When adminportal domain zone is delegated to azure stack there is no way for an operator to add records (for example adding .txt when validating SSL certificates) without placing a ticket to Microsoft support. Why not just expose the dns zone in the "DNS zones" part of adminportal and let administrators configure part of the zone file (you can grey out all the non-configurable names such as portal/adminportal and so on).