Custom domains stuck on VALIDATING_OWNERSHIP despite correct DNS

geoffosborn

PROOP

16 days ago

---

Subject: Custom domains stuck on VALIDATING_OWNERSHIP despite correct DNS

Project ID: f524c9a5-b086-455c-8c83-71274b9a1456

Issue:

Three custom domains have been stuck on CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for over an hour. DNS is

correctly configured and Railway's API confirms DNS_RECORD_STATUS_PROPAGATED with matching CNAME values for all

three.

Affected domains:

Domain: test.fourize.io

Environment: 41268f38-2a5b-4658-96ef-63ea8d355b58

CNAME Target: vw0fheyc.up.railway.app

DNS Status: Propagated (match)

Cert Status: VALIDATING_OWNERSHIP

────────────────────────────────────────

Domain: beta.fourize.io

Environment: 3aa2b51a-68c9-4cb2-9e76-9bda8fc3155b

CNAME Target: wccebfmn.up.railway.app

DNS Status: Propagated (match)

Cert Status: VALIDATING_OWNERSHIP

────────────────────────────────────────

Domain: app.fourize.io

Environment: 31c14c00-5e08-4ef1-9d40-7323ea45f348

CNAME Target: z373taoj.up.railway.app

DNS Status: Propagated (match)

Cert Status: VALIDATING_OWNERSHIP

Additional context:

- A pre-existing domain (fourizecompliance.com) on the same project is also stuck on

CERTIFICATE_STATUS_TYPE_ISSUING

- All services are deployed and healthy (200 on Railway-generated domains)

- Custom domains return Railway's {"status":"error","code":404,"message":"Application not found"} when accessed

- No CAA records on fourize.io that would block Let's Encrypt

- Domains were created ~1 hour ago via the GraphQL API

Could you check if there's an issue with certificate validation for this project? Thanks.

$20 Bounty

2 Replies

Railway

BOT

15 days ago

This thread has been marked as public for community involvement, as it does not contain any sensitive or personal information. Any further activity in this thread will be visible to everyone.

Status changed to Open Railway • 15 days ago

aemorandin-coder

FREE

15 days ago

Potential Workaround (Try with Caution)

If support does not respond within a few hours, you can try to force a re-trigger of the validation job. Warning: Do not do this repeatedly, or you may hit Let's Encrypt rate limits.

Go to the Railway Dashboard.
Navigate to the Settings tab for one of the affected environments.
Remove one of the stuck domains.
Wait 5 minutes.
Re-add the domain.
This sometimes forces the edge router to re-evaluate the routing rules and triggers a fresh ACME challenge attempt.

Check Let's Encrypt Rate Limits

Since you have one domain stuck on ISSUING and three on VALIDATING, ensure you haven't hit the Duplicate Certificate limit (5 certificates per exact set of domains per week). Given these are new subdomains (test, beta, app), this is unlikely, but worth keeping in mind if you attempt the "Remove/Re-add" workaround multiple times.

geoffosborn

PROOP

15 days ago

thanks Aemorandin , I've tried that (via claude), still not working it seems as below:

Update: Tried the remove/re-add workaround suggested in the thread.

Here's what I did:

1. Removed all three stuck domains (app.fourize.io, test.fourize.io,

beta.fourize.io) via the API

2. Waited 5 minutes

3. Re-added all three domains

Unfortunately, all three immediately returned to

VALIDATING_OWNERSHIP and have stayed there. No progress after 15+

minutes.

DNS is confirmed correct for all three:

- app.fourize.io → CNAME → z373taoj.up.railway.app (resolves to

66.33.22.3)

- test.fourize.io → CNAME → vw0fheyc.up.railway.app (resolves to