During domain validation Reverse proxy verification failed

[ArisudanTiwari]

Hi,

I am trying to connect my landing page domain:

www.connect.oculusit.com

The DNS records have been updated on the server side by our IT team, but during validation I am now getting a Reverse Proxy error.

Can someone help with how we can fix this?

I have gone through the developer documentation here:
https://developers.hubspot.com/docs/cms/best-practices/testing-staging-performance/reverse-proxy-sup...
but it hasn’t been helpful in resolving the issue.

We have Marketing Hub Enterprise and Content Hub professional plan. 

Thanks in advance.

 

[RubenBurdin]

Hi  @ArisudanTiwari  This one is frustrating, but the error message is actually quite specific. A “Reverse proxy verification failed” during domain validation usually means HubSpot is detecting that requests to the domain are being intercepted or modified before they reach HubSpot’s CDN, even though the DNS records look correct.

In practice, this almost always comes down to something sitting in front of HubSpot that HubSpot does not control. Common culprits are Cloudflare, Akamai, Azure Front Door, AWS ALB, NGINX, or a WAF doing SSL termination or rewriting headers. For landing page domains, HubSpot requires a clean CNAME directly to the HubSpot target, with no reverse proxy or traffic inspection in between. If your IT team has configured the domain behind an existing reverse proxy for security or routing, validation will fail even if the CNAME technically resolves.

Two concrete things to check. First, confirm that connect.oculusit is a pure CNAME to the HubSpot provided hostname and not proxied or flattened. If you are using Cloudflare, the record must be DNS-only, not orange-clouded. Second, make sure SSL is not being terminated upstream. HubSpot issues and manages the certificate itself for CMS domains, so any proxy handling HTTPS before HubSpot will break validation. HubSpot documents this limitation clearly here: https://developers.hubspot.com/docs/cms/best-practices/testing-staging-performance/reverse-proxy-sup...

Also worth checking is that there is no HTTP auth, IP restriction, or header injection on that host. Even a subtle security rule can cause HubSpot’s verification request to be rejected. You can sanity-check this by curling the domain and inspecting headers to see if they match a standard HubSpot response (https://knowledge.hubspot.com/domains-and-urls/connect-a-domain-to-hubspot )

If you want, can you confirm whether that subdomain is currently behind Cloudflare or another edge proxy? That usually points straight to the fix. Hope this helps.

[BérangèreL]

Hey @ArisudanTiwari 👋 and Happy Friday!

Thanks for reaching out to the HubSpot Community and for sharing the screenshots!

I'd love to put you in touch with our Top Experts: Hi @suprdense, @TomM2 and @Humashankar do you have any tips or insights to share with @ArisudanTiwari, please?

Thanks so much and have a lovely weekend!
Bérangère