15 days ago
Hi, a custom domain has been stuck on VALIDATING_OWNERSHIP for over 12 hours even though DNS is fully correct. Certificate is never issued.
Project: cashflow-tk-ventures
Service: cashflow-tk-ventures (57e4404f-9b10-4ed1-866a-e1a3b6e00e8e)
Environment: production
Custom domain: dashboard.tk-ventures.nl (domain id f6938ebf-ae07-426a-b7f4-4d81bee1f2f2)
Required CNAME target: tt27mmjv.up.railway.app
What I've verified on my side:
The CNAME dashboard.tk-ventures.nl → tt27mmjv.up.railway.app is correct and identical on all three authoritative nameservers (ns1/ns2/ns3.cloud86) and on Google (8.8.8.8) and Cloudflare (1.1.1.1) public resolvers. Single CNAME record, no conflicting records.
No CAA records on the domain or any parent that would block Let's Encrypt.
The service itself is healthy (returns HTTP 200 on cashflow-tk-ventures-production.up.railway.app).
The anomaly: Your API's status.dnsRecords.currentValue for this domain flaps between tt27mmjv.up.railway.app (correct) and sztphmkq.up.railway.app — and sztphmkq was the target of a previously deleted custom-domain entry for the same hostname. It hasn't resolved to sztphmkq in public DNS at any point in the last 12+ hours, so this looks like a stale value pinned in your internal resolver/validation cache that is preventing the ownership check from completing.
History: initial target was gd89r9s4, DNS was corrected, your cache lagged, so I deleted and re-added the domain (which assigned the new hash tt27mmjv), DNS was updated again and is correct everywhere — but validation is now wedged with the flapping currentValue described above.
Could you please clear/reset the stale DNS validation state for this domain so the certificate can be issued? I'd prefer not to delete + re-add again, since that just rotates the hash and risks the same wedged state.
Thanks!
2 Replies
15 days ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • 15 days ago
15 days ago
"Validating Ownership" error is related to a misconfigured TXT record, since Railway uses TXT records to verify domain ownership. Now, looking at your TXT record for _railway-verify.dashboard.tk-ventures.nl, it appears to be malformed because it contains 66 characters after railway-verify= (it should be 64 characters). I suggest you double check the value of your TXT record, and if you are using the API to add your custom domain, make sure you're getting it from verificationToken under status.
15 days ago
this guide will be helpful: https://docs.railway.com/networking/domains/working-with-domains