Custom domain stuck in VALIDATING_OWNERSHIP — edge returns x-railway-fallback despite syncStatus ACTIVE
jarquai
HOBBYOP

a month ago

Custom domain dunzo.holocene.fun never routes at the edge. Service donesies-web, project Dunzo (b0515db4-c743-49cf-9c3f-e6472fbd8cc6), edge edge-6705e5cc5ae5e82ae931d2b1f900f08f.

Symptom: requests to the hostname over HTTPS return 404 with x-railway-fallback: true and {"status":"error","code":404,"message":"Application not found"} — byte-identical to what an unregistered hostname returns. certificateStatus has been VALIDATING_OWNERSHIP for 19+ hours with certificates: [], and CT logs show no ACME order has ever completed. My read is that the cert can't issue because the edge doesn't route the host, so the challenge can't be answered.

What the API reports: syncStatus: ACTIVE, currentValue == requiredValue, DNS_RECORD_STATUS_PROPAGATED, targetPort: 8080.

Ruled out: DNS (correct at both authoritative nameservers and 4 public resolvers), CAA (none), DNSSEC (zone unsigned), plan quota (1 of 2 used), targetPort, and service health (307 on three other hostnames).

Two things that make this specific:

www.holocene.fun is a custom domain on the same edge in another project and works fine, holding a valid cert.

A serviceDomain I added to this same service routed immediately on the first request with no fallback header — so the edge accepts new routes for this service. Only custom-domain provisioning fails.

I deleted and recreated the custom domain, updated DNS to the new CNAME target, confirmed propagation across all public resolvers, and re-triggered customDomainIssueCertificate. Identical failure.

Possible to force a re-provision of this custom domain at the edge? Or other options?

Solved

1 Replies

Railway
BOT

a month ago

Your CNAME is correct and propagated, but the TXT ownership-verification record is missing entirely: there is no TXT record at the _railway-verify host for this domain, so it stays unverified and the certificate cannot issue. Add a TXT record in your DNS zone using the host and value shown in the domain's settings under Networking in the dashboard, and once it propagates verification will complete, the certificate will issue, and the edge will begin routing.


Status changed to Awaiting User Response Railway • about 1 month ago


Railway
BOT

a month ago

This thread has been marked as solved automatically due to a lack of recent activity. Please re-open this thread or create a new one if you require further assistance. Thank you!

Status changed to Solved Railway • 28 days ago


Welcome!

Sign in to your Railway account to join the conversation.

Loading...