12 days ago
Custom domain certificates stuck in VALIDATING_OWNERSHIP — 4 attempts, 3 hostnames, DNS propagated
Project: e41b19a4-2207-4647-8c97-d9c89b9a4bb7 (service: munan-server / 253cd53d-14da-490d-a60a-a5dbc89b6204)
Since yesterday, every NEW custom domain we add gets stuck in CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP indefinitely, while dnsRecords report DNS_RECORD_STATUS_PROPAGATED:
- munan-app.14dimension.com — stuck 3+ hours (tried twice)
- munan.14dimension.com — stuck 1+ hour (current, domain id 0c9752c5-b079-416d-a46c-9a681dbc70d0), created after deleting the previous order and waiting 20+ minutes per community guidance
Checks done on our side: CNAME propagated on public resolvers, no CAA records on the zone, DNSSEC disabled, Cloudflare record is DNS-only (grey cloud). Existing older custom domains on the same zone (hyean/sokgi/jeongeo.14dimension.com etc., same account) work fine. A domain on a different zone (yeoun.io) provisioned within minutes earlier this week on this same account.
This looks like the certificate-issuance pipeline stalling (similar to incident 1QD5978Z). Could you clear the stuck ACME orders for these hostnames or advise?
4 Replies
12 days ago
The domain munan.14dimension.com is missing both required DNS records. Our system shows the CNAME status as "requires update" (not propagated), and the TXT verification record at _railway-verify.munan.14dimension.com does not exist. Both a CNAME pointing to qdvsx20s.up.railway.app and the TXT record with the verification token shown in the dashboard are required before Railway will verify ownership and issue a certificate. Additionally, traffic to the domain is currently being served by Cloudflare's proxy rather than reaching Railway directly, so please confirm the CNAME entry in Cloudflare is set to DNS-only (grey cloud) and that no conflicting A/AAAA records exist for that hostname. Once both records are in place and the proxy is off, you can reply here so we can re-check.
Status changed to Awaiting User Response Railway • 12 days ago
Railway
The domain `munan.14dimension.com` is missing both required DNS records. Our system shows the CNAME status as "requires update" (not propagated), and the TXT verification record at `_railway-verify.munan.14dimension.com` does not exist. Both a CNAME pointing to `qdvsx20s.up.railway.app` and the TXT record with the verification token shown in the dashboard are required before Railway will verify ownership and issue a certificate. Additionally, traffic to the domain is currently being served by Cloudflare's proxy rather than reaching Railway directly, so please confirm the CNAME entry in Cloudflare is set to DNS-only (grey cloud) and that no conflicting A/AAAA records exist for that hostname. Once both records are in place and the proxy is off, you can reply here so we can re-check.
7 days ago
CNAME is now DNS-only (grey cloud) and your API reports DNS_RECORD_STATUS_PROPAGATED. I also deleted and re-created the domain (new id ae9699f5-6bc4-42d6-8e93-8d220a802764) to start a fresh ACME order with correct DNS in place — it has been stuck in CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP as well. This confirms the issuance pipeline is stalled on your side. Please clear the stuck ACME orders for this hostname.
Status changed to Awaiting Railway Response Railway • 7 days ago
7 days ago
Re-checking now, munan.14dimension.com still resolves to Cloudflare proxy IPs (104.21.x, 172.67.x) rather than Railway's edge, and since this is a subdomain (not an apex), a DNS-only CNAME would appear directly in a public dig as a CNAME record pointing at Railway. The TXT record at _railway-verify.munan.14dimension.com is also still absent. Please double-check in your Cloudflare dashboard that the CNAME entry for munan is set to grey cloud and targets lvq1vvx9.up.railway.app, and that a TXT record exists for _railway-verify.munan with the token shown on the domain's settings page.
Status changed to Awaiting User Response Railway • 7 days ago
Status changed to Solved leegod • 7 days ago
7 days ago
Resolved — the TXT verification record was missing on our side. Adding it + recreating the domain (fresh ACME order with correct DNS) issued the certificate within a minute.
Status changed to Awaiting Railway Response Railway • 7 days ago
Status changed to Solved Railway • 7 days ago