The three affected domains are resolving to a hardcoded IP address instead of following the .up.railway.app CNAME target that Railway requires, and requests arriving that way are now refused with a 403 Forbidden. Your two working domains happen to resolve to a different address that is still accepted, but they are configured the same way and will need the same correction.

Since these are all root/apex domains, a plain CNAME record is not valid at the apex. You will need to replace the A records at NameSilo with a CNAME-flattened or ALIAS/ANAME record pointing at the .up.railway.app target shown for each domain in that service's Settings under Networking. If NameSilo does not support flattening at the apex, you can either use a www subdomain (which takes a normal CNAME) or move the zone to a DNS provider that does support it. This docs page covers which providers support apex CNAMEs and the setup steps.