Certificate stuck — "provisioning" blocks domain changes, but DNS verification fails

Support
1

Hi,

I’m using external DNS (IONOS) for my domain brinkmannpr.de and I’m stuck in what seems to be a deadlock.

Current setup at IONOS:

  • www → CNAME → brinkmannpr.netlify.app (in place and resolving)
  • No A record for the apex domain. IONOS does not allow an A record on @ alongside the www CNAME — it explicitly warns that adding the A record will delete the CNAME, so I cannot have both.
  • All mail records (MX, SPF, DKIM, DMARC) are untouched at IONOS and working.
  • Nameservers are still IONOS (I do not want to use Netlify DNS, because my email is managed there).

The problem:

brinkmannpr.de is still set as the primary domain, and DNS verification fails with:

brinkmannpr.de doesn’t appear to be served by Netlify

That’s expected, since the apex has no A record pointing to Netlify.

So I tried to set www.brinkmannpr.de as the primary domain instead. But that’s blocked with:

We’re provisioning a certificate for your site, you cannot change custom domains until that process completes

This has been showing for over 12 hours. The certificate provisioning never completes (it fails verification), but the site still considers it in progress, so I can’t change the primary domain to fix the underlying cause.

I also had a Netlify DNS zone for this domain in my team account, which I have now deleted, since I’m using external DNS.

What I’d like:

Could you reset the stuck certificate process so I can set www.brinkmannpr.de as the primary domain? After that, DNS verification should succeed against the existing CNAME.

Site name: brinkmannpr

Thanks a lot!

2

IONOS’s apex record limitation is a known pain, and the stuck provisioning usually clears once the DNS check passes. Since you can’t add the A record, a quicker path is to use Netlify’s DNS for brinkmannpr.de entirely—just move the nameservers over. While you wait for propagation, double-check your SPF record for that domain with an SPF checker, which I use often for catching syntax issues that can silently break email. That won’t fix the certificate, but it rules out a secondary blocker. For the stuck provisioning, try pausing and resuming the site in Netlify’s UI—it often retriggers the certificate issuance. If that fails, contact Netlify support directly; they can force a reset from their side.