GitHub Pages custom domain stuck on DNS Check in Progress and serving wrong TLS certificate

[qw12-34]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Pages

Body

Hello!

My GitHub Pages website uses the custom domain https://domderevyev.ru/.

Repository: https://github.com/qw12-34/domderevyev-site

In Settings → Pages, the custom domain has been stuck at “DNS Check in Progress” for a long time.

My DNS records at the domain registrar are configured as follows:

A records for the root domain:

• 185.199.108.153
• 185.199.109.153
• 185.199.110.153
• 185.199.111.153

CNAME record:

• www → qw12-34.github.io

The repository's CNAME file contains:
domderevyev.ru

However, HTTPS serves a Let's Encrypt certificate issued for *.github.io, which does not match domderevyev.ru. Yandex Browser warns visitors that the connection is not secure.

I have already removed and re-added the custom domain once, but the DNS check is still in progress.

Could you please advise how to get GitHub Pages to issue and attach the correct TLS certificate for my custom domain?

Thank you!

[weuderr]

I checked your domain from the outside. Your DNS is actually correct, so the problem is on the Pages side:

• domderevyev.ru A → exactly the 4 GitHub IPs, no extra A/AAAA records (registrar parking IPs are the usual culprit, and you don't have any)
• www CNAME → qw12-34.github.io ✔
• No CAA record, so nothing blocks Let's Encrypt ✔
• The Pages API shows cname: domderevyev.ru, status: built, https_enforced: false

The interesting part: crt.sh shows that GitHub already obtained a Let's Encrypt certificate for domderevyev.ru + www.domderevyev.ru on 2026-09-20 (valid until 2026-12-19). The edge is still serving the default *.github.io one, though. So the certificate was issued, but its assignment to your site got stuck. That's likely related to the remove/re-add, which restarts provisioning.

What usually unsticks it:

1. In Settings → Pages, clear the custom domain and Save. Wait ~5–10 minutes. Don't re-add it immediately, since the old state needs to clear.
2. Add domderevyev.ru again and Save. Leave the page open: the DNS check should go green within a few minutes, then "Enforce HTTPS" becomes available (it can take up to ~1h after that).
3. Make sure the CNAME file in the repo still contains domderevyev.ru afterwards. With legacy (branch) builds, clearing the domain in the UI can delete or modify it. Push a small commit to trigger a fresh build if needed.

Also recommended: verify the domain for your account (profile Settings → Pages → Add a domain). It gives you a TXT record _github-pages-challenge-qw12-34.domderevyev.ru to add at reg.ru. You currently don't have it. It prevents domain takeover and makes the domain state more robust.

If it's still stuck after a clean remove → wait → re-add cycle, it's a backend issue only GitHub can fix. Open a ticket at https://support.github.com (Pages category) and mention that crt.sh already shows a valid cert for your domain while the old *.github.io cert is still being served.

[shivanagendrakore]

I checked your live DNS and site just now — the good news is your configuration is already correct, so this is a provisioning stall on GitHub's side rather than a DNS mistake:

• dig A domderevyev.ru returns exactly the four GitHub Pages IPs (185.199.108.153, .109.153, .110.153, .111.153), with no AAAA or CAA records that could block issuance.
• www correctly points to qw12-34.github.io, and http://domderevyev.ru already serves your site from GitHub with HTTP 200.
• HTTPS still presents the *.github.io wildcard certificate, which confirms GitHub has not yet issued the certificate for your apex domain.

GitHub only queues the Let's Encrypt request after the automatic DNS check succeeds (see Securing your GitHub Pages site with HTTPS). When the check stays stuck even though public DNS is right, re-triggering it usually unsticks it:

1. In Settings → Pages, clear the custom domain field and Save, then re-enter domderevyev.ru and Save again. This starts a fresh DNS check; leave "Enforce HTTPS" off until the check passes.
2. Optionally verify the domain under your account's Pages settings (the _github-pages-challenge-* TXT record). A verified domain rules out ownership hiccups and protects against takeover.
3. Wait for propagation after the re-add — the check and certificate can take from a few minutes up to ~24 hours. Once GitHub shows the certificate as issued, tick "Enforce HTTPS".

If it is still stuck after 24 hours with the same correct DNS, that points to a stuck provisioning job and is worth a GitHub Support ticket quoting the domain and the checks above, since there is nothing left to fix at your registrar.