HTTPS certificate won't issue for ibaclinton.com, DNS check passes

[guarantee418]

🏷️ Discussion Type

Bug

Body

My GitHub Pages site won't get an HTTPS certificate, even though the DNS check passes.

Repository: guarantee418/ibaclinton-site (public)
Custom domain: ibaclinton.com
Publishing: GitHub Actions (custom workflow)

What Settings > Pages shows:

• Custom domain: ibaclinton.com, "DNS check successful"
• Enforce HTTPS: "Unavailable for your site because your domain is not properly configured to support HTTPS (ibaclinton.com)"
• For a while it said the certificate was being issued, then it went back to the message above.

DNS (GoDaddy nameservers ns17/ns18.domaincontrol.com since October 16, 2026; the domain was on Cloudflare before that):

• ibaclinton.com A: 185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153
• No AAAA, ALIAS or ANAME records on @, and no other A records
• www.ibaclinton.com CNAME: guarantee418.github.io
• No CAA records, no wildcard records, no _acme-challenge records
• DNSSEC is off at the registry (no DS record)
• The other records are for Microsoft 365 email only (MX, SPF and verification TXT, DMARC, DKIM and autodiscover CNAMEs)

What I've already tried:

• Removed the custom domain and added it again (the DNS check passed again, but HTTPS is still unavailable)
• Waited several hours

Support ticket 4868855 was closed and pointed me here.

Could someone from GitHub please check the certificate status for ibaclinton.com and www.ibaclinton.com and reset or re-trigger it? Thank you!

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[DYNOSuprovo]

The Root Cause

The reason GitHub Pages cannot issue the HTTPS certificate is that the domain is still delegated to Cloudflare at the .com TLD registry level, so your GoDaddy DNS records are completely bypassed by global resolvers and Let's Encrypt.

Querying the authoritative .com registry root nameservers (a.gtld-servers.net / Verisign) and Google public DNS (8.8.8.8) directly confirms:

$ nslookup -type=ns ibaclinton.com a.gtld-servers.net
Server: a.gtld-servers.net
ibaclinton.com nameserver = paul.ns.cloudflare.com
ibaclinton.com nameserver = alexa.ns.cloudflare.com

$ nslookup ibaclinton.com 8.8.8.8
Address: 104.21.34.96
Address: 172.67.158.224
Address: 2606:4700:3033::6815:2260

Why This Breaks GitHub Pages HTTPS

1. Ignored GoDaddy Zone: You configured the GitHub Pages 185.199.xxx.xxx A records inside GoDaddy's DNS manager, but because the registrar's nameserver delegation was never updated to GoDaddy, nobody on the internet is querying GoDaddy's nameservers (ns17/ns18.domaincontrol.com).
2. Cloudflare Proxy Interception: All incoming traffic is routed to Cloudflare's edge proxy IPs (104.21.34.96 / 172.67.158.224).
3. Let's Encrypt ACME Challenge Failure: When GitHub attempts to provision your certificate, Let's Encrypt follows the TLD delegation to Cloudflare and queries http://ibaclinton.com/.well-known/acme-challenge/.... Cloudflare intercepts this request and terminates it, preventing GitHub Pages from proving domain ownership. Consequently, GitHub Pages reverts to:

   "Unavailable for your site because your domain is not properly configured to support HTTPS (ibaclinton.com)"

---

How to Fix

You have two clean solutions depending on which DNS provider you prefer to use:

Option A: Complete the switch to GoDaddy Nameservers

If you intended to move fully to GoDaddy:

1. Log into your domain registrar account (where you registered ibaclinton.com).
2. Go to Domain Settings → Nameservers (Delegation).
3. Switch from Custom Nameservers (alexa/paul.ns.cloudflare.com) to GoDaddy Standard Nameservers (ns17.domaincontrol.com and ns18.domaincontrol.com).
4. Wait 15–30 minutes for the .com registry delegation to propagate.

Option B: Keep Cloudflare DNS (Set to "DNS Only" / Grey Cloud)

If you prefer keeping Cloudflare's fast DNS:

1. Log into your Cloudflare Dashboard and select ibaclinton.com.
2. Go to DNS → Records.
3. Add the four GitHub Pages A records for @:
   • 185.199.108.153
   • 185.199.109.153
   • 185.199.110.153
   • 185.199.111.153
4. Set the Proxy status to DNS only (Grey Cloud), NOT Proxied (Orange Cloud). GitHub Pages requires direct IP routing for ACME validation.
5. Set www as a CNAME to guarantee418.github.io with DNS only (Grey Cloud).

---

Re-triggering the Certificate on GitHub Pages

Once nslookup ibaclinton.com 8.8.8.8 returns the 185.199.xxx.xxx IPs directly:

1. In your repository on GitHub, go to Settings → Pages.
2. Clear the Custom domain field and click Save.
3. Re-enter ibaclinton.com and click Save.
4. GitHub Pages will initiate a fresh ACME challenge. The certificate will issue within 5–15 minutes, and the Enforce HTTPS checkbox will become available.

---

If this diagnosis pinpointed the nameserver delegation issue and gets your HTTPS certificate issued, please consider marking this response as the accepted answer! 🚀