Is to possible to set up an alias in Azure DNS to point to a Front Door configuration in another account / tenant?

Question

I'm looking to point an apex domain to an Azure Front door configuration, which from what I understand can be achieved with Azure DNS using an alias, however the challenge I am facing is that the Azure DNS setup and the Front Door set up are in different accounts / tenants.

Is it possible to make this work (I can't seem to find any documentation around this)?

Thanks

Answer 1

Hi @Richard,

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Yes, using an Alias record in Azure DNS is the standard way to point an apex domain to an Azure Front Door. To achieve your requirement, it requires a bit more configuration than a simple Alias record. Direct Alias records across tenants are not supported.

For your reference: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-how-to-onboard-apex-domain?pivots=front-door-standard-premium

The main concept is to delegate a subdomain (or the apex domain itself) from the DNS zone in the Front Door's tenant to the Azure DNS zone in the other tenant. This allows the Azure DNS zone to manage the records for your domain, including the necessary Alias record for Front Door.

For your reference: https://learn.microsoft.com/en-us/azure/dns/dns-zones-records

Please go to the Azure portal, navigate to your Front Door profile. You need to get the hostname provided by Front Door and in your Azure DNS zone, create an Alias record for your apex domain. Point this Alias record to the Front Door hostname. This is the crucial step that links your domain to Front Door.

In the DNS zone where your apex domain is currently managed, create NS records. These NS records will delegate authority for your domain (or a subdomain) to the Azure DNS name servers.

For your reference: https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns#retrieve-name-servers

Go to your current DNS provider where your apex domain is registered. Add the NS records you obtained from the Azure DNS zone in the other tenant. If you are delegating the apex domain itself, replace the existing NS records with the Azure DNS ones. If delegating a subdomain, create new NS records specifically for that subdomain.

To achieve your requirement, you need to have appropriate permissions in both Azure tenants to manage DNS and Front Door resources. Also, you need to have the access to the DNS settings where your apex domain is currently managed and be careful of TTL values. Changes to NS records can take time to propagate.

After setting up the delegation, use tools like dig to verify that the NS records are correctly configured and that the Alias record is resolving to your Front Door hostname.

---

Kindly let us know if the above helps or you need further assistance on this issue.

I hope this has been helpful!

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!