FaunaDB custom domain: DNS resolution error before TLS handshake

Symptom

A client cannot establish a TLS connection to a FaunaDB instance accessed via a custom domain. The connection attempt terminates with a DNS resolution error (“Name or service not known”) before any TLS handshake occurs.

Goal

Determine whether the failure stems from an incorrect or missing DNS A record, an overly restrictive CAA record, or a certificate issuance problem that prevents the client from validating the server’s identity.

Constraints & Uncertainty

• FaunaDB requires the custom domain’s A record to point to Fauna’s edge nodes.
• Let’s Encrypt is used for the TLS certificate; the domain’s CAA record must explicitly allow letsencrypt.org.
• Client drivers perform strict certificate validation and cannot disable it.

Questions

1. Do the current A records for the custom domain resolve to Fauna’s edge node IPs?
2. Does the CAA record for the domain include letsencrypt.org as an allowed issuer?
3. Is the certificate chain presented by the custom domain correctly issued by Let’s Encrypt and trusted by the client’s trust store?