Let's Encrypt certificate never provisions on Netlify DNS — "doesn't appear to be served by Netlify"

Support
1

Site name: baurzhansukhankulov
Custom domain: bsukhoff.ru (registrar: RU-CENTER / nic.ru)
DNS: Netlify DNS

My domain is on Netlify DNS and resolves to Netlify from everywhere I can test, but the SSL panel has been stuck on “We could not provision a Let’s Encrypt certificate for your custom domain” for more than 13 hours. https://bsukhoff.ru still serves the default *.netlify.app certificate, so browsers show ERR_CERT_COMMON_NAME_INVALID.

What I have verified

1. Delegation at the .ru registry is complete and correct. Queried the authoritative parent directly:

dig NS bsukhoff.ru @a.dns.ripn.net
bsukhoff.ru. 345600 IN NS dns1.p09.nsone.net.
bsukhoff.ru. 345600 IN NS dns2.p09.nsone.net.
bsukhoff.ru. 345600 IN NS dns3.p09.nsone.net.
bsukhoff.ru. 345600 IN NS dns4.p09.nsone.net.

These match the four name servers shown on my Netlify DNS zone page exactly.

2. The zone holds 8 records, including NETLIFY records for both apex and www:

bsukhoff.ru       NETLIFY  baurzhansukhankulov.netlify.app
www.bsukhoff.ru   NETLIFY  baurzhansukhankulov.netlify.app
bsukhoff.ru       MX 5/10/20  mx02/mx01/mx03.nicmail.ru
bsukhoff.ru       TXT      v=spf1 include:dc1.nicmail.ru include:dc2.nicmail.ru ?all
bsukhoff.ru       TXT      _globalsign-domain-verification=...
mail.bsukhoff.ru  CNAME    mail.nic.ru

3. The domain resolves to Netlify from every public resolver I tested (Google, Cloudflare, Quad9, OpenDNS): 18.208.88.157, 98.84.224.111.

4. http://bsukhoff.ru returns HTTP 200 with the header server: Netlify and the correct page content.

5. The ACME challenge path is reachable (returns 404, not blocked or redirected).

6. There are no CAA records on the domain, so nothing restricts Let’s Encrypt.

What the UI shows

  • The domain status flips between “Netlify DNS” and “Netlify DNS propagating…” and never settles.
  • Clicking Verify DNS configuration returns: “DNS verification failed - bsukhoff.ru doesn’t appear to be served by Netlify”, which contradicts points 3 and 4.

What I already tried

  • Removed the custom domain from the project and added it back. On re-adding, Netlify itself said “Good news! bsukhoff.ru is already on Netlify DNS, so you can add your domain”, and both NETLIFY records were recreated. Certificate still not provisioned.
  • Triggered a fresh production deploy. No change.
  • Waited overnight (13+ hours) after delegation completed.

Ask

Could you check the internal state of this domain? From the outside everything looks correct, so the verification step seems to be stuck on your side rather than a DNS misconfiguration on mine.

2

Some additional diagnostics since posting.

Let’s Debug reports no issues for either hostname (http-01):

Certificate Transparency shows no Let’s Encrypt certificate has ever been issued for this domain. crt.sh returns exactly one record for bsukhoff.ru: a GlobalSign certificate for www.bsukhoff.ru issued 2026-08-04, which comes from the registrar’s own SSL product and is unrelated to Netlify. There are zero Let’s Encrypt entries.

Taken together, this suggests provisioning never reaches Let’s Encrypt at all. It appears to fail earlier, at Netlify’s own DNS verification step (“bsukhoff.ru doesn’t appear to be served by Netlify”), so no ACME order is ever created — which is consistent with Let’s Debug finding nothing wrong.

I also worked through the SSL troubleshooting guide point by point, and none of the listed causes apply:

  • No CAA records on the domain
  • No AAAA records on the apex
  • No conflicting A or CNAME records — the zone contains only the two NETLIFY records plus MX/TXT for email
  • DNSSEC is not enabled (no DS records at the parent)
  • Delegation is complete: all four p09 name servers are present at the .ru registry

Since the guide says provisioning retries every 10 minutes for the first 24 hours, this has been failing continuously rather than simply not having been attempted yet.

3

Resolved — closing the loop, and leaving notes in case someone finds this later.

The certificate provisioned on its own a few hours after my last post, with no further changes from my side. The SSL panel switched from “We could not provision a Let’s Encrypt certificate” to “DNS verification was successful”, and a Let’s Encrypt certificate for bsukhoff.ru and *.bsukhoff.ru was issued and installed.

https://bsukhoff.ru now serves correctly, www redirects to the apex, and HTTP redirects to HTTPS.

Two things that may help others:

1. The likely root cause was an incomplete delegation. My registrar assigns name servers through a form whose “add another name server” control silently did nothing on a normal click, so for a while only three of the four assigned p09.nsone.net name servers were actually set at the registry. DNS resolved perfectly with three, and every external check looked clean — which is exactly why this was hard to spot. Netlify’s verification, however, appears to expect all four, and it kept reporting “doesn’t appear to be served by Netlify” until the fourth was in place. If you see that message while everything else checks out, compare the delegation at your registry against all four name servers on your DNS zone page, not just whether the domain resolves.

2. A confusing error near the end. When I clicked “Provision certificate” at the moment things started working, the dialog returned certificate parameter is required when updating an existing certificate. That looked like another failure, but the certificate had in fact already been provisioned — reloading the SSL panel showed HTTPS enabled. So that error was cosmetic rather than fatal.

Thanks, and sorry for the noise.