a month ago
Hello.
My custom domain is verified in Railway:
ktosdelaet38.ru
Railway UI shows the DNS records as valid:
CNAME @ -> lw7oyxzg.up.railway.app
TXT _railway-verify -> verified
But the custom domain does not open from several Russian mobile operators: Tele2, Megafon and Beeline.
At the same time, the Railway generated domain works correctly from the same mobile networks:
https://web-production-bed8.up.railway.app/
DNS diagnostics:
ktosdelaet38.ru resolves to 69.46.46.70
web-production-bed8.up.railway.app resolves to 69.46.46.37
The app itself is healthy. The generated domain returns 200 OK.
The custom domain sometimes works from Wi-Fi, but does not open from mobile networks.
On desktop curl, the custom domain sometimes fails during TLS handshake:
schannel: failed to receive handshake
When the custom domain works, the response includes:
HTTP/1.1 200 OK
Server: railway-hikari
x-railway-edge: osl1
Project: angelic-comfort
Service: web
Custom domain: ktosdelaet38.ru
Generated domain: web-production-bed8.up.railway.app
Could you please check the custom domain edge / TLS / routing for ktosdelaet38.ru?
The issue seems specific to the custom domain edge, because the generated Railway domain works from the same mobile networks.
2 Replies
a month ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • about 1 month ago
a month ago
Hey! I don't think this is a Railway problem. I loaded ktosdelaet38.ru from outside Russia and it loaded perfectly fine (returns HTTP 200) with a valid certificate (the edge, TLS, and routing are all healthy, so there's nothing broken on Railway's side to fix).
You described the failure happening during the TLS handshake and only on Russian mobile networks, while your .up.railway.app domain works on those same networks. That sounds like Russian ISP filtering: the domain name is sent unencrypted in the TLS handshake, so their systems can see you're connecting to ktosdelaet38.ru and drop the connection. Your generated Railway domain has a different name they aren't filtering, which is why it still works.
Because it's the domain name being filtered and not the IP (otherwise it wouldn't connect at all, instead of failing mid-handshake), Railway can't change anything to fix this. It's imposed by the Russian networks.
What you can do: check whether your domain is on Russia's block registry (eais.rkn.gov.ru) and request removal if it's listed. Otherwise, Russian mobile users would need a VPN, or you'd have to serve Russian traffic through infrastructure that isn't being filtered.