Some providers don't fully support CNAME flattening (using CNAME records on root domain), so in this case, I'd suggest migrating to Cloudflare's DNS service.

https://developers.cloudflare.com/dns/zone-setups/full-setup/setup/

The CNAME → ALIAS conversion is happening because your DNS provider doesn't support CNAME flattening at the root/apex domain. This is actually a DNS standard limitation — you technically can't have a bare CNAME at the root (e.g. yourdomain.com), so some providers auto-convert it to ALIAS as a workaround, but Railway's verification doesn't accept that format.

Railway's docs explicitly list providers that don't support this: AWS Route 53, Azure DNS, Hostinger, GoDaddy, NameSilo, Hurricane Electric, and SquareSpace. If you're on one of these, the CNAME/ALIAS issue is expected.

The fix: point your nameservers to Cloudflare

You don't need to transfer your domain — just change the nameservers to Cloudflare's (free plan works fine). Once your domain is on Cloudflare:

1. Add a CNAME record with Name → @ and Target → the value Railway gave you (e.g. abc123.up.railway.app)
2. 2. Cloudflare handles the "flattening" transparently behind the scenes, so Railway sees a valid CNAME and accepts it
3. 3. Set Cloudflare proxy to on (orange cloud), then go to SSL/TLS → Overview and set it to Full (not Full Strict)

That's it — Railway will verify the domain and issue the SSL cert automatically within an hour or so.

If you're trying to add a subdomain instead of the root (e.g. app.yourdomain.com), a plain CNAME works on virtually any provider and you shouldn't have this issue. Let us know which case you're dealing with if the above doesn't apply.