Azure App Service custom domain verification fails although TXT record resolves correctly

second 0 Reputation points
2026-09-16T19:44:10.31+00:00

Hi,

I’m trying to add gallerietsecondhand.com as a custom domain to an Azure App Service named gallerietsecondhand.

The DNS configuration is:

  • A record for root domain: 51.12.31.26
  • TXT record: asuid.gallerietsecondhand.com
  • TXT value: B3573AF4E03605C2F0A6592033DB75FCC096E22B2A0048175019B0AC969C6609

We initially had a DNSSEC problem at the DNS provider, but that has now been repaired.

Current DNS checks succeed:

  • dig TXT asuid.gallerietsecondhand.com @1.1.1.1 +dnssec returns NOERROR and the correct TXT value.
  • Azure Cloud Shell nslookup -type=TXT asuid.gallerietsecondhand.com also returns the correct TXT value.
  • dig A gallerietsecondhand.com @1.1.1.1 +short returns 51.12.31.26.

However, both the Azure Portal custom domain verification and this Azure CLI command still fail:

az webapp config hostname add --webapp-name gallerietsecondhand --resource-group gallerietsecondhand --hostname gallerietsecondhand.com

The error is:

A TXT record pointing from asuid.gallerietsecondhand.com to B3573AF4E03605C2F0A6592033DB75FCC096E22B2A0048175019B0AC969C6609 was not found.

Since the TXT record is publicly resolvable and also resolvable from Azure Cloud Shell, what could cause App Service ownership verification to still fail?

App Service:

  • Linux
  • .NET 10
  • Region: Sweden Central

Any help would be appreciated.Hi,

I’m trying to add gallerietsecondhand.com as a custom domain to an Azure App Service named gallerietsecondhand.

The DNS configuration is:

  • A record for root domain: 51.12.31.26
  • TXT record: asuid.gallerietsecondhand.com
  • TXT value: B3573AF4E03605C2F0A6592033DB75FCC096E22B2A0048175019B0AC969C6609

We initially had a DNSSEC problem at the DNS provider, but that has now been repaired.

Current DNS checks succeed:

  • dig TXT asuid.gallerietsecondhand.com @1.1.1.1 +dnssec returns NOERROR and the correct TXT value.
  • Azure Cloud Shell nslookup -type=TXT asuid.gallerietsecondhand.com also returns the correct TXT value.
  • dig A gallerietsecondhand.com @1.1.1.1 +short returns 51.12.31.26.

However, both the Azure Portal custom domain verification and this Azure CLI command still fail:

az webapp config hostname add --webapp-name gallerietsecondhand --resource-group gallerietsecondhand --hostname gallerietsecondhand.com

The error is:

A TXT record pointing from asuid.gallerietsecondhand.com to B3573AF4E03605C2F0A6592033DB75FCC096E22B2A0048175019B0AC969C6609 was not found.

Since the TXT record is publicly resolvable and also resolvable from Azure Cloud Shell, what could cause App Service ownership verification to still fail?

App Service:

  • Linux
  • .NET 10
  • Region: Sweden Central

Any help would be appreciated.

Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Allan Solomon Mejia 9,000 Reputation points
    2026-09-16T21:06:22.1433333+00:00

    Hi @second

    Your DNS records look structurally correct for an App Service apex/root domain: the A record points to the App Service IP, and asuid.gallerietsecondhand.com contains the Custom Domain Verification ID. Microsoft documents this as the expected configuration.

    Since the TXT record now resolves correctly from both 1.1.1.1 and Azure Cloud Shell, but both Portal and az webapp config hostname add return the same TXT-not-found error, this no longer looks like a simple Portal issue.

    The earlier DNSSEC problem is important. First, verify the complete authoritative chain rather than only querying 1.1.1.1:

    dig +trace gallerietsecondhand.com
dig +trace TXT asuid.gallerietsecondhand.com
dig TXT asuid.gallerietsecondhand.com @<authoritative-nameserver>

    Make sure all authoritative name servers return the same TXT value and that no DNSSEC validation errors remain.

    Also verify that the TXT value still exactly matches the Custom Domain Verification ID currently displayed in App Service → Custom domains. It specifically requires the asuid TXT value to match that verification ID.

    If the authoritative DNS/DNSSEC checks are clean and the verification ID matches, leave the DNS records in place and allow time for cached DNS state to expire rather than repeatedly changing them. DNS changes can take up to 48 hours to propagate depending on previous TTL/cache state.

    You can also run App Service → Diagnose and solve problems → SSL and Domains → All Certificates & Domains Checks, which is recommended when domain validation remains stuck after DNS has been verified.

    If it still fails after the DNSSEC repair has fully propagated, open an Azure support request and include the CLI failure, timestamp, App Service resource ID, domain, and the successful authoritative TXT/DNSSEC results. At that point, Microsoft may need to check the App Service hostname-verification path/backend rather than the DNS configuration itself.

    Do not remove the asuid record while troubleshooting. Keep it, as it also helps prevent another Azure subscription from validating and taking over the hostname.

    References:

    Troubleshoot custom domain issues in Azure App Service

    Set up an existing custom domain in Azure App Service

    Prevent subdomain takeover in Azure App Service

    Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.