9 days ago
Service: domain_fitness_site
Project: DOMAIN FITNESS INDUSTRY (35cd01d0-430b-4536-b89e-70e3a8d22ee4)
Environment: production
Symptom: Default domain (domainfitnesssite-production.up.railway.app) works perfectly, but all 3 custom domains (domainfitnessind.gr, www.domainfitnessind.gr, admin.domainfitnessind.gr) fail instantly with TLS handshake reset (~150-200ms). Errors: "Connection was reset" / "failed to receive handshake, SSL/TLS connection failed". Confirmed across multiple networks/clients.
DNS is correct (CNAME records, verified by nslookup, resolving to 69.46.46.x).
_railway-verify TXT records are in place. (Double-checked: TXT record values in Cloudflare match exactly what the Railway dashboard's "DNS records" panel currently shows as required for each domain.)
Domains show as "verified" in the Railway dashboard.
Tried: toggling Cloudflare proxy, re-adding domains (fresh CNAME targets), toggling Serverless, checking status page.
Analysis: Since the default domain on the same IP works but every custom domain fails at TLS, the certificate issuance or edge deployment for these hostnames may not have completed despite the verification checkmark. This matches the pattern in other recent threads here (e.g. "Custom domain stuck — certificate not issuing / not routing", "Custom domain returns 502/404 while default Railway domain works fine").
Please check: SSL certificate provisioning status and edge routing for these hostnames. Confirm whether the Let's Encrypt certificate issuance completed and is deployed to the edge.
2 Replies
9 days ago
This thread has been opened as a bounty so the community can help solve it.
Status changed to Open Railway • 9 days ago
9 days ago
Try using a VPN, 1.1.1.1 as DNS, or a different network to access the site. I’m able to access it just fine.
9 days ago
same IP, only the custom domains fail, reset happens almost instantly. That points to something blocking based on the domain name itself, not a cert or Railway problem — likely your ISP or network filtering new domains.
Test this: run openssl s_client -connect domainfitnessind.gr:443 -servername domainfitnessind.gr from the network where it fails, then run it again on mobile data.
Fails on wifi but works on mobile data → it's your network blocking it, not Railway.
Fails on both → it's actually Railway's edge, worth pushing further.