The bare domain without any subdomain (example.com), also known as the zone apex or root domain. Since a CNAME is not allowed there, routing it to a service like Front Door relies on CNAME flattening or Azure DNS alias records.
Also called root domain, zone apex.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Apex domain in context, with comparison tables and the common traps.
Terms in this definition
- Domain
A way of grouping workspaces by area of the business, in support of a data mesh approach. Items take on their workspace's domain, letting you filter the OneLake catalog by it, and certain tenant settings can be passed to domain admins; domains have no effect on access permissions.
- Subdomain
A domain nested under a Fabric domain to group workspaces more finely. It doesn't get its own admins, since admins of the parent domain look after it, and for now only general settings are available for it.
- CNAME
Alias record in DNS that points one name at another, for example
wwwat<app>.azurewebsites.net; it can't be placed at the apex of a zone. - Geographic
A Traffic Manager routing method that picks the endpoint according to where the user is located geographically.
- LIKE
Compares strings with a pattern that can contain the % and _ wildcards. Because it only understands character patterns, searching big volumes of text this way is much slower than using full-text search.
- Azure DNS
Family of Azure services for hosting and resolving DNS, covering public zones, private zones and DNS Private Resolver; you can't register domain names through it.
- Private Link service alias
When you create a Private Link service, Azure gives it a read-only name that is unique worldwide. The provider passes this to consumers, who use it, or the resource ID, to request a private endpoint connection.
Related terms
- A record
Points a DNS name at an IPv4 address. A typical use is pointing a root (apex) domain at an app.
- Enterprise Admins
Members of this built-in group, found only in the forest root domain, can change things that affect the entire forest, for example creating new domains.
- PDC emulator
Handles account lockouts, gets new passwords ahead of other domain controllers, and in the forest root domain serves as the authoritative clock. It is one of the domain operations master roles.
- Schema Admins
A built-in group in the forest root domain that is allowed to change the Active Directory schema. Best practice is to leave it without members except when a change is needed.
- Windows Time service
The Windows service that keeps clocks in sync using NTP. Domain members take time from the AD DS hierarchy, and the PDC emulator in the forest root domain gets it from an outside source.