If you havent obfuscated that domain name, it's likely doing some checking on the tld as it isn't valid. I'd check that it's cnamed properly too. Azure normally checks the routing before it will allow you to add custom domains.

the domain name is obfuscated

Aren’t you able to leave out this property and let it auto-generate?

it said it was required

Hmm, it’s not in the latest version, according to https://github.com/pulumi/pulumi-azure-native/blob/master/sdk/dotnet/Cdn/CustomDomain.cs#L152

but Pulumi actually errored out saying it was missing

Oh, odd, that doesn’t sound right

no, but thats what I got.