Mapping a custom domain (e.g., example.com or api.example.com) to an Azure Virtual Machine involves reserving a static IP address, opening network firewall ports, updating your DNS registrar records, and binding the web server.

Technical Overview & Prerequisites

User Request ──> https://api.yourdomain.com
                        │
                        ▼ (DNS Registrar - A Record)
                 Azure Public IP (Static)
                        │
                        ▼ (Network Security Group)
                   Ports 80/443 Open
                        │
                        ▼ (Azure VM Web Server)
            Nginx / IIS / Apache / Reverse Proxy

Step 1: Ensure Your Azure Public IP is Static

By default, Azure public IP addresses may be dynamic, meaning the IP changes if the VM is stopped or deallocated. You must set it to Static so your DNS mappings remain permanent.

  1. Log in to the Azure Portal.

  2. Navigate to Virtual Machines and select your VM.

  3. In the left menu under Settings, click Properties.

  4. Click on your Public IP address.

  5. On the Public IP page, click Configuration under Settings.

  6. Set Assignment to Static.

  7. (Optional) Under DNS name label, enter an alias prefix (e.g., myuniqueapp) to assign a default Azure FQDN (myuniqueapp.eastus.cloudapp.azure.com).

  8. Click Save at the top.

  9. Copy your Public IP Address for use in Step 3.

Step 2: Configure Network Security Group (NSG) Rules

Ensure Azure allows incoming HTTP and HTTPS web traffic to reach your virtual machine.

  1. On your VM's overview page in the Azure Portal, select Networking from the left menu.

  2. Under Inbound port rules, check if rules for HTTP (Port 80) and HTTPS (Port 443) are present.

  3. If missing, click Add inbound port rule and configure:

    • Source: Any

    • Source port ranges: *

    • Destination: Any

    • Service: HTTP (Port 80) / HTTPS (Port 443)

    • Action: Allow

    • Priority: 300 (or any available low number)

    • Name: Allow-HTTP-HTTPS

  4. Click Add.

Step 3: Add DNS Records at Your Domain Registrar

Log in to the DNS management dashboard provided by your registrar (e.g., GoDaddy, Namecheap, Cloudflare).

Scenario A: Mapping a Root Domain (yourdomain.com)

Add an A Record:

Record TypeHost / NameValue / DestinationTTL
A@YOUR.AZURE.VM.IP600s / 1 Hour

Add a CNAME Record for www:

Record TypeHost / NameValue / DestinationTTL
CNAMEwwwyourdomain.com600s / 1 Hour

Scenario B: Mapping a Subdomain (api.yourdomain.com)

Add an A Record or CNAME Record:

Option 1: Direct IP Mapping (A Record)

Record TypeHost / NameValue / DestinationTTL
AapiYOUR.AZURE.VM.IP600s / 1 Hour

Option 2: Azure FQDN Alias (CNAME Record)

(Requires configuring the DNS name label in Step 1)

Record TypeHost / NameValue / DestinationTTL
CNAMEapimyuniqueapp.eastus.cloudapp.azure.com600s / 1 Hour

Step 4: Configure the Web Server on the VM

Bind your web server on the VM to accept incoming requests for your custom hostname.

Nginx (Linux VM)

Create a new configuration block in /etc/nginx/sites-available/yourdomain.conf:

Nginx

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com api.yourdomain.com;

    location / {
        proxy_pass http://localhost:5000; # Points to your backend application port
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'keep-alive';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

Enable the site and reload Nginx:

Bash

sudo ln -s /etc/nginx/sites-available/yourdomain.conf /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

IIS (Windows VM)

  1. Open Internet Information Services (IIS) Manager.

  2. Right-click your web application under Sites and click Edit Bindings.

  3. Click Add:

    • Type: http or https

    • IP address: All Unassigned

    • Port: 80 (or 443)

    • Host name: yourdomain.com (or api.yourdomain.com)

  4. Click OK.

Step 5: Provision Free SSL/TLS Certificates (HTTPS)

Secure incoming traffic using Let's Encrypt SSL.

On Linux (Nginx / Apache)

Run Certbot:

Bash

sudo apt update
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com -d api.yourdomain.com

On Windows (IIS)

Use Certify The Web or win-acme:

  1. Download and run Certify The Web.

  2. Select your IIS site and target domain bindings.

  3. Click Request Certificate. It automatically provisions and binds Let's Encrypt certificates to IIS.

Step 6: Verify and Test

Test DNS propagation and HTTP accessibility using terminal commands:

  1. Verify DNS Propagation:

    Bash

    nslookup yourdomain.com

  2. Test HTTP/HTTPS Connection:

    Bash

    curl -I https://yourdomain.com