Realtime API: DNS resolution timeout before TLS handshake

Problem Overview

When a custom domain is configured for Appwrite’s Realtime service, the client first performs a DNS lookup, then establishes a TLS handshake. A timeout before the handshake indicates a potential DNS or certificate issue.

Goal & Constraints

The objective is to determine whether the failure originates from DNS propagation (missing A record or restricted CAA), from the TLS certificate chain (self‑signed, expired, or untrusted), or from the client’s trust store. The investigation must be performed without altering Appwrite’s internal settings, relying only on publicly available DNS and TLS tools.

Uncertainty

It is unclear whether the custom domain resolves to Appwrite’s infrastructure, whether the certificate authority is permitted by the domain’s CAA record, and whether the client environment accepts the presented certificate chain.

Specific Questions

• Does the custom domain’s A record point to the correct Appwrite IP address, and is the response consistent across multiple DNS resolvers?
• Are the domain’s CAA records configured to allow the certificate authority that issued the TLS certificate?
• Is the TLS certificate chain presented by the Realtime endpoint trusted by the client’s operating system or application trust store?