Lovable custom domain not working: stuck on 'Verifying' or SSL certificate error

Lovable Easy 15 minutes of changes, up to 72 hours of DNS waiting Last verified Jul 17, 2026

The fix Check three things: the TXT record at host _lovable with the lovable_verify= value, an A or CNAME record pointing directly at Lovable's target, and, on Cloudflare, the orange-cloud proxy switched to 'DNS only'. Proxying breaks both verification and certificate issuance. Then wait: SSL can take 15 to 30 minutes after verification, and DNS can take up to 72 hours.

Symptoms

The domain sits in a pending or 'Verifying' state for hours or days after you add the DNS records
The site loads but the browser shows an SSL warning or certificate mismatch
You are on Cloudflare (heavily overrepresented in these reports)
Either the apex or the www variant works while the other serves a mismatched certificate

Why it happens

The _lovable TXT verification record is wrong

The TXT record with the value starting lovable_verify= is missing, sits on the wrong host, or has been altered, so Lovable's ownership check never passes.

The A/CNAME record is proxied

Cloudflare's orange-cloud proxy (or any CDN in front) hides Lovable's IP. Verification never completes and Lovable cannot provision the Let's Encrypt certificate.

Normal DNS propagation and certificate delay

SSL can take 15 to 30 minutes after verification, and DNS propagation can take up to 72 hours. Some 'stuck' domains are just early.

How to fix it

Recheck every record against Lovable's domain settings screenYou need an A record (or a CNAME for www) pointing directly at Lovable's target, plus a TXT record at host _lovable with the lovable_verify= value. Match the values exactly; an altered or retyped record fails silently.
On Cloudflare, set the records to 'DNS only'Click the orange cloud on the A and CNAME records for the domain and switch them to the grey cloud ('DNS only'). Lovable must terminate SSL itself; a proxy in front breaks both verification and certificate issuance.
Verify what the world actually seesUse a checker like dnschecker.org (or dig) to confirm the A record resolves to Lovable's IP and the TXT record is publicly visible. If the checker cannot see the records, Lovable cannot either.
Wait out propagation without touching the recordsMost records go live within a couple of hours; the worst case is 72 hours. Edits restart the process, so resist the urge to churn the records while you wait.
Cover both apex and wwwAdd the www CNAME and the redirect so neither variant of the domain serves a mismatched certificate.
Escalate to Lovable support after 72 hoursIf the domain is verified and live but SSL is still invalid after 72 hours, contact Lovable support. Certificate provisioning happens on their side.

How to prevent it

Set Cloudflare records to 'DNS only' before adding the domain in Lovable, not after verification fails
Copy record values from Lovable's domain settings screen exactly instead of retyping them
Add both the apex and www records from the start so both variants get a valid certificate
Give DNS a real propagation window before changing anything; every edit restarts the clock

Tools that actually fix this

Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.

SentryFree Developer tier, no card

The default error tracker for JS and Python. It catches the unhandled exceptions and swallowed promise rejections AI-generated code ships with, and gives you the stack trace instead of a mystery.

Try Sentry →

Better Stackfree tier

Uptime, heartbeat, and log monitoring built for indie devs. Heartbeats catch the dead background job your app never noticed, and log alerts surface the errors it never handled. Real free tier.

Try Better Stack →

Frequently asked questions

Why is my Lovable custom domain stuck on Verifying?

A Lovable custom domain gets stuck on Verifying for one of three reasons: the _lovable TXT record with the lovable_verify= value is missing, on the wrong host, or altered; the A/CNAME record is behind Cloudflare's orange-cloud proxy so Lovable cannot see its own IP; or DNS simply has not propagated yet, which can take up to 72 hours.

Do I need to disable the Cloudflare proxy for a Lovable domain?

Yes. Set the A and CNAME records for your Lovable domain to 'DNS only' (the grey cloud) in Cloudflare. Lovable must terminate SSL itself, and the orange-cloud proxy blocks both domain verification and Let's Encrypt certificate issuance.

How long does Lovable take to issue an SSL certificate?

SSL provisioning for a Lovable custom domain typically takes 15 to 30 minutes after the domain verifies, while DNS propagation itself can take up to 72 hours. If the domain is verified and live but the certificate is still invalid after 72 hours, contact Lovable support, since certificate provisioning happens on their side.

What is the _lovable TXT record for?

The _lovable TXT record is Lovable's domain ownership check: a TXT record at host _lovable whose value starts with lovable_verify=. If that record is missing, on the wrong host, or altered, the domain stays in the Verifying state indefinitely.

Sources

The Vibe Oops briefing

One email when something ships to production that should not have. New incidents, new error guides, no filler.