Cascade Regional Airlines wants to bind a free App Service Managed Certificate to the apex domain cascaderegional.com for the booking site, but the binding keeps failing domain validation. The DNS zone currently has only an A record pointing the apex at the App Service's inbound IP, with no other verification records. What is the most likely reason the App Service Managed Certificate cannot be issued for the apex domain?
Select an answer to reveal the explanation.
Short Explanation
An A record alone proves the domain points at your app — it doesn't prove you actually own the domain, which is what certificate issuance cares about. For apex domains, App Service needs a TXT record alongside that A record to complete ownership verification before it will issue the managed certificate.
Full Explanation
Binding an App Service Managed Certificate to a custom domain requires the domain to pass ownership verification, and for an apex (root) domain that verification takes the form of a TXT record added at the domain's DNS zone, since an apex domain cannot use the CNAME-based verification method available to subdomains like www. Without that TXT record in place alongside the existing A record, the platform cannot confirm ownership and the certificate request fails, even though the app itself is correctly reachable at the apex. Managed Certificates absolutely do support custom domains including apex domains, so the first option misstates a basic capability of the feature. TLS/SSL bindings themselves are available starting from Basic tier upward, so a low tier is a plausible-sounding but different failure mode than what is described, and the scenario gives no indication the plan tier is the issue. Moving the DNS zone to Azure DNS is not a requirement for Managed Certificates; App Service only needs the correct verification records to exist wherever the zone is hosted, whether that is Azure DNS or a third-party registrar. As an operational check, review the domain verification ID App Service provides and confirm a TXT record with that exact value has been published and has propagated before retrying the certificate request.