GitHub Pages custom domain stuck on DNS Check in Progress and serving wrong TLS certificate

[qw12-34]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Pages

Body

Hello!

My GitHub Pages website uses the custom domain https://domderevyev.ru/.

Repository: https://github.com/qw12-34/domderevyev-site

In Settings → Pages, the custom domain has been stuck at “DNS Check in Progress” for a long time.

My DNS records at the domain registrar are configured as follows:

A records for the root domain:

• 185.199.108.153
• 185.199.109.153
• 185.199.110.153
• 185.199.111.153

CNAME record:

• www → qw12-34.github.io

The repository's CNAME file contains:
domderevyev.ru

However, HTTPS serves a Let's Encrypt certificate issued for *.github.io, which does not match domderevyev.ru. Yandex Browser warns visitors that the connection is not secure.

I have already removed and re-added the custom domain once, but the DNS check is still in progress.

Could you please advise how to get GitHub Pages to issue and attach the correct TLS certificate for my custom domain?

Thank you!

[weuderr]

I checked your domain from the outside. Your DNS is actually correct, so the problem is on the Pages side:

• domderevyev.ru A → exactly the 4 GitHub IPs, no extra A/AAAA records (registrar parking IPs are the usual culprit, and you don't have any)
• www CNAME → qw12-34.github.io ✔
• No CAA record, so nothing blocks Let's Encrypt ✔
• The Pages API shows cname: domderevyev.ru, status: built, https_enforced: false

The interesting part: crt.sh shows that GitHub already obtained a Let's Encrypt certificate for domderevyev.ru + www.domderevyev.ru on 2026-09-20 (valid until 2026-12-19). The edge is still serving the default *.github.io one, though. So the certificate was issued, but its assignment to your site got stuck. That's likely related to the remove/re-add, which restarts provisioning.

What usually unsticks it:

1. In Settings → Pages, clear the custom domain and Save. Wait ~5–10 minutes. Don't re-add it immediately, since the old state needs to clear.
2. Add domderevyev.ru again and Save. Leave the page open: the DNS check should go green within a few minutes, then "Enforce HTTPS" becomes available (it can take up to ~1h after that).
3. Make sure the CNAME file in the repo still contains domderevyev.ru afterwards. With legacy (branch) builds, clearing the domain in the UI can delete or modify it. Push a small commit to trigger a fresh build if needed.

Also recommended: verify the domain for your account (profile Settings → Pages → Add a domain). It gives you a TXT record _github-pages-challenge-qw12-34.domderevyev.ru to add at reg.ru. You currently don't have it. It prevents domain takeover and makes the domain state more robust.

If it's still stuck after a clean remove → wait → re-add cycle, it's a backend issue only GitHub can fix. Open a ticket at https://support.github.com (Pages category) and mention that crt.sh already shows a valid cert for your domain while the old *.github.io cert is still being served.