AFD domains asking for revalidation though it was already done 2 years back

Question

AFD domains asking for revalidation though it was already done 2 years back

Nikhil Mamillapalli 25 Microsoft Employee

PII

for this resource there are three domains already validated long back, and now recently it showed to renew the azure managed certificates, and usually azure used to take care of renewal of azure certs, but today all of a sudden we are seeing to revalidate the domains, why this was happened?

Ravi Varma Mudduluru 12,625 Reputation points Microsoft External Staff Moderator

2026-05-19T11:46:35.12+00:00
Hello @ Nikhil Mamillapalli

Thank you for reaching out to Microsoft Q&A.

what you’re seeing is actually by design. Azure Front Door (and Azure CDN) automatically prompts for domain re-validation whenever it’s time to renew the managed certificate (roughly 45 days before expiry). Even though you validated those domains two years ago, the certificate authority requires a fresh proof of ownership each renewal cycle. Here’s the rundown:

“Pending revalidation” state

When the managed cert is within ~45 days of expiration, your custom domain enters Pending revalidation.

If your CNAME already points directly to the Azure Front Door endpoint (*.azurefd.net), Azure will auto-renew the cert—no action needed on your part.

If you’re using a different CNAME or the portal shows “Pending re-validation,” you need to regenerate the validation token.

How to revalidate

In the portal, go to your Front Door/Azure CDN Classic profile → Domains → select the domain in “Pending revalidation” → click Regenerate.

Copy the new TXT record value and add it to your DNS provider under _dnsauth.<your-subdomain>.

Wait for DNS to propagate (pay attention to your TTL—defaults are 1 hour). Once Azure sees the correct TXT record, your domain flips back to Approved and the cert auto-renews.

Classic SKU DCV deprecation (planning ahead)

If you’re on AFD Classic or CDN Standard (Microsoft) Classic, CNAME-based DCV is retiring August 15, 2025. After that date, new certificates won’t be issued and existing ones expire April 14, 2026.

To avoid future outages, consider migrating to Azure Front Door Standard/Premium or switch to BYO-certificates before those deadlines.

References

Domains in Azure Front Door (validation states): https://learn.microsoft.com/azure/frontdoor/domain#domain-validation

Configure custom domains & avoid takeovers: https://learn.microsoft.com/azure/frontdoor/front-door-custom-domain

If the answer is helpful, please click "upvote" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Nikhil Mamillapalli 25 Reputation points Microsoft Employee

2026-05-19T11:49:23.02+00:00

@Ravi Varma Mudduluru but since two years this did not happen, why all of a sudden now?
Ravi Varma Mudduluru 12,625 Reputation points Microsoft External Staff Moderator

2026-05-25T16:07:32.14+00:00

Hello @Nikhil Mamillapalli ,

As discussed on the Teams chat, we are currently checking with the backend team to understand why the status changed to Pending instead of Approved.
Steph Jones 0 Reputation points

2026-06-09T13:34:05.5266667+00:00

@Ravi Varma Mudduluru is there an update on this, we have 50 front door instances all containing domains wanting to be revalidated also, they were all added different times, some have been there a long time and some were only revalidated a year ago

Answer accepted by question author

Ravi Varma Mudduluru 12,625 Microsoft External Staff Moderator

Hello @Nikhil Mamillapalli ,

Thank you for reaching out to Microsoft Q&A.

As previously discussed, the backend team cleared the struck renewal operation. Now, the domain validation status changed from “Timeout” to “Approved,” and the issue was resolved.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

0 comments

1 additional answer

Your answer

Nikhil Mamillapalli 25 Reputation points Microsoft Employee

2026-05-19T11:49:23.02+00:00

@Ravi Varma Mudduluru but since two years this did not happen, why all of a sudden now?
Ravi Varma Mudduluru 12,625 Reputation points Microsoft External Staff Moderator

2026-05-25T16:07:32.14+00:00

Hello @Nikhil Mamillapalli ,

As discussed on the Teams chat, we are currently checking with the backend team to understand why the status changed to Pending instead of Approved.
Steph Jones 0 Reputation points

2026-06-09T13:34:05.5266667+00:00

@Ravi Varma Mudduluru is there an update on this, we have 50 front door instances all containing domains wanting to be revalidated also, they were all added different times, some have been there a long time and some were only revalidated a year ago

Answer 1

hi Nikhil Mamillapalli & thanks for join me here at Q&A portal,

сonfig is probably fine, test new name/RG/region/SKU, then escalate with correlation ID if portal also fails, if it fails from both Terraform and portal, this is almost certainly not Terraform. OperationFailed + “conflict” during create usually means the Managed Redis resource provider hit a backend conflict, capacity issue, stale name/resource state, or regional/SKU provisioning problem. Azure Managed Redis docs also say the service can enter Failed state when a management operation fails, so “terminal failed” is a real provisioning state, not just UI noise. First things to try use a brand-new name, brand-new resource group, different region, and smaller/different SKU. If that works, original region/SKU/name path is the issue. Also avoid preview tiers unless needed, because some Managed Redis tiers are still public preview, especially large memory tiers and Flash tiers. Check Activity Log for the failed deployment and copy the correlation ID, because the portal error is too generic. If multiple regions SKUs fail even from portal, open Azure Support under Azure Managed Redis / Cache for Redis and ask them to check backend provisioning conflict for ur subscription.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal