Failing DNSSEC chain when reaching azurefd.net

Hi @ Roy Freij •,

Welcome to Microsoft Q&A Platform.

Azure does not perform DNSSEC response validation using the default Azure-provided DNS resolver. DNSSEC validation is only relevant when you are running your own recursive DNS resolvers.

Trust anchors and DNSSEC validation states:

In your scenario, the DNSSEC chain validates correctly until it reaches azurefd.net. This is because azurefd.net (Azure Front Door’s canonical domain) is not DNSSEC-signed

Microsoft does not publish DS/RRSIG records for azurefd.net

As a result, a fully trusted DNSSEC chain cannot be established when a CNAME ultimately points to Azure Front Door

This is why external DNSSEC validation tools (such as Verisign DNSSEC Debugger) report failures for *.azurefd.net.

Is there a way to resolve this?

No. DNSSEC cannot be enabled for Microsoft-owned service domains like azurefd.net. Customers cannot configure DNSSEC on these zones.

If a third-party audit requires full end-to-end DNSSEC validation, Azure Front Door cannot be used as the final CNAME target.

Please Accept the answer if the information helped you. This will help us and others in the community as well.