22 days ago
Subject: Custom domain stuck in VALIDATING_OWNERSHIP for 3+ days, edge returns 404 even after certificate previously reached VALID
Project: odonax (project id 03f7698b-61fe-406f-8395-df086a5161bf)
Service: odonax, environment: production
Custom domain: api.odonax.com (custom domain id 5d87ecc7-d557-4dcf-b513-e4f615185773)
Target: kbglugpv.up.railway.app
Issue:
The custom domain's certificateStatus has been stuck at
CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP for more than 3 days (since
2026-07-27). During this whole time, requests to https://api.odonax.com
get a "404 Application not found" from the edge.
What I've already ruled out on my side:
-
DNS is correct and propagated: querying the domain's own status via the
GraphQL API shows dnsRecords.status = DNS_RECORD_STATUS_PROPAGATED, with
currentValue exactly matching requiredValue (kbglugpv.up.railway.app).
-
No CAA records on odonax.com that would block certificate issuance.
-
The CNAME target (kbglugpv.up.railway.app) resolves fine and port 80
reaches Railway's edge.
-
The account is on the Hobby plan, active, not in trial — which per your
docs includes custom domains.
-
I manually triggered customDomainIssueCertificate twice with no effect.
History that suggests this is two separate broken pieces (cert issuance
and edge routing), not one:
-
An earlier custom domain for this same hostname (created with an
explicit targetPort: 3001) DID reach CERTIFICATE_STATUS_TYPE_VALID, but
the edge still returned 404 for the hostname even with a valid cert.
-
After deleting that domain and recreating it (this time letting
targetPort auto-detect, per your own recommendation), Railway assigned
a different CNAME target, and since then the certificate hasn't even
reached VALID — it's stuck at VALIDATING_OWNERSHIP, seemingly worse than
before.
Could someone look into why (a) certificate validation isn't completing
despite DNS being correctly propagated, and (b) why the edge didn't route
the hostname even during the window when the certificate was VALID?
Happy to provide any additional logs/IDs needed.
1 Replies
Status changed to Awaiting Railway Response Railway • 22 days ago
21 days ago
Your CNAME is correctly propagated, but the TXT ownership-verification record is missing. Custom domains require both a CNAME record and a TXT record to verify ownership. Without the TXT, the domain stays unverified, the certificate cannot issue, and the edge returns 404. At your DNS provider, add a TXT record with host _railway-verify.api and the verification value shown in your domain's settings in the Railway dashboard. Once the TXT propagates, verification and certificate issuance will proceed automatically.
Status changed to Awaiting User Response Railway • 21 days ago
14 days ago
This thread has been marked as solved automatically due to a lack of recent activity. Please re-open this thread or create a new one if you require further assistance. Thank you!
Status changed to Solved Railway • 14 days ago