Forwarding IPV4 instead of IPV6 in Azure Front Door

@Ishan Saxena
Thank you for reaching out. I understand that you recently implemented Azure Front Door and the X-Forwarded-For header which gives the IPV6 instead of the IPV4.

This issue is specific to the client environment. As Azure Front Door supports Dual Stack this is expected behavior for clients using only IPv6 or Dual stack IP addresses. In most of the client environments using dual stack, IPv6 addresses are preferred for communication.

Currently disabling IPv6 functionality for a specific Azure Front Door endpoint is not supported by design.

I think the work-around in this case will be set DNS for Azure FrontDoor Domain/Custom Domain in such a way that it only resolves to IPv4 address as If a dual-stacked device queries the name of a destination and DNS gives it an IPv4 address (a DNS A Record), it sends IPv4 packets. If DNS responds with an IPv6 address (a DNS AAAA Record), it sends IPv6 packets.

I currently validating with the team internally, if this will work if an alias record (A record) is added for the FrontDoor domain as it will always resolve to an IPv4 address, and a Dual Stack client will use IPv4 address to connect.

Please let me know if you have any questions. Thank you!

Hi Chaitanya, Thanks for your answer, could you please also elaborate how can we set DNS for Azure FrontDoor Domain that it resolves to IPv4 address so this can be achieved.

@Ishan Saxena

Thank you for getting and apologies for the delay here.

how can we set DNS for Azure FrontDoor Domain that it resolves to IPv4 address so this can be achieved.

In order to achieve this.

• You need to create Alias record for your Front Door Custom Domain. For this you will have to create Azure DNS zone for your Custom domain.
• Just FYI Apex domains don't have CNAME records pointing to the Azure Front Door profile, therefore managed certificate autorotation will always fail unless domain validation is completed between rotations. If you are using a BYOC then this limitation does not apply to you. This is currently documented here.
• After this you can follow this CLI command to create an Alias record. Sample command below.

az network dns record-set a create -g contosorg -z contoso.com -n www --target-resource /subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/contosorg/providers/Microsoft.Cdn/profiles/contoso/afdendpoints/contosoendpoint

This will create alias record for the Azure Front Door endpoint and this way it will always resolve to an IPv4 address.

Thank you! Please let me know if you have any questions.