Custom domain not served by edge — control plane says VALID

Project: crm.stroinash (12dfbee7-67e7-4aa7-9b6d-3037f07916a8)

Service: crm-web (52a35390-06c4-47ef-8e9a-b219fb300709), environment: production

Domain: crm.stroinash.ru → target 0x9a7d50.up.railway.app

The custom domain is not served by the edge, although the control plane reports it as fully valid.

API returns:

certificateStatus: CERTIFICATE_STATUS_TYPE_VALID

CNAME requiredValue == currentValue == 0x9a7d50.up.railway.app, status: DNS_RECORD_STATUS_PROPAGATED

DNS is correct and stable (own NSD authoritative servers, verified on both):

crm.stroinash.ru CNAME 0x9a7d50.up.railway.app on ns1 and ns2, propagated to public resolvers (verified over 12 minutes, 24 checks)

_railway-verify.crm.stroinash.ru TXT railway-verify=98aadcd… resolves correctly

Behaviour — the same edge node responds on its own hostname but closes connections for our domain:

http://0x9a7d50.up.railway.app → 301, https:// → 404 (edge alive)

http://crm.stroinash.ru → connection closed (port 80, so this is not a TLS/cert issue)

https://crm.stroinash.ru → ECONNRESET, TLS handshake returns no peer certificate available

The domain appears registered in the control plane but never propagated to the edge.

Additional context: the CNAME target changed twice on its own without any action from us (mp5pjlmi → mpek4mjl), which is what broke the domain originally; re-creating the domain produced a third target (0x9a7d50). The dashboard kept showing a green check mark throughout, while the domain was down.