GitHub Pages Custom Domain Stuck? Troubleshooting DNS and TLS Certificate Issues

Ever configured a custom domain for your GitHub Pages site, only to find it stuck on a perpetual “DNS Check in Progress” message, serving the wrong TLS certificate? This frustrating scenario is more common than you might think, as highlighted in a recent GitHub Community discussion.

The core issue, as discussed by users like qw12-34, often isn't incorrect DNS settings on the user's side. Instead, it's a provisioning stall within GitHub's backend, preventing the correct TLS certificate from being issued or assigned to your custom domain. Even when public DNS records for your apex domain (e.g., domderevyev.ru) and www CNAME are perfectly configured to point to GitHub's IPs, and no conflicting CAA records exist, the site might still present the generic *.github.io wildcard certificate, triggering browser warnings about insecure connections.

Diagnosing the Stuck DNS Check

Community experts like weuderr and shivanagendrakore quickly confirmed that the original poster's DNS was correctly configured. This is a crucial first step in any troubleshooting process, acting as a manual form of github monitoring tool to ensure external dependencies are met. Key checks include:

• A Records: Ensure your root domain points exactly to GitHub's four IP addresses (185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153) with no extra A/AAAA records or registrar parking IPs.
• CNAME Record: Verify your www subdomain correctly points to your .github.io address.
• CAA Records: Confirm no CAA records are blocking Let's Encrypt from issuing certificates.

Interestingly, sometimes a valid Let's Encrypt certificate for your custom domain might already exist (discoverable via services like crt.sh), but GitHub's edge network is still serving the default *.github.io one. This is a clear indicator of a provisioning hang-up.

Effective Solutions for Unsticking Your Custom Domain

When facing this issue, the community recommends a systematic approach to re-trigger GitHub's provisioning process, enhancing your engineering efficiency by resolving deployment bottlenecks:

1. Clear, Wait, and Re-add the Custom Domain

This is the most frequently successful method to unstuck the process:

1. In your repository's Settings → Pages, locate the "Custom domain" field.
2. Clear the custom domain and click Save.
3. Wait 5–10 minutes. This crucial waiting period allows GitHub's systems to clear the old state. Do not re-add immediately.
4. Re-add your custom domain (e.g., domderevyev.ru) and click Save again.
5. Leave the page open. The "DNS Check" should ideally go green within a few minutes. "Enforce HTTPS" will then become available, though certificate provisioning can take up to an hour or more after that.

2. Verify Your Domain Ownership

For added robustness and to prevent domain takeover, verify your domain for your account:

• Go to your profile Settings → Pages → Add a domain.
• Follow the instructions to add a TXT record (e.g., _github-pages-challenge-yourusername.yourdomain.com) at your domain registrar. This step can make the domain state more resilient and is a good practice for overall site security, contributing to better performance analytics software insights by ensuring foundational security.

3. Trigger a Fresh Build

If you're using legacy (branch) builds, clearing the domain in the UI might sometimes affect your repository's CNAME file. Ensure the CNAME file still contains your custom domain. If in doubt, push a small, insignificant commit to your repository to trigger a fresh build. This can sometimes kickstart the provisioning process.

4. When to Contact GitHub Support

If, after performing a clean remove → wait → re-add cycle and verifying your domain, the custom domain remains stuck on "DNS Check in Progress" or continues to serve the wrong TLS certificate for over 24 hours, it's likely a backend issue only GitHub can resolve. Open a ticket at https://support.github.com (Pages category). Be sure to mention your domain, the troubleshooting steps you've already taken, and any observations like a valid certificate already existing on crt.sh.

By following these steps, developers can effectively troubleshoot and resolve common GitHub Pages custom domain and TLS certificate issues, ensuring their sites are secure and accessible, and maintaining high levels of engineering efficiency in their deployment workflows.