23 days ago
Subject:
▎
▎ Hi Railway team,
▎
▎ A custom domain on my service has been stuck at "Validating ownership" for
▎ several hours and the TLS certificate never issues. It keeps serving the
▎ default *.up.railway.app cert, so the domain fails over HTTPS.
▎
▎ Details:
▎ - Project: grant-gold (39a9a782-1125-4077-9b24-67d1553be05a)
▎ - Service: grant-gold, Environment: production
▎ - Custom domain: http://www.nonprofitaid.org
▎ - Target CNAME: u569tj34.up.railway.app
▎
▎ What I've verified on my side:
▎ - DNS is correct and your dashboard shows the record PROPAGATED
▎ (www.nonprofitaid.org → u569tj34.up.railway.app, confirmed via public
▎ resolvers).
▎ - No CAA records on the domain (Let's Encrypt is permitted).
▎ - I removed a previously-added apex domain (nonprofitaid.org) that
▎ couldn't validate, in case it was blocking issuance — no change.
▎ - My app passes /.well-known/ paths through (ACME challenges aren't
▎ redirected).
▎
▎ Despite all of this, the cert status stays at "Validating ownership" and
▎ never completes. Could you re-trigger / force certificate issuance for
▎ www.nonprofitaid.org, or tell me what's blocking it on your end?
▎
▎ Thanks!
3 Replies
23 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 23 days ago
23 days ago
Delete the custom domain and re-add it after 10 minutes
In Railway, remove www.nonprofitaid.org.
Leave the DNS CNAME unchanged:
www.nonprofitaid.org → u569tj34.up.railway.app
Wait 10–15 minutes.
Add www.nonprofitaid.org back to the service.
Why this one? Because your DNS is already showing PROPAGATED. The most common failure mode at that point is a stuck ownership-validation or certificate-provisioning state in Railway's domain system. Removing and re-adding the domain forces Railway to create a fresh validation and certificate request.
Before doing it, verify there is only one DNS record for www and that it's the CNAME to u569tj34.up.railway.app. No A records, AAAA records, or Cloudflare proxying.
23 days ago
also as a personal rule i set for myself i always change the name of the generated domain railway generates.. i dont know why but i never had a dns problem sice doing that..
23 days ago
You need to add a TXT record at _railway-verify.www.nonprofitaid.org. Railway uses TXT records to verify domain ownership. If you are using the API to add your custom domain, you can find it in verificationToken under status