Your CNAME record is correctly propagated, but the TXT ownership-verification record is missing. Certificates require both a CNAME for traffic routing and a TXT record for domain verification. At your registrar (TransIP), add a TXT record with the host and value shown in the "Show DNS Records" section of the domain's settings in your Railway dashboard. The certificate should proceed once that record propagates.