a month ago
Environment: production
Service: web
Custom domain: plat.recro.ru
Railway service domain: web-production-7d81c.up.railway.app
Our application and Railway health checks are healthy. The custom domain intermittently fails before reaching the application.
Controlled test from the affected route:
-
https://web-production-7d81c.up.railway.app/health
-> HTTP 200 in ~0.37s
-> Railway edge IP: 69.46.46.73
-
https://plat.recro.ru/health, forced to the exact same IP:
curl --resolve plat.recro.ru:443:69.46.46.73 https://plat.recro.ru/health
-> TLS connection timeout after 5s
-> no HTTP request reaches application logs
DNS for plat.recro.ru is correct and points to the Railway-provided CNAME.
The domain also works from some networks, including a Russian Timeweb host.
The difference occurs before HTTP, at TLS ClientHello/SNI:
- SNI web-production-7d81c.up.railway.app works
- SNI plat.recro.ru times out on the same edge IP
Could you check the Hikari edge routing/certificate binding for plat.recro.ru, especially on the Amsterdam edge, and advise whether the custom domain can be moved to another ingress/legacy edge or prefix?
2 Replies
a month ago
This thread has been opened as a public bounty so the community can help solve it. The thread and any further activity are now visible to everyone.
Status changed to Open Railway • about 1 month ago
a month ago
Your domain works, as you pointed out for some networks in Russia. Unfortunately, this appears to be a regional block, Railway can't do anything about it. You can use a VPN to access it instead.
a month ago
Additional testing confirms this is not an application or DNS issue.
Our deployment is healthy, plat.recro.ru is verified, and the Railway service domain works. However, from some Russian routes, the custom domain times out before any request reaches our application.
The domain works from Austria and through a full VPN tunnel. We also observed inconsistent access to the Hikari 69.46.46.* range from Russian networks. A temporary newly verified custom domain showed the same behavior, so this does not appear to be limited to the original hostname.
We understand that a VPN can be a temporary workaround, but it does not solve access for our users in Russia.
Could a Railway team member please review the custom-domain TLS/SNI routing and advise whether the domain can be moved to another ingress or IP range? We would appreciate a supported technical solution.