Troubleshooting Custom Domains

Certificate not provisioning

Symptoms: Domain shows "Pending" status, no SSL certificate issued.

Common causes:

DNS not propagated — CNAME changes can take up to 48 hours to propagate. Use dig to verify:
```
dig CNAME api.myapp.com
```
Wrong CNAME target — Ensure the CNAME points to the exact endpoint shown in the dashboard.
CAA records blocking issuance — If you have CAA records, ensure letsencrypt.org is allowed:
```
myapp.com  CAA  0 issue "letsencrypt.org"
```

Domain shows "Error" status

Possible causes:

The CNAME record was removed or changed after initial verification
DNS provider is returning NXDOMAIN for the verification target
Let's Encrypt rate limits have been hit (unlikely for most users)

Resolution: Remove the domain, verify your DNS configuration, and re-add it.

Mixed content warnings

If your site loads over HTTPS but references HTTP resources, browsers will show mixed content warnings. Ensure all asset URLs use https:// or protocol-relative // URLs.

Apex domain not working

Apex domains (e.g., myapp.com without www) require ALIAS or CNAME flattening support from your DNS provider. Standard CNAME records cannot be used on apex domains per the DNS specification.

Supported providers: Cloudflare, AWS Route53, DNSimple, NS1.

Domain stuck in "Verifying"

If a domain is stuck in verifying status for more than 10 minutes:

Confirm the CNAME record is correct with dig
Try removing and re-adding the domain
Check that your DNS provider isn't proxying the record (e.g., Cloudflare orange cloud should be off for initial verification)