Sorry you hit this — it's a known sharp edge. What happened is that Let's Encrypt (not Railway) enforces the rate limits, so Railway support can't reset them (docs). Two different LE limits matter here:

Failed validations: 5 failed validation attempts per hostname per hour. This is what Railway's automatic retries burned through while your DNS was still propagating. It resets after 1 hour, not a week.

Duplicate certificates: 5 identical certs per week. This is the one with the ~7-day lockout, but it only applies if certs were actually issued — if your cert never issued, you're almost certainly hitting the hourly failed-validation limit, possibly repeatedly because the platform keeps retrying.

The way out:

Leave your DNS records exactly as they are — don't delete/re-add the domain repeatedly, that's what extends the lockout (docs warn about this specifically).

Confirm both the CNAME and the TXT verification record have fully propagated using dnschecker.org — both are required; a missing TXT record keeps validation failing.

Once DNS is verifiably propagated, wait a few hours for the rate-limit window to clear, then remove and re-add the domain once in the Railway dashboard to trigger a fresh issuance attempt. Issuance normally completes within an hour after that.

If it's still stuck after 72 hours with correct DNS, that's the threshold where the docs say to escalate to Railway support.

On your actual question — "why does it auto-retry before the domain has validated?" — that's fair feedback, and you're not the first to hit it. The retry loop doesn't currently check propagation before consuming attempts. Worth dropping that in the Feedback section so it gets in front of the team; the practical mitigation today is to add the DNS records first, confirm propagation, and only then add the domain in Railway.