Pending validation

Hello @Leo Orelli

Thank you for reaching out Microsoft Q&A..

Even when the TXT record appears propagated on external checkers, validation can remain stuck due to DNS conflicts (e.g., existing CNAME at the same host) or missing CAA records required for DigiCert (the CA used by Azure for managed certificates).

1. Add a CAA Record (Recommended first step)

Add this at the root of your domain (lebosc.org):

• Record type: CAA
• Host/Name: @ (or blank)
• Value: 0 issue "digicert.com" (include quotes if required by your DNS provider)
• TTL: 600 (or lowest allowed)

Verify it using this command in Azure Cloud Shell or any terminal: dig lebosc.org CAA

You should see the DigiCert entry in the ANSWER SECTION.

2. Remove and Re-add the Custom Domain

• In the Azure portal, go to your Static Web App > Custom domains.
• Delete the existing portal.lebosc.org entry.
• Add it again (select Custom domain on other DNS).
• Generate a new validation code for the TXT record.

3. Add the New TXT Validation Record

• Record type: TXT
• Host/Name: _dnsauth.portal
• Value: [The new validation code from the portal]
• TTL: 600 (or low value)

4. Refresh and Monitor

• Click Refresh periodically in the Custom domains blade.
• Validation typically completes within 10–30 minutes once records are correct (allow up to a few hours).
• When it shows Validated, test the site and check for certificate errors.

Reference:
https://learn.microsoft.com/en-us/azure/static-web-apps/custom-domain
https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/add-custom-verified-domains?pivots=platform-azp
If the answer is helpful,  Please do click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you

Hi Leo,

I checked on dnschecker.org for txt record for portal.lebosc.org and it shows all red Xs. This is understandable since you have CNAME record.

1. Please create below DNS record in your provider's portal for lebosc.org domain:

To verify CAA record is correct, you may use dig command below in Azure Cloud Shell:

dig lebosc.org caa

In output you should have answer section similar to below:

;; ANSWER SECTION:
lebosc.org.            600    IN      CAA     0 issue "digicert.com"

NOTE: digicert.com should be in quotes as shown above. With some DNS providers you need to enter the quotes in their portal while others you do not.

2. Please delete portal.lebosc.org custom domain from your Static Web App, then add it back. Click the button to generate new validation code for TXT record.

3. Please create below DNS record in your provider's portal for lebosc.org domain:

4. Periodically click Refresh on Custom domains blade to see if the domain switches to Validated with green check mark. It typically completes the process within 20 minutes or so. Once it says validated, please test by navigating to your site and make sure there are no certificate errors or warnings.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP