Custom domains on my project have been stuck at Validating ownership all day, across two registration attempts, while DNS on our side is verifiably correct.

Project / service:

Workspace: Plaidware Solutions

Project: exactpoint — 1d7b7296-a589-43ec-9dc9-447365c8c081

Environment: production — 94322d99-03a1-4f68-a9d9-45b041db45e4

Service: web — 94e6fe38-daa9-47d0-9dda-1b5370861ec6

Stuck domains (current):

exactpointrepairs.com — domain id 932eb9f0-5b9c-401e-8313-9b7abefaae38, created 2026-08-16 10:47 UTC, target fvmkyoev.up.railway.app

www.exactpointrepairs.com — domain id 43c4f974-732d-4318-8f5f-2dcbef775c8d, created 2026-08-16 10:47 UTC, target ukmekgv3.up.railway.app

Timeline & evidence:

First registration of these hostnames was ~02:30 UTC today (ids ca005da5-4f08-40b9-a34c-18452b6c08b2 / 152bfa3e-0783-4518-a514-56cfca9858df); after 8 hours stuck in VALIDATING_OWNERSHIP I deleted and recreated them, updated DNS to the new targets, and the new pair has now been stuck ~2 hours the same way.

The API reports dnsRecords.status: DNS_RECORD_STATUS_PROPAGATED and cdnProvider: DETECTED_CDN_PROVIDER_CLOUDFLARE, yet certificateStatus never leaves CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP.

I tested both configurations: DNS-only (grey-cloud) records — where your checker read back currentValue exactly equal to the required CNAME target for the www record — and Cloudflare-proxied with SSL "Full" (the config my other project uses successfully). Stuck in both.

Independently verified clean: no CAA records on the zone, DNSSEC off, port 80 to your edge reachable (ACME HTTP path answers), apex flattening resolves to your edge IPs.

Same workspace, same Cloudflare account: project diamondridge-production has six custom domains (incl. apex diamondridge.live) all VALID in the identical proxied configuration — so this doesn't look like plan, DNS, or configuration.

Requests to the hostnames currently reach your edge and return the "train has not arrived" 404 (example edge request id from earlier today: WYFgSnnqRkSbMH6Mlt7tkg).

Ask: please inspect/re-kick the ownership-validation + certificate issuance job for the two domain ids above (or advise what your validator is seeing that public DNS isn't showing us).