Docs

Troubleshooting WAF Provisioning

Overview

The WAF provisioning process involves several automated steps: domain registration, firewall configuration, certificate issuance, and DNS verification. Occasionally the process can get stuck at one of these stages.

Common Issues

Stuck on “Initializing WAF Build”

This means the initial firewall instance is being created. The build runs on our infrastructure, not on your Heroku dynos, so your app’s logs will not show anything about it.

  1. If the build has shown Initializing for more than an hour and your domain’s DNS is resolving, contact us and we can investigate
  2. If your domain is not yet resolving, no action is needed: the build retries automatically for several hours by design while DNS propagates

Domain Verification Not Completing

If the setup is waiting for domain verification:

  1. Confirm you have added the required CNAME record exactly as shown on the setup page
  2. Verify the record is visible with DNS is Beautiful: look up the exact CNAME name shown on your setup page, e.g. at https://dnsisbeautiful.com/CNAME/<the record name from your setup page> (a CNAME lookup checked from resolvers worldwide)
  3. DNS propagation can take up to 24 hours, though it is usually much faster

Certificate Not Issuing

If the setup is stuck at the certificate stage:

  1. Check for CAA records on your domain that may be blocking certificate issuance
  2. Verify the domain verification step completed successfully
  3. Wildcard domains may require additional DNS records

Setup Page Shows Stale Information

If you believe a step has completed but the setup page hasn’t updated:

  1. Refresh the page
  2. Check the WAF dashboard for updated status

Starting Over

If the provisioning is stuck and cannot be resolved:

  1. Remove the ExpeditedWAF addon from your Heroku app’s Resources tab
  2. Wait a few minutes
  3. Re-add the addon and begin the setup process again

This will not affect your Heroku application. The WAF is a separate proxy layer.

Need Help?

If your provisioning is stuck, please contact us so we can investigate: