Custom domain stuck on “Waiting on DNS propagation” for 48+ hours despite correct DNS

Support
1

’m having a TLS provisioning issue with a Netlify custom domain and I’m hoping someone can help identify what I’m missing.

Site: sondera-product-companion-production
Custom domain: companion.shopsondera.co

DNS is managed through Shopify. The record is:

companion.shopsondera.co CNAME sondera-product-companion-production.netlify.app

The domain has been stuck on “Waiting on DNS propagation” for more than 48 hours.

I’ve verified the following:

  • All four authoritative nameservers return the correct CNAME.

  • Google, Cloudflare, Quad9, and OpenDNS all resolve the hostname correctly.

  • There is no conflicting A or AAAA record.

  • There is no applicable CAA restriction.

  • DNSSEC is not enabled or broken.

  • HTTP reaches the correct Netlify site.

  • The default sondera-product-companion-production.netlify.app hostname has valid HTTPS.

  • The custom domain is attached only to the correct Netlify production site.

Netlify currently reports:

  • ssl=false

  • ssl_status=null

  • certificate: null

  • automatic TLS provisioning enabled

When I visit https://companion.shopsondera.co, strict TLS validation fails because Netlify is serving its fallback *.netlify.app certificate instead of a certificate containing companion.shopsondera.co.

I have already tried, once each:

  1. A manual certificate provisioning retry using Netlify’s normal TLS provisioning API.

  2. Removing the custom domain from the site and adding the exact same domain back while leaving DNS unchanged.

Neither action resulted in a certificate being issued.

No application has been deployed to this production site yet, so the normal Netlify 404 over HTTP is expected. I have not changed the CNAME, added A/AAAA records, uploaded a custom certificate, or modified DNS while troubleshooting.

At this point, DNS appears fully propagated and correct, but Netlify still has no custom-domain certificate.

Has anyone seen this exact state where DNS verification succeeds globally but Netlify’s ACME/certificate provisioning remains stuck? Is there anything else I can check from my side, or does this require Netlify to reset/requeue the certificate provisioning internally?