Custom domain returns 404 with `x-railway-fallback: true` — cert VALID, DNS PROPAGATED, target port set

Question

Hi all — hoping someone has seen this before.

I added a custom domain to a web service. Everything looks correctly provisioned on both

sides (DNS propagated, certificate valid, target port set), but **every request to the custom

domain gets a `404` from the edge with the header `x-railway-fallback: true`** — as if the edge

has no mapping from that hostname to my service.

**Symptom** — the custom domain (served by the edge, never reaches the app):

```
$ curl -sI https://sub.example.com/
HTTP/1.1 404 Not Found
Server: railway-hikari
x-railway-fallback: true
x-railway-edge: waw1
```

The **same service, same edge** answers `200 OK` on its Railway-provided `*.up.railway.app`

domain, so the app is healthy and listening — only the custom-domain → service mapping seems

missing.

**DNS** — a plain CNAME to the value Railway asked for, no proxy/CDN (no Cloudflare) in front:

```
sub.example.com  ->  <token>.up.railway.app
```

**What Railway's dashboard/API reports for the domain:**

- Certificate: **VALID**
- CNAME record: **PROPAGATED** (`purpose = TRAFFIC_ROUTE`)
- Target port: set, and it matches the port the app listens on
- Only **one** required record is listed (the CNAME). No TXT record is requested or shown as

missing — even though the docs mention a TXT verification record, the dashboard never issued one

for this domain, so there's nothing to add.

**Already tried (no change):**

1. Delete + re-create the custom domain (new CNAME target), updated DNS, waited for propagation.
2. Re-issued the certificate → went VALID.
3. Redeployed the service several times → all SUCCESS.
4. Confirmed the app listens on the target port and the domain's target port matches.
5. Confirmed no proxy/CDN in front of the DNS record.

**Question:** has anyone hit a custom domain that stays stuck on `x-railway-fallback: true` (404)

even though cert + DNS + target port all check out? Is there a hidden verification step, or is this

an edge-routing entry that only Railway staff can re-register? Any pointers before I open a private

support thread would be great.

Thanks!

0x5b62656e5d · Accepted Answer

Make sure to add the TXT record at `_railway-verify.` (where `` is the domain you’re trying to add). You can get the content for it from the `verificationToken` property under `status`.