Custom domain stuck on pending or showing a security warning on Webflow, Squarespace or Wix

The certificate follows the connection

Every one of the three builders issues the HTTPS certificate for your domain after it can see that the domain points at the builder. If the domain is not pointing correctly, or a restriction stops the certificate authority, the panel shows pending, error or records not found. That is a message about the connection, so the fix is in the DNS records, not in the certificate.

The records you need differ by builder and can change over time, so copy them from your builder's own domain panel rather than from an old article. Wix, for example, lists an A record on the root domain and a CNAME record on www for the pointing method, and says the domain must be connected to your site for the certificate to be enabled. Webflow says a custom domain that still points at its legacy DNS records can no longer be published to, so an older site may need its records changed to the ones shown in its Publishing settings. Squarespace shows each required record in its panel, with a status beside it.

• Open the domain panel and copy the records it lists.
• Open your DNS host and compare record by record: name, type and value.
• Write down which records are for email before you change anything.

Conflicts and leftovers

The most common blocker is a record that should have been replaced and was not. Webflow says extra A records on the root domain conflict with its own, as do duplicate CNAME records. Squarespace shows conflicting records in red and says to delete them, to delete an A record with a blank host, and to keep an A record on a Mail or Email host because it supports email. Typos in a verification record are common too, and some DNS editors append your domain to the value, which Squarespace fixes with a trailing period.

Take care of the other direction: a record that looks unused may carry email or another service. Compare before and after, and change one thing at a time.

• Remove only records the builder names as conflicting, with the owner's approval.
• Leave MX, SPF, DKIM and DMARC records as they are.
• Re-read the panel after each change rather than guessing.

Restrictions in front of the domain

Four things sit between your records and the certificate. A CAA record tells certificate authorities who may issue for your domain: Squarespace says its provider cannot issue if a restriction blocks it, and Webflow says a CAA record must allow both of the authorities it uses, Let's Encrypt and Google Trust Services. A proxy, such as Cloudflare's orange cloud, hides the real records: Wix says the A and CNAME records must be DNS only, and Webflow says a proxied record can cause a 525 handshake error, so it should be DNS only unless you set up Cloudflare's Orange-to-Orange option, which Webflow supports. Turning a proxy off can remove protection you chose, such as a firewall, so that is your decision. DNSSEC can interrupt propagation; Wix asks you to confirm it is not signed for a domain bought elsewhere, and Squarespace cannot guarantee third-party DNSSEC works. Custom nameservers can mean the records you edited are not the ones the domain uses, and Squarespace says to return to the provider's default nameservers if a nameserver connection fails.

None of these is a mistake to be embarrassed about. They are protections that were correct before the site was moved.

• Look for a CAA record on the domain and read who it allows.
• Look for an orange cloud beside the website records; on Webflow it must be off unless Orange-to-Orange is set up.
• Ask whether DNSSEC is switched on at the registrar.
• Confirm which nameservers the domain really uses.

How long to wait, what does not fit, and acceptance

Squarespace and Wix both say a new connection can take up to 48 hours, and Squarespace asks you to wait 48 hours after any change before testing in a private window. Refreshing repeatedly does not help; Squarespace says to wait 48 hours after your last refresh. If the records are correct and the status is still wrong after about two days, the builder's support is the next step.

A certificate that used to work and has expired, a move of DNS hosting, or mail records that need repair are different jobs. The fixed-scope fix of one domain is priced at £115 as an untested proposal and paid only after you sign off. It is accepted when the builder shows the domain connected, both the bare and www addresses open over HTTPS from two networks, and the mail and verification records are identical before and after.