the result

Query the resource after the PATCH:

az rest --method get \
  --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/[Resource Group] Group]/providers/Microsoft.DomainRegistration/domains/<domain-name>?api-version=2024-11-01" \
  --query "properties.nameServers"

Then verify public delegation using a DNS or WHOIS lookup. Allow time for registrar publication and cached DNS data to expire.

If the request fails

403 Forbidden: confirm Azure CLI is using the tenant and subscription that own the domain. Selecting the wrong subscription or tenant can produce a 403 ^4^. The signed-in identity must also be authorized to update the domain resource.
404 Not Found: check the subscription ID, resource group, domain name, and that the resource type is exactly Microsoft.DomainRegistration/domains.
Validation error mentioning dnsZoneId: resend the minimal body above without that property.
Successful PATCH but unchanged public delegation: retain the full request/response and timestamp, then reopen the Microsoft support case. Ask support to inspect the Microsoft.DomainRegistration/domains update operation rather than redirecting to the registrar portal.

The deployment template documentation does not list nameServers among the normal creation-time domain properties ^5^. That does not invalidate this PATCH approach: nameServers is documented separately on the domain update/PATCH model, which includes update-only fields not exposed by the deployment schema.

References