Hi, I'm blocked on a custom domain issue that three AI agent troubleshooting sessions couldn't resolve. I believe this might need human backend access? Open to any ideas you all have, as I'm a new Railway user. **Issue:** All 3 custom domains stuck at `CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP` for 75+ minutes. Edge returns `HTTP 404` with `x-railway-fallback: true`. No Let's Encrypt certs have been issued (verified via crt.sh). **Confirmed working:** * DNS propagated (Railway's own check returns `DNS_RECORD_STATUS_PROPAGATED`, `currentValue` matches `requiredValue`) * Custom domains present in both instance-level `customDomains` and service config * All services Online **What we think is broken:** The cert/edge sync layer. Agent couldn't find a way to force cert validation or edge route re-publication. Suspect either the Let's Encrypt challenge isn't being initiated, or the edge routing daemon isn't picking up the domain binding. Confirmed no conflicting DNS records, zone has exactly 3 CNAMEs, all pointing to Railway-assigned targets per the dashboard's `requiredValue` field. This differs from the common scenario in Station post `43547eb8` where a leftover A record was the blocker. Happy to provide any additional diagnostic info. Any ideas? Thanks!

Custom domain assistance - Railway Central Station

Custom domain assistance

jtlapenna

HOBBYOP

a month ago

Hi,

I'm blocked on a custom domain issue that three AI agent troubleshooting sessions couldn't resolve. I believe this might need human backend access? Open to any ideas you all have, as I'm a new Railway user.

Issue: All 3 custom domains stuck at CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for 75+ minutes. Edge returns HTTP 404 with x-railway-fallback: true. No Let's Encrypt certs have been issued (verified via crt.sh).

Confirmed working:

DNS propagated (Railway's own check returns DNS_RECORD_STATUS_PROPAGATED, currentValue matches requiredValue)
Custom domains present in both instance-level customDomains and service config
All services Online

What we think is broken: The cert/edge sync layer. Agent couldn't find a way to force cert validation or edge route re-publication. Suspect either the Let's Encrypt challenge isn't being initiated, or the edge routing daemon isn't picking up the domain binding.

Confirmed no conflicting DNS records, zone has exactly 3 CNAMEs, all pointing to Railway-assigned targets per the dashboard's requiredValue field. This differs from the common scenario in Station post 43547eb8 where a leftover A record was the blocker.

Happy to provide any additional diagnostic info.

Any ideas? Thanks!

Solved

2 Replies

Status changed to Awaiting Railway Response Railway • about 1 month ago

sam-a

EMPLOYEE

a month ago

Your CNAME records are correct and propagated, but all three domains are missing the required TXT ownership verification records, which is why certificates are stuck at the validating ownership stage. You need to add a TXT record at your DNS provider for each domain: _railway-verify.portal for portal.hellosniff.com, _railway-verify.app for app.hellosniff.com, and _railway-verify.api for api.hellosniff.com. The token values for each are shown in the domain settings on your dashboard under each custom domain's DNS configuration. Once the TXT records propagate, ownership will be verified and certificates will be issued automatically. See custom domains docs for reference.

Status changed to Awaiting User Response Railway • 30 days ago

jtlapenna

HOBBYOP

a month ago

Thank you!

Status changed to Awaiting Railway Response Railway • 30 days ago

Status changed to Solved Railway • 30 days ago

Welcome!