If you use Cloudflare, make sure your CNAME record is set to DNS only (the grey cloud icon) and not Proxied (the orange cloud icon).
When a record is proxied, Cloudflare hides your CNAME and serves traffic through its own servers, handling TLS itself. As a result we can't see that the record points to mydomain.onelink.to, and we can't verify your domain or issue a TLS certificate for it. To fix this, open your Cloudflare DNS settings, find the record for your subdomain, and click the orange cloud so it turns grey ("DNS only"). Verification should succeed within a few minutes.
The same applies to other proxy, CDN, or web-firewall services (such as Sucuri, Imperva, or StackPath): disable proxying for this record so the CNAME points directly to our servers.