You have a website with the FQDN www.contoso.com that currently resolves to an on-premises web server. You will migrate the site to an Azure Web App named Web1, and publish it through an Azure Front Door instance named ContosoFD1. You’ve built the site on Web1 and plan to configure ContosoFD1 for testing without disrupting users who still go to the on-premises server. When you try to add a custom domain for www.contoso.com to ContosoFD1 you receive a verification error. Which DNS record should you add to the contoso.com zone to allow testing without changing the live www.contoso.com record?

To validate custom domains for Azure Front Door without disrupting live traffic, Azure Front Door uses a special CNAME record for verification. This record maps afdverify.yourcustomdomain.com to afdverify.yourfrontdoorinstance.azurefd.net. In this scenario, yourcustomdomain.com is www.contoso.com and yourfrontdoorinstance is ContosoFD1. Therefore, the correct CNAME record is afdverify.www.contoso.com mapped to afdverify.ContosoFD1.azurefd.net. Creating a CNAME that maps afdverify.www.contoso.com to ContosoFD1.azurefd.net is incorrect because the target of the verification CNAME must also include the afdverify prefix. Creating a CNAME that maps www.contoso.com to ContosoFD1.azurefd.net would immediately redirect live traffic to Azure Front Door, which is explicitly what the question aims to avoid. Mapping www.contoso.com to Web1.contoso.com is not relevant for Front Door custom domain verification and would also disrupt live traffic.