Firebase Hosting Custom Domain Stuck on "Needs Setup"? 6 Fixes for DNS and SSL (2026)
Why does my Firebase Hosting custom domain say "Needs setup"?
In most cases because your DNS A records haven't reached Firebase yet, or they point somewhere other than Firebase Hosting. Firebase's own status table says exactly that, and adds that if it's been more than 24 hours you should check where your records point. Less often, an SSL challenge in the Advanced Setup flow has failed and its token is no longer valid. This guide turns those causes into six checks you can run in order, and was checked against the Firebase Hosting custom domain documentation (last updated 2026-11-12) on 2026-11-13.
GSPTeck is giosaia's indie studio building mobile and web apps with Flutter and Firebase. Our own sites, including gspteck.com, autox.network and coinx.gspteck.com, are served from Firebase Hosting on custom domains, so the DNS answers quoted below are real lookups we ran on 2026-11-13.
What do the Firebase custom domain statuses mean?
There are four, and only "Connected" means your site is live with its own certificate. The meanings below come from the "Setup status descriptions" table in Firebase's guide to connecting a custom domain.
| Status | What Firebase says it means | What to do |
|---|---|---|
| Needs setup | Usually your A records haven't propagated to Firebase; rarely a failed SSL challenge token | Check DNS (fixes 1 to 4); for Advanced Setup, click View and provide the new token |
| Pending | DNS is correct, but no SSL certificate yet | Check CAA records, the challenge token and the subdomain count (fixes 5 and 6) |
| Minting Certificate | The certificate is being produced | Wait |
| Connected | Proper DNS records and a certificate | Nothing; your content is served |
The 6-step Firebase domain check, in order
Run these in sequence; each one rules out a cause before the next. In the developer reports we reviewed for this guide, the fix was usually a stray record (step 2) or a proxy (step 3).
- Look up what the internet actually sees. Query your domain's A records with an outside resolver, not your own computer's cache.
- Delete records that point elsewhere. Remove old A, AAAA and CNAME records for the same host.
- Turn off any proxy on the record. Set Cloudflare-style proxied records to DNS only while Firebase verifies.
- Keep the TXT ownership record in place. Don't remove it after the domain connects.
- Allow Firebase's certificate authorities in CAA. letsencrypt.org and pki.goog must be permitted.
- Wait out the 24-hour window, then re-issue the token if needed. And stay under 20 subdomains per apex domain.
Step 1: how do I check my DNS records from outside?
Use a public lookup tool such as the Google Admin Toolbox Dig service, which Firebase's guide recommends, or dig +short example.com A in a terminal. The answer should be exactly the IP addresses the Firebase console gave you, and nothing else.
For reference, here is what our own domains returned on 2026-11-13 through Google Public DNS: gspteck.com, autox.network, pilotaseo.com and swappr.website each answered with the single A record 199.36.158.100, which is also the value Firebase's provider table shows for its Cloudflare example. Your console may give you different values, and the console is what counts. Firebase's guide also warns that even when records look right, propagation and certificate provisioning can take more time.
Step 2: which old DNS records stop Firebase from connecting?
Any A, AAAA or CNAME record for the same host that points to another provider. Firebase's Quick Setup instructions are blunt: "If any of these record types exist, Firebase cannot provision an SSL certificate." Registrars often add these by default, for example a parking page A record, an AAAA record you never noticed, or a "www" CNAME to the registrar's site builder.
Developers on Stack Overflow have reported two less obvious versions: a registrar "main IP" field outside the normal record list that silently creates an A record, and a URL redirect record left over from a previous site. If your lookup in step 1 shows an IP you didn't enter, look for settings like these.
Step 3: does Cloudflare's proxy break Firebase verification?
It can, because a proxied record doesn't return your Firebase IP. Cloudflare's documentation on proxy status says a query to a proxied record "will be answered with Cloudflare anycast IP addresses" instead of the IP you entered, while a DNS-only record returns the actual IP. Firebase is looking for its own addresses, so set the A records to DNS only (grey cloud) while the domain connects. TXT records are always DNS-only on Cloudflare, so the ownership record itself isn't affected.
