Once a custom domain is verified for a web app or static web app, can I delete the TXT verification record from our DNS or does that need to remain active?

Question

Once a custom domain is verified for a web app or static web app, can I delete the TXT verification record from our DNS or does that need to remain active?

Answer 1

Hi,

For a web app it is preferred (not mandatory) to leave the txt record in place to prevent potential future subdomain takeover. For static web app it makes no difference--in other words you can delete it if you want.

Excerpt from documentation:

These records don't prevent someone from creating the Azure App Service with the same name that's in your CNAME entry. Without the ability to prove ownership of the domain name, threat actors can't receive traffic or control the content.

Above warning from this article.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Answer 2

As per https://learn.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain

App Services uses this record only at configuration time to verify that you own the custom domain. You can delete this TXT record after your custom domain is validated and configured in App Service.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin