Azure Front Door: Global load balancer and CDN

What Azure Front Door is

Azure Front Door is Microsoft's global entry point for web applications, combining anycast routing, TLS termination, caching and a web application firewall. It is typically placed in front of Azure App Service, Azure Storage or an external origin.

How DNSTrace.dev detects it

Detection correlates independent public signals. A single match is reported as strong evidence; agreement between a response header and the announcing network is reported as confirmed.

x-azure-ref — Per-request reference identifier used by Azure support.
x-azure-fdid — The Front Door instance identifier.
CNAME targets under azurefd.net — The Front Door endpoint hostname.
AS8075 — The Microsoft autonomous system commonly announcing the edge address.

What a detection proves

The response passed through an Azure Front Door profile.

What it does not prove

Which backend pool answered, or whether that backend is hosted in Azure. Front Door can route to origins outside Microsoft's network.

Common questions

Does AS8075 by itself prove Azure Front Door?

No. AS8075 announces a very large amount of Microsoft infrastructure. DNSTrace.dev only reports Front Door when a response header or endpoint hostname supports it.