Focus

Next-Gen Trust Security

Azure DNS Requirements for Domain Validation

Table of Contents

Azure DNS Requirements for Domain Validation

When using Azure DNS with a certificate authority (CA) that supports the DNS-01 challenge method—such as Let's Encrypt or a custom ACMEv2 CA—Next-Gen Trust Security automates domain control validation by creating and deleting TXT records through the Azure API.

Required Azure Properties

These Azure properties are required to enable secure automation with Azure DNS:

Field	Purpose
Subscription ID	Identifies the Azure subscription hosting your DNS zones.
Resource Group	Identifies the resource group that contains those DNS zones.
Client ID	The application (service principal) ID registered in Azure AD.
Client Secret	Secret string that, with the Client ID, authenticates requests.
Tenant ID	Identifies your Azure Active Directory instance.

Required Permissions

To allow Next-Gen Trust Security to create and manage TXT records automatically, you must:

Create a service principal (Azure AD application).
Assign it the DNS Zone Contributor role at either the resource-group or DNS-zone scope.

This role lets Next-Gen Trust Security:

Read DNS zones and records
Create TXT records for validation
Update or delete those records when validation completes

Tip: Need help creating a service principal? See Microsoft's guide.

You may need assistance from your Azure administrator to create the principal and assign roles.

Tip: Need CNAME delegation for domain validation? If you don't have API access to your primary DNS provider, you can use CNAME delegation to an Azure DNS zone for validation. See CNAME Delegation for Domain Validation.

Add Custom ACMEv2

Google Cloud DNS Requirements for Domain Validation