ACM certificate DNS validation not completing with Route 53

I’m stuck with an ACM certificate validation issue and could use a second set of eyes.

I have a custom domain with DNS hosted in Route 53 for a long time. The NS records are correct and unchanged.

I’m using DNS validation. For each certificate request, I created the validation CNAME records directly from the ACM console using Create records in Route 53. After creation, the CNAMEs resolve immediately with dig, so DNS propagation doesn’t appear to be the problem.

What’s happening:

• 2 certificate requests failed after ~72 hours
• Several other requests stayed in Pending validation for 48+ hours and were deleted
• Thecurrent request has been Pending validation for over 24 hours

What I’ve tried:

• Manually deleting and recreating the validation CNAME records
• Different SAN combinations: - apex domain + wildcard - apex domain + www
• Verifying there are no duplicate or conflicting CNAME/TXT records
• I’ve confirmed there are no CAA records restricting certificate issuance
• Domain delegation is correct and stable (Route 53 nameservers in use for a long time, not a recent transfer)
• No NS/CNAME conflicts on the same DNS labels
• Validation CNAMEs exist and resolve publicly for each SAN (apex + wildcard / apex + www tested)
• Previous timed-out requests were deleted; only one active certificate request exists now
• Certificate is requested in us-east-1, the correct region for CloudFront

Right now there is only one active certificate request and the validation CNAMEs look correct and resolve publicly, but ACM still doesn’t validate the certificate. Is there anything non-obvious that can block ACM DNS validation in this situation? Any guidance would be appreciated.