If you haven't deleted and re-added your domain, you're safe if you do it once (IIRC, LE rate limit is 5 tries per week) since re-adding the domain usually fixes the stuck state, I suggest you try to remove your custom domain and all its related DNS records, wait for 10 - 15 minutes, and add it again.

Thanks darseen, your fix worked, but only halfway. Update:

I did exactly what you suggested. Deleted both custom domains AND all their DNS records at Namecheap, waited a full 15 minutes, then re-added both domains and entered the new records Railway generated.

Result: www.savannahsquarepops.com verified and had a valid Let's Encrypt cert about 9 minutes later. It's live right now. So the stuck state was real and the re-add cleared it for that one.

But the bare domain savannahsquarepops.com is still sitting at "Validating domain ownership" roughly 20 minutes after the re-add. New domain ID is ae1ba407-e302-43d5-8dc7-a4fe8d58f911, target 55nc9eh3.up.railway.app.

What I've verified since:

1. The _railway-verify TXT is an exact byte-for-byte match on Namecheap's own authoritative servers, on Google DNS, and on Cloudflare DNS. All 79 characters.
2. The root uses a Namecheap ALIAS record (their CNAME flattening), which publishes A 69.46.46.17, one of your edge IPs. I know the dashboard's CNAME row will never show a literal CNAME because of flattening. My other Railway project (aisle-scout.com, root on Cloudflare flattening) works the same way, so I don't think the record shape is the issue.
3. The bare domain currently returns Railway's 404 "Application not found", which your docs say is the unverified-domain response.

My questions:

1. Is it possible Railway's resolver cached the ABSENCE of the TXT during the 15-minute deletion window and is still serving that negative answer? If so, how long before your verifier re-checks?
2. With ALIAS/flattening at the root, does verification need anything beyond the TXT?
3. Would you delete and re-add JUST the root one more time at this point, or does that risk making it worse?
4. Is there any way to force a re-verification on domain ID ae1ba407-e302-43d5-8dc7-a4fe8d58f911?

The www half being fixed proves the pipeline works. I just need the bare domain to take the same trip. Thanks again.

RESOLVED — both domains live with valid certificates. Here's the complete recipe for anyone who lands on this thread with a root/apex domain stuck at "Validating domain ownership":

1. darseen's delete/re-add fixed my www subdomain on the first cycle (cert about 9 minutes after re-adding). Accepting that answer for the bounty — thank you.

2. My bare domain needed more. A second, root-only delete/re-add with a much longer gap (about 2.5 hours instead of 15 minutes) got it verified and routing in about 5 minutes — the longer gap matters because resolvers can negative-cache the ABSENCE of your _railway-verify TXT from the deletion window.

3. The certificate still sat at "validating ownership" after that, and here's the part I couldn't find documented anywhere: Railway's public GraphQL API has a mutation that force-runs the certificate order:

mutation { customDomainIssueCertificate(id: "") }

POST it to https://backboard.railway.com/graphql/v2 with your account token. It returned true, and my certificate went from "validating ownership" to issued in under a minute — after being wedged for over five hours across earlier attempts today. The dashboard has no button for this, and the retry endpoint refuses while the status is stuck "in progress" rather than "failed," so this mutation is the only self-service kick.

Notes for anyone searching: apex on Namecheap ALIAS (their CNAME flattening) works fine with Railway — the dashboard's CNAME row will always show yellow at the apex because flattening never exposes a literal CNAME. Trust the TXT check and your app answering on the domain, not the widget. And the Let's Encrypt duplicate-cert limit only counts ISSUED certs, so failed validation cycles don't burn it.

Railway team: a dashboard "re-issue certificate" button (or letting the retry endpoint work on stuck-in-progress orders) would have saved my whole launch day. Thanks darseen!

You're welcome! Glad you got it working.