I have a custom domain that will not issue a certificate. It has been sitting at CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for over 13 hours, across three separate attempts, with DNS confirmed correct each time.

Details

Project: nannyroster - 4d68a24c-db7c-4b4f-b94f-4dbddea664c0

Environment: production - 61be0f7b-f3fd-4f42-9440-f263a29a388a

Service: api - 76cefa2a-ee6a-43d8-98d7-0782805be735

Custom domain: api.nannyroster.com - current ID 8e20aa86-ce47-4363-85c6-681e3026bea4

Required CNAME target: 26j92x4j.up.railway.app

What I have verified

The DNS record at my registrar (Hostinger) is CNAME api -> 26j92x4j.up.railway.app with a 300 second TTL. Both Google and Cloudflare public resolvers return that exact value. Railway's own API confirms it: requiredValue and currentValue are identical and the record shows DNS_RECORD_STATUS_PROPAGATED. There are no CAA records on the domain that would restrict issuance.

What I have already tried

I deleted and recreated the custom domain twice. Each recreation issued a new CNAME target, I updated the DNS record to match, and confirmed propagation on both resolvers before waiting. All three attempts stalled at the same status. I have stopped recreating it, since each attempt only costs another propagation cycle.

Notes

The service itself is healthy and the deployment succeeded. https://api-production-5d88.up.railway.app/api/health returns {"ok":true}, so the app and its Postgres connection are fine. The only failure is certificate issuance on the custom domain.

The domain was originally created around 01:57 UTC on 2026-08-04 with a 14400 second TTL, which caused a genuine propagation delay on the first attempt. That is no longer a factor - the TTL has been 300 for many hours and both resolvers have agreed for over an hour.

Is there anything on your side blocking validation for this domain, or a way to force a re-check without recreating it again?