Azure SWA intermittent 404s with custom domains

1. records are set in cloudflare with proxy so they can be scanned by WAF, the cname is set to the correct address provided by the SWA.
2. verified active
3. the default url has no problems as previously stated only custom domains, and i have already performed these troubleshooting steps as listed in my initial post.
4. I was deleting my SWA before i set it up again, and later i was removing my custom domain before removing the SWA then readding. Same problem with both of these domains.
5. 48 hours is a long time to wait but i will wait. But if this was production and i am deploying in the same region this is a ridiculous ask in todays day when general DNS is ~5 mins in a region and max of ~4 hours in the country.
6. do i still do this if it validates successfully? if i remove and re-add the domain it will push back the 48 hour #5 more and i need production working
7. azure portal wont let me open a ticket is there a number

Intermittent 404s on Azure Static Web Apps custom domains almost always point to one of three areas, all of which can be validated without renaming or recreating everything:

1. Confirm DNS is stable and unambiguous
   • For each custom domain (for example, abc1.hello.com, abc2.hello.com), ensure there is only one of the following:
     • A CNAME pointing to the SWA default hostname (for example, *.azurestaticapps.net), or
     • An A record (less common for SWA) pointing to the correct IP.
   • Never configure both an A record and a CNAME for the same hostname; this can cause intermittent resolution and 404s.
   • Use global DNS tools (like WhatsMyDNS or DNS Checker) to verify that the records are consistent worldwide and that there are no stale or conflicting records. Intermittent behavior is often due to some resolvers still seeing old or conflicting DNS entries.
2. Verify the hostname binding and status in the SWA resource
   • In the Azure portal for each Static Web App, go to Custom domains and confirm:
     • Each custom domain is listed once.
     • The status is Active/Validated (no pending validation or error state).
   • If the domain was added using an A record, ensure the required TXT record is also present and correct. Missing TXT verification for an A-record mapping can cause Azure to not consistently route the hostname, resulting in 404s.
3. Check for the classic “Azure 404 – Web app not found” pattern
   • When the 404 appears, test both:
     • The SWA default hostname (for example, swa-abc-wus2-01.azurestaticapps.net).
     • The custom domain (for example, https://abc1.hello.com).
   • If the default hostname always works but the custom domain intermittently returns 404, this matches the documented case where Azure can’t consistently associate the hostname with the app because of DNS or binding issues:
     • The domain might not be fully or correctly added to the app.
     • DNS might be pointing correctly some of the time but not all of the time.
   • The guidance in this case is to:
     1. Re-validate the DNS records (CNAME vs A+TXT) and remove any conflicting entries.
     2. In the portal, remove the custom domain from the SWA, wait for it to disappear from the list, then re-add it and wait for validation to show as successful.
4. Avoid conflicting use of the same domain on other Azure resources
   • Ensure the same hostname (for example, abc1.hello.com) is not also bound to any other Azure resource (another SWA, App Service, Front Door, etc.). A domain can be linked to only one app service-type resource at a time. If it was previously used elsewhere, remove it there first.
5. Allow for propagation and cache clearing, but don’t rely on time alone
   • DNS changes can take up to 48 hours to propagate globally, but if intermittent 404s persist beyond that, the issue is usually misconfiguration rather than propagation.
   • Clear local DNS cache (ipconfig /flushdns on Windows) and browser cache when testing to avoid cached old IPs.
6. If validation is stuck or inconsistent
   • There is a known pattern where custom domain validation can get stuck or behave oddly. A workaround that has helped in similar cases:
     1. Delete the CNAME for www (or the subdomain) at the DNS provider.
     2. Add the asuid.<subdomain> TXT record manually and wait for it to be visible globally.
     3. Let Azure validate the domain.
     4. Then delete the TXT and re-add the CNAME.
   • This can “unstick” validation and ensure Azure has a clean, verified mapping.
7. When to recreate vs. when to escalate
   • Renaming SWA resources and domains is a heavy operation and usually not required if:
     • DNS is clean (no conflicting A/CNAME records).
     • The custom domains show as active/validated on the SWA.
     • The default SWA hostname is always stable.
   • If all of the above checks out and intermittent 404s still occur only on the custom domains, the next step is to open an Azure support case and provide:
     • Exact timestamps and sample URLs that returned 404.
     • Confirmation of DNS records and screenshots from the SWA Custom domains blade.

Applying the above checks should allow resolution without changing SWA names or subdomains, unless a hidden conflicting binding or DNS record is discovered.

References:

• Troubleshoot custom domain issues in Azure App Service for web apps on Windows and Linux
• Troubleshoot domain and TLS/SSL certificate problems in Azure App Service
• Static web app display azure 404 error - Microsoft Q&A
• Custom domain still validating after 12 hours - Microsoft Q&A