My site uses Azure Front Door Standard in front of a Container App. The www domain is a CNAME, and the apex uses an alias A record. Both domains are approved and bound to the same route, with managed certificates.
The apex redirects to www in my tests, but some visitors occasionally get a connection error on their first attempt and succeed after refreshing. Going straight to www appears to work. What should I check next?
Check the Front Door route and rule set for both HTTP and HTTPS on the apex. The redirect should happen at Front Door, before the request needs to reach the container. An HTTP request returning a Container App 404 would point to a different path than the redirect you expect.
Capture the status, Location header, and x-azure-ref for each hop without automatically following redirects. Compare a failing request with a successful one, including the hostname and protocol actually used. Also check that Front Door connects to the origin over HTTPS if that's your intended setup.
I'd revisit DNS from the affected network rather than assume a clean lookup elsewhere settles it. Compare the apex and www answers, including any IPv6 results, and note the resolver, time, and record TTLs. An alias A record at the apex is not automatically wrong just because www uses a CNAME.
If you can reproduce it, compare connections to the returned addresses while keeping the correct hostname for TLS. That may help separate a DNS or address-family issue from a routing or certificate problem. None of those is proven by the symptoms alone.
Try to get one useful failure report instead of more successful warm checks. Ask for the exact error, time, browser, network type, and whether the address bar shows HTTP or HTTPS. A screenshot can help if the person can't capture network details.
A fresh tab is useful, but it doesn't necessarily clear DNS, connection, or browser caches. Comparing a private session and a different network could help, without assuming either one guarantees a clean test.
If the failure is a Container App 404 rather than a browser connection error, check the origin hostname and Host header that Front Door sends, along with the route and origin configuration. That response suggests the request reached a container endpoint, but it doesn't by itself explain every reported failure.
Answers are reviewed before publication.
3p+teacaddy_618:
A bare domain entered in a browser doesn't tell you which protocol it tried first. Getting that detail from a failing attempt would help narrow this down.