I’d split this into two checks, because the 525 and the “domain disappears from service config” may be related, but they’re not exactly the same symptom.

For the SSL side: keep Cloudflare DNS-only for every record pointing at Railway, and make sure Cloudflare SSL mode is Full, not Flexible. Flexible can create some really confusing behavior once Railway starts trying to serve the cert.

For the verification side, I’d check the exact public records from outside Cloudflare:

dig +short CNAME _acme-challenge.uniadshare.com
dig +short TXT _railway-verify.uniadshare.com
dig +short CAA uniadshare.com

If you have CAA records, allow Let’s Encrypt, including wildcard issuance:

0 issue "letsencrypt.org"
0 issuewild "letsencrypt.org"

One thing I’d avoid is repeatedly adding apex + wildcard while old validation targets are still cached. I’d get one hostname verified/certed first, then add the wildcard after that. If the TXT/CNAME resolve publicly and Railway still removes the domain from the service, then I wouldn’t keep changing DNS providers. That’s the point where staff need the service id plus the exact generated verification target Railway gave you.

Removing the proxy worked!