Trying to set up a custom domain in Auth0. Followed their docs, but it's been stuck on "pending" for over 48 hours. No clear error.
Is this normal? Support hasn't been helpful. What's the actual wait time? I'm on the free tier, so wondering if they deprioritize it.
48 hours on pending definitely feels excessive, even for the free tier. In my experience, it's usually 24 hours tops for the DNS changes to propagate and their system to verify. The lack of a clear error is the most frustrating part.
Have you double-checked the CNAME record values exactly? Even a stray period at the end of the domain in your DNS can cause this silent hang. Their support can be slow, but escalating with a screenshot of your exact DNS configuration sometimes gets a faster answer.
It's unlikely they deprioritize based on tier for a fundamental setup step like this. It's more often a tiny configuration mismatch that their status check doesn't flag properly. Hang in there.
Yeah, that silent hang on DNS mismatches is classic. Their validation is a black box, and it won't fail fast - it just waits forever for a record that'll never resolve correctly.
I've seen it trip on TTLs too. If you had a very long TTL set on an old record, it can extend that "pending" state way past 24 hours, even after you've updated it. Might be worth checking your DNS provider's cache.
Support escalation is the right call, but honestly, recreating the custom domain config from scratch has worked for me more than once when stuck like this.
48 hours on pending isn't normal, free tier or not. Their verification isn't that slow.
Forget the docs for a second. Strip it back to basics. You need two CNAME records. Not one, two. The most common silent hang is that folks create the verification record, see it resolve, and think they're done. They miss the second record for the actual CDN alias. Auth0's status won't tell you it's missing, it'll just spin.
Check your DNS for two distinct records, both pointing to the exact targets Auth0 gave you. If you only see one, that's your problem. Add the second, wait an hour, and it'll likely flip to active.
The second CNAME is the obvious culprit, but their system's failure to flag a missing record is the real problem. It's not user error if the interface hides critical state.
I've had this happen with Cloudflare, where their proxy can mask the missing record from Auth0's check. You can see both records resolve fine on your end, but their validator times out waiting for the CDN alias it can't reach. Disabling the proxy for an hour often forces it through.
Your vendor is not your friend.
The "two CNAMEs" thing is gospel now, but honestly, it just shifts the blame. If missing a record is *the* most common failure, why can't their validation step detect and surface that immediately? It's not rocket science.
Their whole process is designed to fail quietly, which is perfect for their support metrics but awful for the person trying to get auth working. I'd bet they quietly count on community threads like this to do their troubleshooting for them.
Trust but verify.
Free tier deprioritization is the convenient excuse they want you to believe. The reality is their validation process is just brittle. It'll fail the same way on an enterprise plan.
48 hours of silence isn't support being slow, it's the intended design. Saves them a ticket.
Your stack is too complicated.
That point about brittleness being the consistent factor across tiers rings true from my own troubleshooting logs. I've seen the same validation failure patterns on both free and paid tenant setups. The system's inability to produce meaningful error states suggests a fundamental design choice around reducing perceived failure rates, not a resource allocation issue.
What's more revealing is analyzing the telemetry they must be collecting. For a service that handles authentication, they have to monitor domain verification success rates, failure modes, and time to resolution. The fact that the "pending" state remains the primary user-facing status indicator, devoid of substatus or progression hints, implies they've prioritized simplicity of display over operational transparency. That's a trade-off that hurts users at all tiers equally.
I'd argue it's less about saving support tickets and more about avoiding the engineering cost of implementing a robust, self-diagnosing verification system. The silent hang is cheaper to build and maintain.