Connecting a custom domain to a Vercel project sounds straightforward until you hit the dreaded "Invalid Configuration" warning in the Vercel dashboard, or your site loads on vercel.app but returns a 404 on your own domain. Vercel's DNS requirements are slightly different from what most registrars and hosting tutorials teach, and the gap between theory and practice costs developers hours of debugging. This guide covers every record type you'll need, the exact dashboard paths, how to handle apex vs. subdomain scenarios, and how to verify the fix with CLI tools before you declare victory.

How Vercel Custom Domain DNS Works

Vercel operates a global edge network. When you add a custom domain, Vercel needs to route traffic from your domain to the nearest edge node and simultaneously provision a TLS certificate via Let's Encrypt. Both actions depend on your DNS records resolving correctly. Vercel supports two DNS assignment methods:

  • CNAME record – Points a subdomain (e.g., www) to cname.vercel-dns.com. Simple and widely supported.
  • A record – Points an apex domain (e.g., example.com without www) to Vercel's IP address 76.76.21.21. Required because most DNS providers cannot serve a CNAME at the zone apex (the "CNAME flattening" limitation in RFC 1034).

Some modern DNS providers (Cloudflare, NS1, Route 53) support a pseudo-record called ALIAS or ANAME that allows a CNAME-like behavior at the apex. Vercel explicitly supports this approach too, but you must still point it to cname.vercel-dns.com.

💡 After updating your DNS records, use the DNS Propagation Checker to watch your changes spread across global resolvers in real time — especially useful when debugging apex A records that propagate slower than CNAME updates.

Step 1: Add Your Domain in the Vercel Dashboard

Before touching your registrar, add the domain inside Vercel first. This creates the TLS certificate order and tells Vercel to expect traffic for that hostname.

  1. Log into vercel.com and open your project.
  2. Navigate to Settings → Domains.
  3. Type your domain (e.g., example.com) in the input field and click Add.
  4. Vercel will immediately display the required DNS records in a table. Keep this tab open — you'll copy values directly from it.

Vercel will show one of three recommended configurations depending on what you typed. If you entered the apex domain, it shows an A record pointing to 76.76.21.21 and optionally a CNAME for www. If you entered www.example.com, it shows a single CNAME. Choose carefully: most production sites want both the apex and www working, then redirect one to the other inside Vercel's domain settings.

Step 2: Configure DNS Records at Your Registrar

The path to the DNS editor varies by provider. Below are the most common ones.

Namecheap

Go to Domain List → Manage → Advanced DNS. Add records under the Host Records section. For an apex A record, set Host to @, Value to 76.76.21.21, TTL to Automatic. For a CNAME, set Host to www, Value to cname.vercel-dns.com.

GoDaddy

Navigate to My Products → DNS → Manage Zones → your domain → Add Record. GoDaddy's UI labels the apex host as @. Set the A record TTL to 600 seconds minimum (GoDaddy defaults to 1 hour — lower it so the fix propagates faster).

Google Domains / Squarespace Domains

After Google's sale of Google Domains to Squarespace, the DNS editor lives under Domains → your domain → DNS → Manage custom records. Add an A record with host @ and an A record with host www that CNAMEs to cname.vercel-dns.com — or use their Synthetic record / subdomain forwarding feature only for the www → apex redirect.

Cloudflare

In the Cloudflare dashboard go to your domain → DNS → Records → Add record. For the apex, add an A record pointing to 76.76.21.21. Set the Proxy status to DNS only (grey cloud) — not Proxied (orange cloud). Cloudflare's proxy intercepts TLS, which will break Vercel's certificate issuance. For the www CNAME to cname.vercel-dns.com, also set it to DNS only. If you want Cloudflare's CDN features, consider using Vercel as the origin behind Cloudflare's proxy, but that's an advanced setup requiring extra TLS configuration on both ends.

AWS Route 53

Open Route 53 → Hosted Zones → your domain → Create Record. For the apex, use an Alias record (Route 53's ANAME equivalent) pointed to cname.vercel-dns.com rather than a plain A record — this gives you the dynamic routing benefits. For www, add a standard CNAME to cname.vercel-dns.com.

; Example zone file entries for reference example.com. 300 IN A 76.76.21.21 www.example.com. 300 IN CNAME cname.vercel-dns.com.

Step 3: Verify DNS Records from the CLI

Don't rely on the Vercel dashboard alone — it polls DNS on its own schedule and can lag behind reality. Use these commands immediately after saving records at your registrar.

Using dig (Linux / macOS)

## Check the apex A record dig +short example.com A ## Expected output: 76.76.21.21 ## Check the www CNAME dig +short www.example.com CNAME ## Expected output: cname.vercel-dns.com. ## Query a specific public resolver to bypass local cache dig @8.8.8.8 +short example.com A dig @1.1.1.1 +short www.example.com CNAME

Using nslookup (Windows / macOS / Linux)

nslookup example.com 8.8.8.8 nslookup -type=CNAME www.example.com 1.1.1.1

Using resolvectl (systemd-based Linux)

resolvectl query example.com resolvectl query --type=CNAME www.example.com

If dig returns the correct IP or CNAME but Vercel's dashboard still shows "Invalid Configuration", wait 2–5 minutes and click Refresh in Vercel's domain settings. Vercel caches DNS responses for up to 5 minutes internally.

