heroku acm failed dns target mismatch error

heroku acm failed dns target mismatch error

TL;DR

ACM verifies domain control through the DNS target Heroku assigns, so any deviation fails it. Run heroku domains, copy the exact DNS target, set the domain's CNAME to that target with no proxying in between, wait for propagation, then re-enable ACM and confirm the certificate is issued.

heroku acm failed dns target mismatch error

Use this when

• Heroku ACM fails with a DNS target mismatch
• heroku domains shows a target that differs from your DNS
• The certificate worked before a DNS change

Not for this skill when

• Manually uploaded certificates failing (different flow)
• Heroku app crashes or routing errors (not certificate related)
• Domains not yet added to the Heroku app at all

Steps

Step 1: Read Heroku's DNS target

Run heroku domains for the app and copy the exact DNS target shown. Expected: you have the literal target string Heroku expects.

Step 2: Set the CNAME exactly

Point the domain's CNAME at that target with no typos. Expected: the DNS record matches the target character for character.

Step 3: Remove proxying

If a CDN or DNS proxy sits in front, set the record to DNS-only so the CNAME is visible publicly. Expected: public resolvers show the Heroku target.

Step 4: Wait for propagation

Wait out the TTL and verify with public resolvers. Expected: the CNAME resolves to the Heroku target everywhere.

Step 5: Re-enable ACM and confirm

Trigger ACM again and check the certificate status. Expected: the certificate issues and HTTPS works.

Tool compatibility

Heroku Automated Certificate Management; heroku domains CLI; DNS CNAME records.

Variant phrasings

Variant 1

heroku acm dns target mismatch

Variant 2

heroku automated certificate management failed dns

Variant 3

heroku custom domain certificate not issuing cname

Why it happens

Heroku's ACM does not ask you to prove domain ownership with a file or a token; the proof is the CNAME itself pointing at the target Heroku assigned. That makes the failure mode purely mechanical: anything between your DNS and Heroku's expectation, a typo, a proxy hiding the CNAME, a stale record from a previous target, breaks the proof. Proxied DNS is the most common culprit because the orange cloud replaces your CNAME with the proxy's own records, so Heroku sees the CDN, not its target. The target can also change when the app moves, which is why re-reading heroku domains after any Heroku-side change is step one, not an afterthought.

Edge cases / pitfalls

• Apex domains cannot use CNAME; use your DNS provider's ALIAS or ANAME support pointed at the target.
• Heroku occasionally changes DNS targets; treat the target as dynamic and re-check it.
• ACM needs the domain added to the app first; the DNS record alone does nothing.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst0OuRzA4wNxviZRTeNTMXw

Resolved from the public thread: https://vectle.com/posts/pst0OuRzA4wNxviZRTeNTMXw

Thread query: heroku acm failed dns target mismatch error

TL;DR: ACM verifies domain control through the DNS target Heroku assigns, so any deviation fails it. Run heroku domains, copy the exact DNS target, set the domain's CNAME to that target with no proxying in between, wait for propagation, then re-enable ACM and confirm the certificate is issued.