A custom domain is stuck at pending

Two checks must pass before a certificate is requested: the hostname must
resolve to the platform, and an ownership TXT record must carry the right
token. pending means at least one has not passed.

Find out which before you change anything. The domain status reply names it, and
says what it actually saw.

The forgotten TXT record

This is the most common cause by a wide margin. People publish the CNAME, watch
the name start resolving, and wait for a certificate that will never be
requested.

_maestro-verify.<your hostname> must carry the exact token from the attach
reply. Resolution alone proves nothing — any stale record could point here.

A competing or extra record

The hostname must resolve to the serving address exclusively:

• A stray AAAA record will hold it at pending. The serving host is
  IPv4-only. Remove it — the status message calls this one out specifically.
• Extra A records alongside the pointing record are a failure too.
• A CDN in front of the name means the platform is not what answers, so the
  check fails even though the site appears to load.

An apex name with a CNAME

A CNAME at a zone apex is not valid DNS. An apex needs the A record to the
serving IP. Some providers offer ALIAS or ANAME to paper over this; the attach
reply's notes cover the provider-specific cases.

It is just DNS propagation

Caches take minutes, sometimes longer. Verify probes the zone's own nameservers
directly, so it usually sees a correct record before your laptop does — meaning
dig on your machine disagreeing with a verified status is normal and fine.

Failed rather than pending

Different problem. failed carries the certificate authority's own message.

The one worth naming: a CAA record on your zone that forbids Let's Encrypt.
The message says so verbatim. Add CAA 0 issue "letsencrypt.org" or remove the
CAA set, then retry.

Repeated failures back off exponentially and park at failed after eight
attempts, so fix the cause first — retrying a broken configuration only spends
attempts.

Was verified, now broken

Something changed at the DNS provider: a CDN was put in front, or the TXT was
tidied up. Serving continues on the current certificate, but renewals stop —
so fix the records before it expires rather than after.