Step 4: Verify TLS Certificate Issuance

Once DNS resolves correctly, Vercel provisions a certificate automatically. You can confirm this under Settings → Domains — the domain row will show a green checkmark and the label Valid Configuration. From the CLI, check the cert directly:

## Verify TLS is live and issued for your domain openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \ | openssl x509 -noout -subject -dates ## Expected output includes: ## subject=CN = example.com ## notAfter=... (Let's Encrypt 90-day cert)

If the cert shows CN = vercel.app or you get a certificate error, DNS has not fully propagated yet, or there is a conflicting CAA record blocking Let's Encrypt. Check for CAA records with:

dig +short example.com CAA

If your registrar auto-added a CAA record pinned to a different CA (e.g., 0 issue "comodoca.com"), either delete it or add 0 issue "letsencrypt.org" alongside it.

Common Errors and Fixes

"Invalid Configuration" with correct records

This almost always means DNS hasn't propagated to Vercel's resolvers yet. Vercel uses its own internal resolvers (not 8.8.8.8), and sometimes these lag behind public resolvers. Wait 10 minutes, then click the Refresh button next to the domain in Vercel's dashboard. Don't delete and re-add the domain — that resets the certificate order.

CNAME at apex (CNAME flattening confusion)

Some developers try to add a CNAME record for the bare apex (@) in providers that don't support ALIAS/ANAME. This breaks mail delivery because MX, TXT, and SOA records cannot coexist with a CNAME at the apex per RFC 1035 Section 3.6.2. Always use an A record (76.76.21.21) or a native ALIAS/ANAME record at the apex — never a raw CNAME.

Redirect loop between apex and www

If you add both example.com and www.example.com in Vercel and set each to redirect to the other, you'll get an infinite redirect loop. Fix it by going to Settings → Domains in Vercel, selecting one domain as the primary, and setting the other to Redirect to primary domain (not the other way around).

ERR_TOO_MANY_REDIRECTS with Cloudflare

This happens when Cloudflare's proxy (orange cloud) is enabled alongside Vercel. Cloudflare expects an HTTP origin and Vercel serves HTTPS-only, causing a TLS handshake loop. The fix: set the Cloudflare proxy status to DNS only for all records pointing to Vercel. Alternatively, in Cloudflare's SSL/TLS settings set the encryption mode to Full (Strict) — but DNS only is simpler and works reliably.

Domain works in browser but Vercel dashboard still shows warning

The Vercel dashboard validation is asynchronous. If your site loads correctly over HTTPS, the domain is working even if the dashboard momentarily lags. Give it up to 15 minutes for the UI to catch up after DNS propagation completes.

💡 Use the DNS Lookup tool to quickly inspect your A, CNAME, and CAA records from multiple geographic vantage points at once — far faster than running dig from a single machine.

Using Vercel's Own Nameservers (Vercel DNS)

If you want to skip the registrar DNS editor entirely, Vercel offers its own nameserver delegation. Under Settings → Domains → your domain, click Switch to Vercel DNS. Vercel will provide two nameservers (e.g., ns1.vercel-dns.com and ns2.vercel-dns.com). Update these at your registrar under the nameserver settings (not the DNS records editor). Once delegated, Vercel automatically creates the correct A and CNAME records and handles TLS — nothing else to configure. This is the recommended path for new deployments with no pre-existing DNS setup.

Handling Multiple Environments and Branch Domains

Vercel auto-generates preview URLs (project-git-branch-team.vercel.app) for every branch. If you want a custom domain for a staging environment (e.g., staging.example.com), add it separately under Settings → Domains, and during the domain-add flow, choose Add to specific Git branch. Point a CNAME from staging.example.com to cname.vercel-dns.com at your registrar. Vercel will serve the correct branch deployment to that hostname automatically.

IPv6 and DoH Considerations in 2026

Vercel does not currently publish AAAA records for cname.vercel-dns.com or the edge IP 76.76.21.21. If your network forces IPv6-only DNS resolution, the A record lookup will still return an IPv4 result as long as your resolver performs A record queries. This is standard behavior — no special action needed.

With DNS-over-HTTPS (DoH) enabled in Chrome, Firefox, and macOS 13+ system settings, your dig commands may return different answers than what your browser sees. To test what your browser resolves, use Chrome's built-in lookup at chrome://net-internals/#dns or Firefox's at about:networking#dns. Both show the resolver path used for actual page loads. For DNSSEC validation, Vercel's zones are signed and cname.vercel-dns.com returns a valid RRSIG — if your resolver enforces DNSSEC, there should be no interruption.

How to Confirm Everything Is Working End-to-End

  1. dig +short example.com A returns 76.76.21.21 from at least two different public resolvers (8.8.8.8 and 1.1.1.1).
  2. dig +short www.example.com CNAME returns cname.vercel-dns.com.
  3. Vercel dashboard shows a green Valid Configuration checkmark for both domains.
  4. curl -I https://example.com returns HTTP/2 200 (or your expected redirect status) with a x-vercel-id response header.
  5. openssl s_client confirms a valid Let's Encrypt cert for your hostname.
## One-liner end-to-end health check curl -sI https://example.com | grep -E 'HTTP|x-vercel|location'

Preventing Recurrence and Domain Expiry Issues

The most common cause of a Vercel custom domain suddenly breaking is domain expiry or auto-renewal failure at the registrar. Enable auto-renewal and set a calendar reminder 30 days before expiry. Also enable registrar email alerts for DNS changes — any unauthorized modification to your A or CNAME records will instantly break your Vercel deployment. If you use Cloudflare, consider enabling Change Notifications under Notifications → Create to get a Slack/email alert whenever a DNS record is modified.

For teams managing multiple Vercel projects, audit domain assignments quarterly via the Vercel CLI:

## List all custom domains across your Vercel team vercel domains ls ## Inspect a specific domain's DNS status vercel domains inspect example.com