Azure DNS中为根域名配置CloudFront分发CNAME的解决方案及IP稳定性疑问

Hey Henrique, great question—this is a super common gotcha with apex domains (like mysite.com) and CloudFront, especially when using Azure DNS. Let's break down the solution and address your IP stability concern clearly.

解决根域名无法配置CNAME的问题 #

Root domains (apex domains) can't use regular CNAME records because CNAMEs override all other DNS records for that domain (like MX or TXT records). Azure DNS has a perfect workaround for this: ALIAS records.

ALIAS records act like CNAMEs but are designed specifically for apex domains—they let you point your root domain to another domain (like your CloudFront distribution URL) without breaking other DNS records. Here's how to set it up:

• Log into the Azure Portal and navigate to your DNS zone (e.g., mysite.com)
• Click + Record set to create a new record
• Leave the Name field blank (this tells Azure we're targeting the root domain)
• Set Type to ALIAS
• Under Alias type, select Custom domain, then enter your full CloudFront distribution URL (e.g., d123456abcdef.cloudfront.net)
• Click Create to save the record

⚠️ Critical prerequisites before setting this up:

• You must first add mysite.com to the Alternate domain names (CNAMEs) section of your CloudFront distribution
• You need a valid SSL certificate covering mysite.com (if using HTTPS, which you should!). For CloudFront, this certificate must be issued via AWS Certificate Manager (ACM) and stored in the us-east-1 region, even if your distribution is in another region.

关于CloudFront IP地址稳定性的疑问 #

Do NOT use CloudFront's IPv4 addresses for A records—this is a really bad idea, and here's why:

• CloudFront is a global CDN, so AWS regularly updates its pool of IP addresses to handle traffic, scale infrastructure, and maintain security
• Different users around the world are routed to different CloudFront edge nodes with different IPs; hardcoding a single IP would break access for most users
• AWS doesn't guarantee that any specific CloudFront IP will stay static—if the IP changes, your site will go down immediately, and you won't get advance notice to update your DNS

ALIAS records are the official, reliable way to handle this—they automatically resolve to CloudFront's current valid IPs, so you never have to worry about manual updates or downtime.

备注：内容来源于stack exchange，提问作者Henrique Andrade