Apex domain TLS handshake_failure — "doesn't appear to be served by Netlify" despite working www subdomain

Site: ephemeral-gnome-889af0 (builderlogix.com)

The apex domain (builderlogix.com) fails the TLS handshake outright — ERR_SSL_VERSION_OR_CIPHER_MISMATCH in browser, “sslv3 alert handshake failure” via curl/openssl — while www.builderlogix.com on the same IP (75.2.60.5) serves correctly with a server: Netlify header and a 301 redirect.

The SSL/TLS panel shows: “builderlogix.com doesn’t appear to be served by Netlify. We can’t renew your Let’s Encrypt certificate automatically until the issue is resolved.” Cert was last updated Jun 11 and hasn’t changed since.

DNS is confirmed correct: apex A record → 75.2.60.5, www CNAME → ephemeral-gnome-889af0.netlify.app (verified via dns.google, NS = Hostinger’s dns-parking.com).

Already tried:

  • Clicking “Renew certificate” (twice, no change)
    • Removing and re-adding builderlogix.com as a custom domain entirely (no change — identical handshake_failure and identical “Updated: Jun 11” timestamp afterward)
  • This looks like an edge-side SNI/routing-table issue specific to the apex hostname rather than anything fixable from the dashboard. Could someone take a look at the cert/routing attachment for this domain?