Log inStart free

Custom domain stuck verifying

A SupaHost custom domain stuck on "Waiting for DNS", "Issuing certificate" or "Needs attention". What each state means and how to fix the DNS record.

What you see

On Dashboard → your project → Domains your domain shows one of these badges and doesn't move on:

Badge State Meaning
Waiting for DNS pending We can't see a record pointing at your project yet
Issuing certificate verified DNS is right; the HTTPS certificate is being issued
Needs attention error DNS looked right, but no certificate after 30 minutes
Active + HTTPS active Working

Under the domain there's a message such as:

No DNS record found yet. Add a CNAME from api.bookings.example to app-one.acme.supahost.space.

api.bookings.example points to old-host.example.net. Change the CNAME to app-one.acme.supahost.space.

We couldn’t issue a certificate. Check that the record points at your project and isn’t proxied, then check DNS again.

Why it happens

SupaHost checks your DNS about once a minute through a public resolver (Google's DNS over HTTPS). The domain passes when it has:

  • a CNAME to your project host (<project>.<instance>.supahost.space), or
  • A records that all equal your instance's IP address.

Once DNS passes, the certificate is issued automatically with Let's Encrypt, which needs to reach your instance directly. The domain becomes active when HTTPS answers. Things that block this:

  • The record is missing, has a typo, or was added to the wrong zone.
  • An old record (an A record, another CNAME) still exists for the same name.
  • DNS hasn't propagated yet, or an old record is still cached because of a long TTL.
  • The record is proxied (Cloudflare's orange cloud), so it resolves to the proxy's IPs.
  • It's a root domain (example.com) and your provider doesn't support a CNAME there.
  • A CAA record on your domain doesn't allow Let's Encrypt.

How to fix it

  1. Copy the exact target from the Domains tab (the CNAME target button). Add a record at your DNS provider:

    Type Name Target
    CNAME api app-one.acme.supahost.space

    For a root domain, use an ALIAS or ANAME record, or CNAME flattening.

  2. Remove any other A, AAAA or CNAME record for the same name.

  3. Check what the world sees:

    dig +short api.bookings.example CNAME
dig +short api.bookings.example A

    The CNAME answer should be your project host. If you used A records, every address must be your instance's IP.

  4. On Cloudflare, set the record to DNS only (grey cloud). See Custom domain behind Cloudflare proxy.

  5. If you have CAA records, add one that allows letsencrypt.org.

  6. Click Check DNS on the domain's row. That runs the check straight away instead of waiting for the next pass. It works for domains in the Waiting for DNS and Needs attention states.

On SupaHost

  • Automatic checks stop 14 days after you add a domain. After that, click Check DNS, or remove the domain and add it again.
  • A hostname can belong to only one SupaHost project. Hostnames under supahost.space and supahost.app aren't accepted.
  • Your SupaHost address keeps working the whole time, so nothing breaks while you fix DNS.
  • When the domain goes active, it's used for Auth emails and OAuth callbacks. Update your OAuth providers before switching your app: see OAuth broke after adding a custom domain.
  • Domains per plan: Builder 1, Pro 3, Business 10. Extra domain slots are $2/mo each.

Updated 11 November 2026 · View as Markdown · Something wrong or missing? Tell us