Summary

A custom domain has been stuck in CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP

for over an hour, with errorMessage null. Both DNS records that the dashboard

asks for (CNAME + TXT) are in place and resolve correctly from public

resolvers. No certificate is ever issued, and the edge keeps serving the

*.up.railway.app wildcard certificate for the custom hostname.

Environment

Project: verdeser-trazabilidad (571eb521-5885-43b0-b5d2-9139e4c4b5b7)

Environment: production (dcff0ba1-d479-4509-bac4-79c79dd95f10)

Service: verdeser-trazabilidad (466e3522-cc3b-4cd5-8357-6e80d855115e)

Domain: app.somosverdeser.com (e199c4e2-3bc5-4d4e-959e-f3fdfa8fd3da)

Target port: 8080

Registrar: GoDaddy

Date: 2026-09-08

What I have verified from public DNS (8.8.8.8)

1. CNAME is correct and propagated:

   app.somosverdeser.com CNAME 1hesg1ai.up.railway.app

   1hesg1ai.up.railway.app A 69.46.46.55

2. The ownership TXT record shown in "Configure DNS Records" is present and

   propagated, and its value matches what the dashboard displays:

   _railway-verify.app.somosverdeser.com TXT

   "railway-verify=9913554824ee6a7bff09daea0501617a1bfb756b0af65969ce6838e04953054b"

3. There are no CAA records on somosverdeser.com or on the subdomain, so

   Let's Encrypt is not being blocked at the DNS level.

4. The certificate currently served for app.somosverdeser.com is the Railway

   wildcard, not one for the custom hostname:

   subject=CN=*.up.railway.app

   issuer=C=US, O=Let's Encrypt, CN=YE1

   notBefore=Jul 29 02:40:55 2026 GMT

   notAfter=Oct 27 02:40:54 2026 GMT

   Browsers therefore fail with a hostname mismatch (SEC_E_WRONG_PRINCIPAL /

   ERR_CERT_COMMON_NAME_INVALID).

What Railway reports

The dashboard shows a green check on the CNAME row and a warning triangle on

the TXT row, with the domain labelled "Waiting for DNS update" - even though

the TXT record resolves publicly, as shown above.

Querying domain status through the Railway MCP server returns:

verified: false

certificate.status: CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP

certificate.errorMessage: null

certificate.retryable: null

dnsRecords: [ only the CNAME entry, status DNS_RECORD_STATUS_PROPAGATED,

            requiredValue == currentValue ]

Note that the TXT record does not appear at all in the dnsRecords array, even

though the dashboard requires it. That inconsistency looks like it may be

related to the stall.

Request

Could you re-trigger ownership verification and certificate issuance for this

domain server-side? I would prefer not to delete and re-add the domain, since

that regenerates the railway-verify token and would require another registrar

change - and I have no reason to think a second attempt would behave

differently.

If the stall is caused by something on my side that I have missed, please

point me at it.