My service serves correctly on its Railway-generated domain, but both of my custom domains return the "Not Found — The train has not arrived at the station" page. No request ever reaches the container.

What works:

• The generated .up.railway.app domain serves the site correctly.
• Deploy logs show Caddy starting cleanly and listening on port 80 ("server running", addr :80). Deploys report SUCCESS.

What fails:

• The apex domain and the www subdomain both return Not Found.
• The TLS certificate is valid, so the request is clearly terminating at the Railway edge.
• The deploy logs contain zero HTTP request entries — only container startup. The requests appear to be dropped before reaching the container, at the domain-to-service mapping.

Already verified on my side:

• Both custom domains are added to the service and set to port 80.
• DNS is on Cloudflare, records set to DNS only (not proxied) for testing.
• Both CNAMEs match exactly what the Railway dashboard asks for.
• Nameservers are correctly delegated to Cloudflare at the registrar.
• No conflicting A records, no registrar forwarding, no redirect rules active.
• The domain is not attached to any other service in my account.

One detail that may be relevant: my DNS zone contains two _railway-verify TXT records for each name, left over from earlier attempts to connect the domain. I don't know which token is the current one, so I haven't removed any.

Questions:

1. Can the domain routing be re-provisioned at the edge for this service?
2. How can I tell which verification token is the active one, so I can remove the stale ones safely?

I'd rather not delete and re-add the domains, since my plan is at its custom domain limit.

I have the project and service IDs plus the Request ID from the error page — happy to share those privately with a staff member.