diff --git a/src/Appwrite/Platform/Modules/Proxy/Action.php b/src/Appwrite/Platform/Modules/Proxy/Action.php
index 93e4ea5292..49e0e55146 100644
--- a/src/Appwrite/Platform/Modules/Proxy/Action.php
+++ b/src/Appwrite/Platform/Modules/Proxy/Action.php
@@ -27,6 +27,14 @@ class Action extends PlatformAction
     {
         $domain = new Domain($rule->getAttribute('domain', ''));
 
+        if (empty($domain->get())) {
+            throw new Exception(Exception::RULE_VERIFICATION_FAILED, 'DNS verification failed because domain is not valid.');
+        }
+
+        if (!$domain->isKnown() || $domain->isTest()) {
+            throw new Exception(Exception::RULE_VERIFICATION_FAILED, 'DNS verification failed because domain ' . $domain->get() . ' is not known public suffix.');
+        }
+
         // Ensure CAA won't block certificate issuance
         if (!empty(System::getEnv('_APP_DOMAIN_TARGET_CAA', ''))) {
             $validationStart = \microtime(true);
diff --git a/src/Appwrite/Platform/Workers/Certificates.php b/src/Appwrite/Platform/Workers/Certificates.php
index 05a6578f6e..4e5311fa11 100644
--- a/src/Appwrite/Platform/Workers/Certificates.php
+++ b/src/Appwrite/Platform/Workers/Certificates.php
@@ -282,14 +282,6 @@ class Certificates extends Action
                 $mainDomain = $this->getMainDomain();
                 $isMainDomain = isset($mainDomain) && $domain->get() === $mainDomain;
 
-                if (empty($domain->get())) {
-                    throw new Exception('Missing certificate domain.');
-                }
-
-                if (!$domain->isKnown() || $domain->isTest()) {
-                    throw new Exception('Unknown public suffix for domain.');
-                }
-
                 // TODO: @christyjacob remove once we migrate the rules in 1.7.x
                 if (System::getEnv('_APP_RULES_FORMAT') === 'md5') {
                     $rule = ValidatorAuthorization::skip(fn () => $dbForPlatform->getDocument('rules', md5($domain->get())));