a month ago
Custom domain: schedule.hainesgipson.com
Service: hga-web
Environment: production
Symptom: The custom domain has been stuck in VALIDATING_OWNERSHIP / "Waiting for DNS update" for hours. The web service has a healthy, live deployment (reachable at hga-web-production.up.railway.app), and the CNAME shows verified, but thedomain never finishes verifying and no TLS certificate is issued.
DNS is fully propagated and correct. The verify TXT resolves identically from Google (8.8.8.8), Cloudflare (1.1.1.1), Quad9 (9.9.9.9), and the authoritative nameservers (Network Solutions, ns13/ns14.worldnic.com).
Diagnostics:
$ dig schedule.hainesgipson.com CNAME +short
jntcprvz.up.railway.app.
$ dig schedule.hainesgipson.com A +short
jntcprvz.up.railway.app.69.46.46.60
$ dig schedule.hainesgipson.com AAAA +short
jntcprvz.up.railway.app.
$ dig TXT _railway.schedule.hainesgipson.com +short
(empty — no record)
$ dig TXT _railway-verify.schedule.hainesgipson.com +short
"railway-verify=903217eb046b3947ff291d728cb5a6bd0fc8fb57b0f0f5198dbd702cbf639be8"
The key discrepancy: your "Configure DNS Records" dialog instructed me to add the verify TXT at _railway-verify.schedule.hainesgipson.com (present and correct above), but the _railway.schedule.hainesgipson.com record your support diagnostics check is empty. Is the verifier now expecting the token at _railway. while the dashboard is still issuing _railway-verify.?
Requests:
- Confirm the correct verification TXT record name for this domain, or
- Force-verify the domain from your side, since DNS is correct and propagated.
The CNAME is already correct, so I'd prefer not to delete/re-add (it would change the CNAME target and isn't the domain admin's quick change to make), and I want to avoid Let's Encrypt rate limits from repeated attempts.
Pinned Solution
a month ago
Your DNS records seem fine, assuming the content is correct. It may take up to a few hours (maybe even a day) for Railway to validate the DNS and issue certificates. Unfortunately, if one isn't issued by then, your only option would be to try and remove the domain from Railway and add it back after ~10-15 mins. Update DNS records as necessary.
And yes, IIRC the TXT record should be on _railway-verify.
2 Replies
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • 30 days ago
a month ago
Your DNS records seem fine, assuming the content is correct. It may take up to a few hours (maybe even a day) for Railway to validate the DNS and issue certificates. Unfortunately, if one isn't issued by then, your only option would be to try and remove the domain from Railway and add it back after ~10-15 mins. Update DNS records as necessary.
And yes, IIRC the TXT record should be on _railway-verify.
a month ago
Unfortunately I'm in a situation where I am not the domain admin and can not update DNS records here, the admin turn around is a few days. I think that is the issue here. On other sites where I am the admin I have been in this exact situation and deleting the custom domain and re-adding it and updating the DNS records got me past. Just can't do that here.
Status changed to Solved 0x5b62656e5d • 16 days ago