Updated October 2026: fixed the DNS examples (placeholder values were not displaying), added a quick answer and an FAQ for the most common validation and SSL errors.
Quick Answer
- In Cloudflare DNS, add a proxied (orange cloud) CNAME:
cdn→mystorageaccount.blob.core.windows.net. - Add a DNS-only (grey cloud) CNAME:
asverify.cdn→asverify.mystorageaccount.blob.core.windows.net. - In Azure, add the custom domain to the storage account with Use indirect CNAME validation checked.
- In Cloudflare, set SSL/TLS to Full (strict).
Azure can't validate a domain whose CNAME is proxied (it sees Cloudflare's IPs, not its own host name), which is exactly what the asverify record solves.
Goal: serve images from cdn.yourdomain.com using Azure Blob Storage as the origin and Cloudflare for CDN caching and SSL. This is the setup cdn.ryanwilliams.io originally used. It's a simple, low-cost way to host images with global caching.
What you'll get
- HTTPS at https://cdn.yourdomain.com/…
- Cloudflare edge caching (fewer Azure egress charges over time)
- End-to-end encryption with SSL/TLS: Full (strict) in Cloudflare
Prerequisites
- An Azure Storage account (e.g., mystorageaccount.blob.core.windows.net)
- Your domain on Cloudflare (e.g., yourdomain.com)
- A subdomain for images (e.g., cdn.yourdomain.com)
- A blob container that allows anonymous read access (or the $web container if you use Static Website)
Step 1: Cloudflare DNS, point your CDN subdomain to Azure
In Cloudflare → DNS, create a CNAME for your CDN subdomain and proxy it through Cloudflare:
Type: CNAME
Name: cdn
Target: mystorageaccount.blob.core.windows.net
Proxy: Proxied (orange cloud)
TTL: AutoRequests to cdn.yourdomain.com now go through Cloudflare (caching + SSL) to your Azure Blob origin.
Step 2: Azure, add the custom domain with indirect CNAME validation
In the Azure Portal, open your Storage account and find Custom domain (under Networking in current portal layouts; older layouts show it under Settings or Blob service). Enter cdn.yourdomain.com and select Use indirect CNAME validation. Azure asks for an asverify record; add it in Cloudflare exactly as shown, and leave it unproxied:
Type: CNAME
Name: asverify.cdn
Target: asverify.mystorageaccount.blob.core.windows.net
Proxy: DNS only (grey cloud)
TTL: Auto- Click Save in Azure to complete validation.
- Keep the main cdn record proxied and the asverify record DNS-only.
Step 3: Cloudflare, enable strict SSL
In Cloudflare → SSL/TLS, set Encryption mode to Full (strict).
Why? Azure's *.blob.core.windows.net endpoint presents a valid Microsoft certificate, so strict mode gives you proper end-to-end TLS between Cloudflare and Azure. Optionally, under Edge Certificates, enable Always Use HTTPS and HSTS.
Step 4: Upload and test
- Upload an image to your container, e.g.
images/logo.png. - Open https://cdn.yourdomain.com/images/logo.png.
- The first load may be a cache MISS (see the
cf-cache-statusresponse header); reload to see a HIT.
Optional: set long cache headers on blobs
For static assets that never change at the same URL, set Cache-Control: public, max-age=31536000, immutable on the blobs. Cloudflare respects the origin's Cache-Control by default, which cuts origin requests and egress:
# Azure CLI: set Cache-Control on one blob
az storage blob update --account-name mystorageaccount --container-name images \
--name logo.png --content-cache-control "public, max-age=31536000, immutable"Troubleshooting
- Custom domain won't validate in Azure: the asverify CNAME must be DNS only (grey cloud) and match Azure's value exactly. If you used direct validation, Azure needs the main record to be grey-cloud while validating; indirect validation avoids that.
- 525/526 SSL errors: make sure the main cdn record is proxied, its target is your *.blob.core.windows.net endpoint, and Cloudflare is on Full (strict).
- 403/404 errors: confirm the container allows anonymous read access and the blob path (including case) is correct.
- Static website ($web) endpoint: if you serve from the
z13.web.core.windows.net-style static website endpoint instead, point the CNAME at that host name, not atblob.core.windows.net.
Why this is cheap
- Azure Blob Storage is inexpensive for storage and requests.
- Cloudflare (Free plan) adds global caching and SSL at no extra cost.
- You mainly pay Azure egress on cache misses; hits are served from Cloudflare's edge.
TL;DR: exact settings
# Cloudflare DNS
CNAME cdn -> mystorageaccount.blob.core.windows.net (Proxied)
CNAME asverify.cdn -> asverify.mystorageaccount.blob.core.windows.net (DNS only)
# Azure > Storage account > Networking > Custom domain
Domain name: cdn.yourdomain.com [x] Use indirect CNAME validation -> Save
# Cloudflare > SSL/TLS
Encryption mode: Full (strict)Frequently Asked Questions
Can I use Cloudflare in front of Azure Blob Storage?
Yes. Proxy a CNAME to the blob endpoint through Cloudflare, register the custom domain on the storage account with indirect (asverify) validation, and use Full (strict) SSL.
Why does Azure custom domain validation fail with the Cloudflare proxy on?
With the orange cloud on, DNS lookups return Cloudflare's IP addresses instead of a CNAME to Azure, so Azure can't see that you own the domain. Validate with the DNS-only asverify record instead.
Does Azure Blob Storage support HTTPS on a custom domain by itself?
Not directly: Blob Storage custom domains only support HTTP on their own. For HTTPS you need a CDN or proxy in front, such as Cloudflare or Azure Front Door.
That's it. You've got a fast, low-cost image CDN on your own domain using Azure Blob Storage and Cloudflare.
