Complete Guide: Mapping a Custom Domain to an Azure Virtual Machine (VM)

Mapping a custom domain (e.g., example.com or api.example.com) to an Azure Virtual Machine involves reserving a static IP address, opening network firewall ports, updating your DNS registrar records, and binding the web server.

Technical Overview & Prerequisites

User Request ──> https://api.yourdomain.com
                        │
                        ▼ (DNS Registrar - A Record)
                 Azure Public IP (Static)
                        │
                        ▼ (Network Security Group)
                   Ports 80/443 Open
                        │
                        ▼ (Azure VM Web Server)
            Nginx / IIS / Apache / Reverse Proxy

Azure Infrastructure: Linux or Windows Virtual Machine with a web server installed (Nginx, IIS, Apache, Kestrel).
Network Requirement: Static Public IPv4 Address.
DNS Registrar Access: Ability to edit DNS zone records (GoDaddy, Cloudflare, Namecheap, etc.).

Step 1: Ensure Your Azure Public IP is Static

By default, Azure public IP addresses may be dynamic, meaning the IP changes if the VM is stopped or deallocated. You must set it to Static so your DNS mappings remain permanent.

Log in to the Azure Portal.
Navigate to Virtual Machines and select your VM.
In the left menu under Settings, click Properties.
Click on your Public IP address.
On the Public IP page, click Configuration under Settings.
Set Assignment to Static.
(Optional) Under DNS name label, enter an alias prefix (e.g., myuniqueapp) to assign a default Azure FQDN (myuniqueapp.eastus.cloudapp.azure.com).
Click Save at the top.
Copy your Public IP Address for use in Step 3.

Step 2: Configure Network Security Group (NSG) Rules

Ensure Azure allows incoming HTTP and HTTPS web traffic to reach your virtual machine.

On your VM's overview page in the Azure Portal, select Networking from the left menu.
Under Inbound port rules, check if rules for HTTP (Port 80) and HTTPS (Port 443) are present.
If missing, click Add inbound port rule and configure:
- Source: Any
- Source port ranges: *
- Destination: Any
- Service: HTTP (Port 80) / HTTPS (Port 443)
- Action: Allow
- Priority: 300 (or any available low number)
- Name: Allow-HTTP-HTTPS
Click Add.

Step 3: Add DNS Records at Your Domain Registrar

Scenario A: Mapping a Root Domain (`yourdomain.com`)

Add an A Record:

Record Type	Host / Name	Value / Destination	TTL
A	@	YOUR.AZURE.VM.IP	600s / 1 Hour

Add a CNAME Record for www:

Record Type	Host / Name	Value / Destination	TTL
CNAME	www	yourdomain.com	600s / 1 Hour

Scenario B: Mapping a Subdomain (`api.yourdomain.com`)

Add an A Record or CNAME Record:

Option 1: Direct IP Mapping (A Record)

Record Type	Host / Name	Value / Destination	TTL
A	api	YOUR.AZURE.VM.IP	600s / 1 Hour

Option 2: Azure FQDN Alias (CNAME Record)

(Requires configuring the DNS name label in Step 1)

Record Type	Host / Name	Value / Destination	TTL
CNAME	api	myuniqueapp.eastus.cloudapp.azure.com	600s / 1 Hour

Step 4: Configure the Web Server on the VM

Bind your web server on the VM to accept incoming requests for your custom hostname.

Nginx (Linux VM)

Create a new configuration block in /etc/nginx/sites-available/yourdomain.conf:

Nginx

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com api.yourdomain.com;

    location / {
        proxy_pass http://localhost:5000; # Points to your backend application port
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'keep-alive';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

Enable the site and reload Nginx:

Bash

sudo ln -s /etc/nginx/sites-available/yourdomain.conf /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

IIS (Windows VM)

Open Internet Information Services (IIS) Manager.
Right-click your web application under Sites and click Edit Bindings.
Click Add:
- Type: http or https
- IP address: All Unassigned
- Port: 80 (or 443)
- Host name: yourdomain.com (or api.yourdomain.com)
Click OK.

Step 5: Provision Free SSL/TLS Certificates (HTTPS)

Secure incoming traffic using Let's Encrypt SSL.

On Linux (Nginx / Apache)

Run Certbot: