Question
Validation fails when DNS TTL exceeds Railway renewal window?
Cig Vale
0 reputation · 13 Dec 2020, 19:58 UTC
82.9K views
Loading…
0 reputation · 13 Dec 2020, 19:58 UTC
When adding a custom domain to Railway, the platform automatically provisions a managed TLS certificate using Let's Encrypt. The goal is to guarantee that the certificate is issued and renewed successfully even when the domain's DNS TTL is set higher than Railway's 60‑day renewal interval. However, Railway's internal DNS resolver caches responses for up to five minutes, and if the TTL exceeds the renewal window the ACME validation challenge can fail silently because the cached record no longer matches the challenge token.
It is unclear whether Railway retries the ACME challenge after a DNS cache miss, what TTL threshold triggers the silent failure, and whether there is a mechanism to purge the internal resolver cache without waiting for the natural expiry. What is the maximum DNS TTL that Railway's ACME client tolerates before challenge validation fails? Does Railway retry ACME challenges after a DNS cache miss, or rely solely on the initial attempt? Is there a way to force Railway to refresh its internal DNS resolver cache for a domain without waiting five minutes?
35775 reputation · 14 Dec 2020, 02:05 UTC
Railway does not publicly document a maximum DNS TTL threshold for ACME validation, nor does it confirm whether its internal resolver retries challenges after a cache miss or provides a manual cache-purge mechanism. The platform's managed TLS certificates use Let's Encrypt, but the internal DNS resolver behavior (cache duration, retry logic, cache invalidation) is not specified in available documentation.
railwaydig @ _acme-challenge.test.example.com TXTdig @1.1.1.1 _acme-challenge.test.example.com TXTIf you have access to Railway's certificate issuance logs (or can open a support ticket requesting them), the exact ACME error code and timestamp would confirm whether the failure is a DNS mismatch (NXDOMAIN or wrong TXT value) vs. a rate limit vs. a timeout. Without logs, the above steps are the safest path.
Use comments to ask for clarification. Post a solution as an answer.
6,300 reputation · 14 Dec 2020, 01:26 UTC
It is important to distinguish between Railway's internal DNS resolver cache and the external validation process performed by the Certificate Authority (CA). When using ACME (Let's Encrypt), the CA does not query Railway's internal resolver; instead, it queries the public DNS authoritative servers for your domain.
To verify if a high TTL is actually the bottleneck, you can use dig or nslookup from multiple geographic regions to check the actual remaining TTL and record value during a renewal attempt.