Step 4: can I delete the TXT record once the domain is connected?
No. Firebase's guide says Hosting requires you to keep the ownership TXT record "continually" so it can assign and renew SSL certificates for your site. Firebase reprovisions certificates automatically as needed, and a missing TXT record is an easy way to break a renewal months later, long after you've forgotten the setup.
Step 5: what if the status is stuck on "Pending"?
Pending means DNS is right but no certificate has been issued, and Firebase lists three causes. CAA records can be too restrictive: if your domain has any CAA records, they must allow letsencrypt.org and pki.goog. In Advanced Setup, a failed migration can invalidate the challenge token. And requesting certificates for too many subdomains can stall minting; Firebase recommends no more than 20 subdomains on one apex custom domain.
If you have no CAA records at all, any certificate authority may issue, so CAA isn't your problem. Our own apex domains returned no CAA records on 2026-11-13.
Step 6: how long should I wait before changing anything else?
Up to 24 hours, in two separate windows. Firebase says to allow up to 24 hours for the TXT record to propagate before clicking Verify, and that it provisions and deploys the certificate within 24 hours after you point your A records at Hosting, though "in most cases" both happen within a few hours.
| Stage | Firebase's stated window |
|---|---|
| TXT ownership record propagates | Up to 24 hours (usually a few hours) |
| SSL certificate after A records point to Hosting | Within 24 hours |
| Advanced Setup: ACME challenge TXT propagates | Up to 24 hours |
While the domain is provisioning you may see an invalid certificate that doesn't include your domain name. Firebase calls this "a normal part of the process". If it's still not connected after 24 hours with clean records, click View on the domain in the console and provide the new token; developers also report that removing and re-adding the domain can restart a stuck setup, but treat that as a last resort.
Should I connect the apex domain, www, or both?
Both, with one redirecting to the other. The Add custom domain wizard has an optional box to redirect all requests on one domain to a second domain, so example.com and www.example.com serve the same content. Each custom domain can be connected to only one Hosting site. If you're deciding where a blog should live, PilotaSEO's guide to blog subdomain vs subfolder for SEO covers the search side.
The domain matters beyond the website. Android App Links need your assetlinks.json served over HTTPS on that domain, so wait for "Connected" before testing, as our App Links and universal links migration guide explains. A connected domain is also the last step in our guide to shipping Flutter and Firebase apps as an indie developer, and it belongs on any Flutter Firebase release checklist when your privacy policy or account deletion page lives on it.
Want to see the setup in practice? Every app and site we run is listed on the GSPTeck homepage, and the official GSPTeck apps and links page shows which domains are ours.
FAQ
How long does a Firebase custom domain take to connect?
Firebase says usually a few hours, and up to 24 hours for the TXT record and another 24 hours for the certificate after your A records point to Hosting. If it's longer than that, recheck your records from an outside resolver.
Why does my Firebase domain show a certificate error?
While a domain is provisioning, Firebase may serve a certificate that doesn't include your domain name. Firebase says this is normal and resolves once your domain's certificate is available.
Do I need a CNAME record for Firebase Hosting?
Use exactly the records the Add custom domain wizard shows you. For an apex domain that is typically A records plus the TXT record; extra CNAME records pointing to other providers should be removed.
Can I use Cloudflare with Firebase Hosting?
Yes, Cloudflare is one of the providers listed in Firebase's guide. Set the records to DNS only while the domain connects, because a proxied record returns Cloudflare's IPs instead of Firebase's.
Sources
- Firebase Hosting: Connect a custom domain (last updated 2026-11-12, checked 2026-11-13)
- Cloudflare DNS: Proxy status (checked 2026-11-13)
- Google Admin Toolbox Dig (used 2026-11-13)
- Stack Overflow: Firebase SSL generation takes over 24 hours (community report, checked 2026-11-13)