Two custom domains on service "web" have been stuck at "Waiting for DNS update" for over 3 hours and no certificate is issued.

Project: 2dd4f524-1276-4c30-b298-3bc2e5694d64 (qdenta)

Environment: production

Service: web

Domains: qdenza.com and www.qdenza.com

Both report verified: false and certificate status CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP with errorMessage: null.

In the "Configure DNS Records" dialog, the CNAME row shows a green check for both domains, but the TXT row shows a warning icon - Railway does not appear to see the TXT records. They are in fact live and correct.

DNS is on Cloudflare with the proxy disabled (DNS only, grey cloud).

Both _railway-verify TXT records resolve correctly from two independent public resolvers (Cloudflare 1.1.1.1 and Google 8.8.8.8), and their values match the ones shown in the Railway dashboard character for character. I can share the exact values privately if needed.

www.qdenza.com: CNAME -> 1fdrmvos.up.railway.app. The API reports currentValue equal to requiredValue with status DNS_RECORD_STATUS_PROPAGATED.

qdenza.com: apex on Cloudflare, so CNAME flattening returns an A record 69.46.46.8, which is the address sixobch7.up.railway.app resolves to. The API reports currentValue "" for the apex.

The zone has no CAA records and DNSSEC is not enabled (no DS records).

Traffic does reach the Railway edge - port 80 answers with a 301 and the x-railway-67 header. HTTPS fails the TLS handshake because no certificate has been issued.

The workspace had a past-due invoice, which has since been paid and the past-due banner is gone, but the domains still have not validated.

Could you re-trigger ownership validation for both domains? I would prefer not to delete and re-add them, since that issues new CNAME and TXT values and the DNS is managed by a third party.