Failing DNSSEC chain when reaching azurefd.net

Roy Freij 0

Hello,

A fully trusted DNSSEC chain is required to successfully complete a Third-Party Audit.

Currently, when the DNSSEC chain is requested everything is fine, including the cname record, until it reaches azurefd.net.

These errors also appear when checking the domain directly: https://dnssec-debugger.verisignlabs.com/a01.azurefd.net

Are there any ways to resolve this issue?

Thank you in advance

Vallepu Venkateswarlu 1,405 Reputation points Microsoft External Staff Moderator

2025-12-12T14:47:44.53+00:00

Hi @ Roy Freij •,

Welcome to Microsoft Q&A Platform

This behavior is expected. Azure Front Door’s canonical domain (azurefd.net) does not support DNSSEC. Because of this, the DNSSEC validation chain breaks once the CNAME resolves to *.azurefd.net.

Azure DNSSEC only applies to customer-owned DNS zones, not to Microsoft-owned service domains such as: azurefd.net (Azure Front Door)

Since azurefd.net is not DNSSEC-signed, a fully trusted DNSSEC chain cannot be established through a CNAME pointing to Azure Front Door.

Are there any ways to resolve this issue?

No , The DNSSEC cannot be enabled on azurefd.net. If full end-to-end DNSSEC validation is required, Azure Front Door cannot be used as the final CNAME target.

I hope this information helps resolve your issue.

Please feel free to ask if the provided solution does not help or if you have any additional questions.

Your answer