Summary: In short, you can't have the record you want, and your DNS host is doing things The Right Way.
Explanation: It is a violation of the DNS standadards to have a CNAME (alias record / forward record) at zone apex (the empty name at the front of the zone).
The reason for this is a CNAME record cannot have the name portion conflict with any record except a DNSSec record. In a typical zone, a CNAME record at zone apex would collide with at least the SOA and NS records (and likely several others). While some DNS servers will allow this, it is a Bad Thing, and can cause hard to diagnose failures (not to mention will not work if you move hosting of the zone to a standards-compliant DNS server, such as anything BIND-based).
Either have A records at zone apex (they can be a simple web server that just throws an HTTP 302 to www). If you can get static IP numbers for your Azure server instances, put an A record for each at the apex of your zone, and create a single CNAME record called "www" that points to the apex record.
As an example :
$ORIGIN example.com.
@ IN SOA ns1.example.com. [email protected]. (
101 ;
172800 ;
900 ;
1209600 ;
3600 ; )
@ IN NS ns1.example.com.
@ IN NS ns2.example.com.
@ IN A 123.234.1.123
@ IN A 123.234.1.124
@ IN A 123.234.1.125
ns1 IN A 123.234.1.126
ns2 IN A 123.234.1.127
www IN CNAME example.com.
@ | StealthForward | http://www.example.com