The apex domain countrymouse.art on this service has a valid

certificate and serves fine. Only the www subdomain is stuck on

VALIDATING_OWNERSHIP, now for more than 5 hours.

Project: countrymouse (3241828d-d72a-437c-a394-896300c7ef97)

Service: web (d5a46cee-f898-407a-953c-be01350b8bf9)

Domain: www.countrymouse.art

What I have already verified:

• Railway asks for a single CNAME (purpose TRAFFIC_ROUTE):

  www -> ad8jr1kc.up.railway.app

• The API reports currentValue == requiredValue and

  DNS_RECORD_STATUS_PROPAGATED, but certificateStatus has stayed

  CERTIFICATE_STATUS_TYPE_VALIDATING_OWNERSHIP throughout.

• The CNAME is confirmed at the authoritative nameservers

  (*.ns.porkbun.com) and at 8.8.8.8 and 1.1.1.1. It resolves to

  69.46.46.109.

• There are no CAA records on countrymouse.art, so Let's Encrypt is

  not being blocked from issuing.

• DNS is hosted on Porkbun's own nameservers. There is no Cloudflare

  proxy in front of this.

• http://www.countrymouse.art reaches Railway and is answered by the

  app, so routing works. Only TLS is missing.

• I removed and re-added the custom domain once. Railway issued a new

  CNAME target (zbvmf6vi -> ad8jr1kc) and I updated DNS to match, but

  the state did not change.

No build or deploy logs are attached because builds succeed; this is

only certificate issuance. Could you check whether issuance is stalled

or rate limited on your side?