AWS Amplify Custom Domain Stuck on "Verifying Domain Ownership" / CloudFront 403 Despite Correct DNS

To correct a technical inaccuracy in the re:Post Agent’s response and address the actual root cause:

1. Incorrect ACM Region

The automated response suggests checking the ACM console in ap-south-1. This is incorrect. Because AWS Amplify relies on Amazon CloudFront, the required SSL certificate is strictly provisioned in the us-east-1 (N. Virginia) region, regardless of your Amplify app's location. Checking ap-south-1 will not show the relevant certificate.

2. Missing CAA Records (The usual blocker)

The most common reason for a domain stuck indefinitely at "Verifying domain ownership" is a restrictive CAA record at your DNS registrar (Namecheap). If your domain uses CAA records, you must explicitly authorize amazon.com, otherwise AWS Certificate Manager is blocked from issuing the certificate, causing the verification to hang silently.

Official AWS Documentation Evidence:

• CloudFront ACM Region Requirement: https://docs.aws.amazon.com/acm/latest/userguide/acm-regions.html
• CAA Record Requirements for ACM: https://docs.aws.amazon.com/acm/latest/userguide/setup-caa.html

When AWS Amplify gets stuck on 'Verifying domain ownership' despite correct DNS configuration, there are several potential causes and troubleshooting steps to consider.

First, DNS propagation can take time. While you've waited several hours, full global DNS propagation can sometimes take up to 48 hours. You can verify your DNS records are resolving correctly using tools like dig or nslookup to confirm the CNAME records for ACM validation are returning the expected values.

The CloudFront 403 error you're seeing typically indicates that CloudFront is receiving the request but cannot serve content. This often happens when the domain verification hasn't completed, as CloudFront doesn't yet have the proper origin configuration or SSL certificate attached.

For the verification process itself, ensure that:

• Your DNS records exactly match what Amplify provided, including any trailing dots or specific formatting
• There are no conflicting DNS records (like multiple CNAME records for the same subdomain)
• Your DNS provider has fully propagated the changes

Regarding ACM certificate validation, the certificate must be validated before the domain can become active. You can check the ACM certificate status in the AWS Certificate Manager console in the same region as your Amplify app (ap-south-1). Look for the certificate associated with your domain and verify its validation status.

If the issue persists after 48 hours with confirmed correct DNS records, there may be an internal issue with the domain association. In such cases, you can try:

• Removing the custom domain from Amplify completely
• Waiting a few minutes
• Re-adding the custom domain with fresh DNS records

If you continue experiencing issues after these steps, I recommend opening a support case through the AWS Support Center at https://console.aws.amazon.com/support/ where AWS Support engineers can investigate your specific Amplify app configuration, check for any internal issues with the domain association, and review CloudFront and ACM logs that aren't visible in the console.