Both domains are unverified because the required TXT ownership-verification records are missing or incorrect at your DNS provider, which is why certificates won't issue. For the first domain, the CNAME target is also stale from a previous addition and needs updating to match the new target shown in your service's Settings. For both, add a TXT record at the _railway-verify hostname shown in the dashboard with the exact verification token value displayed there. Custom domains require both the CNAME and the TXT record to verify and issue a certificate, as covered in our docs.