Custom domain peaksel.az: InvalidDNSError although DNS is correct, TLS certificate stuck at 1 of 3<Your question or feedback about the GitHub Discussions product>

[pikseliok]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Pages

Body

This is about GitHub Pages custom domains (Settings > Pages).Repo: pikseliok/piksel.iokk (GitHub Pages, deploy from main branch, root)
Custom domain: peaksel.az

Problem: In Settings > Pages the custom domain check fails with "DNS check unsuccessful - Both peaksel.az and its alternate name are improperly configured. Domain's DNS record could not be retrieved (InvalidDNSError)". The TLS certificate stays at "1 of 3" for hours, and Enforce HTTPS stays disabled.

I removed and re-added the custom domain several times, with no change.

DNS is verified as correct via Google DNS (dns.google/resolve):

• NS: cheryl.ns.cloudflare.com and jaxson.ns.cloudflare.com
• A records for peaksel.az: 185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153
• www.peaksel.az: CNAME to pikseliok.github.io

All records are "DNS only" in Cloudflare (proxy off). There are no CAA records. The CNAME file in the repo contains peaksel.az. The site opens over http://peaksel.az and http://www.peaksel.az, but HTTPS is not available.

Could someone from GitHub reset the domain check or tell me what else could cause InvalidDNSError here? Thank you.

[sknoyon324234234234]

Good news: it looks like it's sorted now. I just checked from outside:

• https://peaksel.az loads (HTTP 200), and http:// redirects to https://
• your Pages settings now report the certificate as approved for both peaksel.az and www.peaksel.az (valid until 2027-01-12), with Enforce HTTPS turned on

Your DNS was right all along: the four A records, the www CNAME to pikseliok.github.io, no AAAA/CAA records, and no DNSSEC on the domain. The InvalidDNSError / "1 of 3" state usually just means GitHub's check ran before its resolvers saw the new records (Cloudflare nameserver changes can take a while to reach everyone). Removing and re-adding the domain restarts the check, so it can look stuck for a bit longer.

If you still see the old error in Settings → Pages, refresh the page. It should show the green DNS check now. If you ever turn on Cloudflare's orange-cloud proxy later, keep it off for these records, or the certificate renewal will fail.

[KasraK2K]

Root Cause Analysis & Solution

Great to see this is resolved! Let me provide some additional context on why the InvalidDNSError occurred and what others should know:

Why This Happened

The InvalidDNSError with "1 of 3" certificate provisioning is typically caused by DNS propagation delays, not actual misconfiguration. Here's what likely occurred:

1. Timing Issue: When you first added the custom domain to GitHub Pages, GitHub's DNS resolvers attempted validation before your Cloudflare DNS changes had fully propagated across all global nameservers (this can take 24-48 hours despite WHOIS showing updated NS records).
2. Certificate Provisioning State: The "1 of 3" indicates GitHub's Let's Encrypt integration had only validated one of the required domain checks (usually just the apex domain peaksel.az, but not www.peaksel.az or the reverse validation).

Why Re-adding Helped

Removing and re-adding the domain forces GitHub to restart its validation queue, which picks up the now-propagated DNS records on the retry attempt.

Your DNS Configuration Was Correct

Your setup was textbook perfect:

• ✅ Four A records pointing to GitHub Pages servers (185.199.108-111.153)
• • ✅ CNAME for www subdomain pointing to your GitHub Pages URL
• • ✅ CNAME file in repo pointing to apex domain
• • ✅ No Cloudflare proxy (critical for certificate renewal)
• • ✅ No CAA restrictions blocking Let's Encrypt

For Future Reference

If this happens again:

1. Wait 30-60 minutes before re-adding (DNS needs time to propagate)
2. 2. Never enable Cloudflare's orange cloud proxy on these records—it breaks HTTPS certificate renewal
3. 3. Keep DNS-only mode enabled
4. 4. If stuck beyond 2-3 hours, refresh your Settings → Pages several times (browser cache can lag)
      Thanks for following up with confirmation that it's working now! 🎉