Your TXT verification record is confirmed, but the apex domain simsimfoodstudio.com.au is currently resolving to an A record at 69.46.46.116 instead of the Railway target 937hjf02.up.railway.app. That is why the certificate is stuck on "validating challenges" - the domain's traffic is not reaching Railway. The ALIAS record you added at VentraIP either has not propagated, is misconfigured, or VentraIP's ALIAS implementation is not resolving as expected. Confirm in your VentraIP DNS panel that the ALIAS record for the root (@ or blank hostname) points to 937hjf02.up.railway.app and that no conflicting A record exists for the root domain, since an A record will take precedence. If VentraIP's ALIAS does not behave like CNAME flattening, switching your nameservers to Cloudflare is a reliable alternative for root-domain CNAME support.

I don't have any A records associated with that domain in VentraIP, so I'm not sure where that value is from. Checking https://mxtoolbox.com/ it looks likes the value comes from Railway?

Railway (AS400940)

To correct our earlier message, your VentraIP ALIAS record is actually working correctly. The domain is resolving to Railway and traffic is reaching your service. The A record you see at 69.46.46.116 is the result of ALIAS/CNAME flattening, which is the expected behavior for a root domain ALIAS. Your TXT verification record is also confirmed. The certificate authority is currently processing the validation challenges, which can occasionally take longer than the typical one-hour window. Your DNS configuration looks correct, so the certificate should complete issuing shortly.

I got Failed to issue TLS certificate

Your DNS configuration is correct - the domain is verified and traffic is reaching your service. Certificate issuance can occasionally fail and needs to be retried. You can retry by removing the domain from your service's settings and re-adding it, or by using the Railway CLI's certificate retry subcommand for your domain. If you remove and re-add, avoid doing so more than a few times, as Let's Encrypt enforces a limit of 5 duplicate certificates per domain per week.