19 days ago
Hi Railway team, our custom domain certificate has been stuck at VALIDATING_OWNERSHIP for more than three days and has never issued. I opened a ticket through help@railway.app on Friday but have not received a response yet, so I am hoping someone here can take a look.
Project: de3de6a5-c6b3-47b0-a63e-5df540f9b86e
Service: mentis-app
Domain: api.mentis-app.com
Current domain ID: f012a5ff-54c1-4c9a-a23b-23738f223eff
The domain uses a Cloudflare CNAME set to DNS-only. Railway’s API reports DNS_RECORD_STATUS_PROPAGATED, there are no CAA records, and DNSSEC is disabled.
We have recreated the custom domain four times. On the latest attempt, we deleted the DNS record before creating the domain, then added the newly issued CNAME target afterward. Every attempt reaches the same state: certificates: [], while ownership validation never advances.
The key detail is that Railway’s edge is already terminating TLS for the hostname and serving the *.up.railway.app wildcard certificate. Routing is working correctly, but certificate issuance for the custom domain appears to be stuck internally.
This is blocking our launch because we need a first-party API domain for Safari cookie support. Could someone force certificate issuance or tell us what is preventing validation from completing?
Thanks!
3 Replies
19 days ago
The CNAME record is propagated, but the domain is missing its TXT record, which is required alongside the CNAME for the certificate to issue. You can find the required TXT record host and value on your service's custom domain settings page. Create that TXT record in Cloudflare in DNS-only mode, and the certificate will issue once it propagates.
Status changed to Awaiting User Response Railway • 19 days ago
Status changed to Solved nwils000 • 19 days ago
19 days ago
Solved! The missing piece was the _railway-verify TXT record. Once added, verification completed within minutes, the certificate issued, and the domain went live.
One request for the team: please expose this TXT requirement more clearly in the API. customDomain.status.dnsRecords only returns the CNAME as PROPAGATED, while verificationDnsHost and verificationToken are separate and easy to miss. We monitored dnsRecords for three days across four domain recreations, and everything appeared complete.
Including the TXT record in dnsRecords with a REQUIRES_UPDATE status would make this much easier to diagnose.
Thanks for the help!
Status changed to Awaiting Railway Response Railway • 19 days ago
19 days ago
Glad it's working! That's a fair point about the API surface. You can post the suggestion at https://station.railway.com/roadmap so other users can upvote it.
Status changed to Awaiting User Response Railway • 19 days ago
Status changed to Solved mykal • 19 days ago