Custom domain certificates stuck in "Validating ownership" / "Waiting for DNS update"

Project: Siyasett-v2 · Service: siyasett · Environment: production (Hobby plan)

Two custom domains have been stuck for 1.5+ hours and won't issue SSL certs:

api.siyasett.com — CNAME → noaixlma.up.railway.app. Railway's dashboard confirms the DNS record matches (currentValue == requiredValue, status PROPAGATED), but the cert stays in VALIDATING_OWNERSHIP and the edge serves the default *.up.railway.app cert.

siyasett.com (root/apex) — set as an ALIAS record → t22ocuip.up.railway.app at Namecheap (which doesn't allow a CNAME at the apex). Railway reports "Waiting for DNS update" with an empty currentValue, so the apex never validates.

Verified on my side: no CAA records, HTTP/80 + 443 reach Railway's edge, the service is healthy and siyasett-production.up.railway.app serves with valid SSL, and there's no incident on your status page. I already tried removing and re-adding both domains (which changed the targets and required a DNS update) — no change.

Could you (1) force re-issuance for api.siyasett.com, and (2) advise the correct way to validate a root/apex domain when the registrar only supports ALIAS/CNAME-flattening (not a literal CNAME)? Thank you.