Your DNS is correctly configured - the CNAME for portal.airecepcja.pl is pointing to the right Railway target. Since you're using Cloudflare, make sure your SSL/TLS encryption mode is set to Full (not "Full (Strict)" and not "Flexible") in your Cloudflare dashboard under SSL/TLS > Overview. If the certificate is still stuck after that, try temporarily disabling the Cloudflare proxy (grey cloud), wait for the green checkmark to appear in your Railway service settings, then re-enable the proxy (orange cloud).

Thank you but none of this worked. How long is the propagation?

matter became very urgent, please help

• Domain: portal.airecepcja.pl
• Service ID: d4f6c5a9-233a-4969-9bc1-c9d074efc149
• CNAME points to 7gu21x0p.up.railway.app (DNS only, confirmed propagated)
• TXT _railway-verify.portal is set correctly
• Domain has been deleted/recreated 4+ times
• verified stays false, cert stuck on VALIDATING_OWNERSHIP

Your custom domain is not currently attached to your service, and your DNS records are not configured correctly. Right now, portal.airecepcja.pl has an A record pointing to 76.76.21.21, which is not a Railway IP.

To fix this:

1. Re-add the custom domain to your service in the Railway dashboard
2. In Cloudflare, delete the existing A record for portal and create a CNAME record pointing to the target shown in your Railway dashboard
3. Add the TXT verification record shown in the dashboard
4. Wait for the green checkmark to appear in Railway. Do not remove and re-add the domain, as that restarts the verification process from scratch.