NorthStar IT manages a public DNS zone contoso.com in Azure DNS and wants the apex (contoso.com) to point to an Azure Traffic Manager profile and to Azure Front Door in separate deployment scenarios. What is the supported and recommended method to implement apex redirection with Azure DNS in these cases?

The correct answer is to create an ALIAS record (A/AAAA with alias) at the zone apex pointing to the Traffic Manager profile or Front Door endpoint in Azure DNS. Azure DNS supports alias records for the zone apex (root domain) to point to Azure resources like Traffic Manager profiles, Front Door endpoints, public IP addresses, or CDN profiles. This allows the root domain (e.g., contoso.com) to resolve directly to these services, which is a common requirement for web applications. Creating a CNAME record at the apex is generally not allowed by DNS standards because it conflicts with other required records like SOA and NS records at the zone root. While some DNS providers offer workarounds, Azure DNS specifically supports ALIAS records for this purpose. Creating an NS record at the apex would delegate the entire domain to Traffic Manager's name servers, which is not the goal; you want to point the apex to the service, not delegate the domain. Azure CDN endpoint mapping is for CDN integration, not a general DNS solution for apex redirection to Traffic Manager or Front Door. Azure DNS can indeed point apex records to these services using ALIAS records.