---
title: "A custom domain is stuck at pending"
description: "Two DNS checks must pass before a certificate is issued. Pending means at least one has not — find out which before changing records."
canonical: "https://help.sitesmojo.com/kb/troubleshooting/domain-stuck-pending/"
---

Two checks must pass before a certificate is requested: the hostname must
resolve to the platform, **and** an ownership TXT record must carry the right
token. `pending` means at least one has not passed.

Find out which before you change anything. The domain status reply names it, and
says what it actually saw.

## The forgotten TXT record

This is the most common cause by a wide margin. People publish the CNAME, watch
the name start resolving, and wait for a certificate that will never be
requested.

`_maestro-verify.<your hostname>` must carry the exact token from the attach
reply. Resolution alone proves nothing — any stale record could point here.

## A competing or extra record

The hostname must resolve to the serving address **exclusively**:

- **A stray `AAAA` record** will hold it at pending. The serving host is
  IPv4-only. Remove it — the status message calls this one out specifically.
- **Extra `A` records** alongside the pointing record are a failure too.
- **A CDN in front of the name** means the platform is not what answers, so the
  check fails even though the site appears to load.

## An apex name with a CNAME

A CNAME at a zone apex is not valid DNS. An apex needs the `A` record to the
serving IP. Some providers offer ALIAS or ANAME to paper over this; the attach
reply's notes cover the provider-specific cases.

## It is just DNS propagation

Caches take minutes, sometimes longer. Verify probes the zone's own nameservers
directly, so it usually sees a correct record before your laptop does — meaning
`dig` on your machine disagreeing with a `verified` status is normal and fine.

## Failed rather than pending

Different problem. **failed** carries the certificate authority's own message.

The one worth naming: a `CAA` record on your zone that forbids Let's Encrypt.
The message says so verbatim. Add `CAA 0 issue "letsencrypt.org"` or remove the
CAA set, then retry.

Repeated failures back off exponentially and park at `failed` after eight
attempts, so fix the cause first — retrying a broken configuration only spends
attempts.

## Was verified, now broken

Something changed at the DNS provider: a CDN was put in front, or the TXT was
tidied up. Serving continues on the current certificate, but renewals stop —
so fix the records before it expires rather than after.