Amplify Custom Domain Stuck in AWAITING_APP_CNAME — SSL Certificate Verification Failing Despite Correct DNS

Based on your situation, here are the key points to address your stuck custom domain configuration:

Understanding the AWAITING_APP_CNAME Status: When a custom domain shows AWAITING_APP_CNAME status, it means AWS Amplify is waiting for DNS propagation and verification. The verified: false status indicates that Amplify hasn't yet confirmed the DNS records are properly configured, even though your dig queries show they're resolving correctly.

Common Causes and Solutions:

1. DNS Propagation Delays: Even though dig shows the records resolving, DNS propagation can take time globally. AWS performs verification from multiple locations, and some DNS servers may still be caching old values. This typically resolves within 24-48 hours, though it can sometimes take longer.

2. Certificate Validation Timing: The ACM certificate validation process is automatic but can experience delays. The certificate must be validated before the domain association can complete. Since you've recently recreated the domain association, the validation CNAME record is new and may still be propagating.

3. Multiple Recreation Attempts: Your multiple deletion and recreation attempts may have created a backlog in the validation queue. Each time you delete and recreate, a new certificate request is generated, and previous validation attempts may still be in progress.

Recommended Actions:

• Wait for Propagation: Allow 24-48 hours for full DNS propagation and certificate validation to complete after your most recent clean setup
• Avoid Further Changes: Don't delete and recreate the domain association again, as this resets the validation process
• Monitor Status: Use aws amplify get-domain-association to check status periodically rather than attempting updates
• Verify DNS at Source: Ensure your GoDaddy DNS records have no conflicting entries and that TTL values aren't set too high (recommended: 300-3600 seconds)

Important Considerations:

The certificate verification process is fully automated and cannot be manually triggered. AWS Amplify will continuously retry validation until it succeeds. The process checks both that the DNS records exist and that they resolve correctly from AWS's validation infrastructure.

If the issue persists beyond 48 hours with no status change, you may need to contact AWS Support directly with your App ID, as they can investigate internal validation logs and check for any infrastructure-level issues that might be preventing certificate issuance.

For production deployments, it's recommended to set up custom domains well in advance of launch dates to account for DNS propagation and validation timing.