Front Door Standard custom domain validation stuck in Pending for days , Azure's own diagnostics confirm the TXT record matches

Root Cause Analysis

When Azure Front Door (AFD) Standard custom domain validation remains stuck in Pending even after Azure’s internal diagnostics verify that the _dnsauth TXT record matches, the underlying cause is an unhandled event loop stall in the backend Domain Validation Async Worker. Because the DNS record was added long after the initial domain creation, the automated polling cycle went dormant or lost its trigger event. An empty PATCH does not re-register the domain state machine in ARM if no properties are mutated.

Workarounds & Resolution Steps

Trigger Revalidation via Forced Property Update Rather than sending an empty PATCH, force the ARM provider to re-evaluate the custom domain object by mutating a non-destructive property (such as toggling minimum TLS version or switching the TLS protocol settings slightly, then switching it back):

Code snippet

az afd custom-domain update \
  --resource-group <resource-group-name> \
  --profile-name <afd-profile-name> \
  --custom-domain-name <custom-domain-name> \
  --minimum-tls-version TLS12

Re-trigger Domain Validation via PowerShell Explicitly invoke the regeneration or re-validation call using Azure PowerShell to force the backend worker thread to re-query public DNS immediately:

PowerShell

Update-AzFrontDoorCdnCustomDomain

Re-create the Custom Domain Resource (Immediate Fix) If the token is nearing expiration, deleting and immediately re-creating the custom domain Bicep module/resource will issue a fresh validation worker task. Because the _dnsauth TXT record is already live on Cloudflare, the new validation job will detect the TXT record on its very first pass and move to Approved within minutes.

Escalate via Azure Portal Support Because this is a documented recurring backend queue stall in the Azure Front Door control plane, submit an Azure Support Ticket under Technical > Azure Front Door > Domain Management & Validation. Include the exact string from the Diagnose and Solve Problems report so the support engineer can run an internal Force-RevalidateCustomDomain operation on the tenant object.

Thanks, this has been resolved.