Can I use my domain on Vercel with A records?

Yes. You can point an apex domain like example.com to Vercel with an A record, and for most projects the value is 76.76.21.21. An apex domain can't use a CNAME, so an A record (or delegating to Vercel's nameservers) is the standards-compliant way to point it at Vercel's network. Pair the apex A record with a www CNAME, and Vercel provisions SSL automatically once DNS propagates.

Here's how to set it up, which value to use, and how to fix the errors that show up most often.

Copy link to headingWhy your apex domain needs an A record

Every DNS zone carries NS and SOA records at its apex, and the DNS spec reserves a CNAME node for the CNAME alone. A name that already has NS and SOA records can't also be a CNAME, so a root domain has two standards-compliant options, an A record or nameserver delegation.

Subdomains work differently. A name like www carries no NS or SOA records of its own, so it can use a CNAME. That's why the recommended setup pairs an apex A record with a www CNAME.

If your goal is a wildcard such as *.example.com, an A record won't work. Wildcards require nameserver delegation so Vercel can run the certificate challenge on each renewal, which the FAQ covers below.

Copy link to headingWhich IP to use for your Vercel A record

Always use the value shown in your project's domain card. For most projects that value is 76.76.21.21, a general-purpose anycast address. Newer projects draw a value from a pool of anycast IPs matched to the plan and project, so your card may show a different address such as 216.198.79.1. The card is the source of truth, so use whatever it displays.

You might see other Vercel IPs mentioned in older guides or forum threads. Copy the value from your card rather than one you found elsewhere, because verification checks for the exact A record your project expects. If the record doesn't match the card, the domain stays in an invalid state.

Skip IPv6. Vercel doesn't support IPv6 for custom domains added through a third-party DNS provider, so an AAAA record pointing at another host splits traffic between providers and can stall SSL provisioning. Remove any AAAA records for the apex before you continue.

Copy link to headingHow to point your apex domain to Vercel with an A record

You set this up in three parts, adding the domain in Vercel, creating the A record at your DNS provider, and pairing it with a www CNAME. Work through them in order.

Follow these steps:

1. Add the domain in Vercel. In the dashboard, open Settings, then Domains, and enter your domain. Vercel detects the apex and shows the A record method, then displays the exact value for your project in the domain card.
2. Create the A record at your DNS provider. Add an A record with the value from your domain card. Delete any existing apex A records first, since stale records from a previous host block verification.
3. Pair the apex with a www CNAME. Add a CNAME for www that points to your domain card's CNAME target, then redirect the apex to www.

Once the records propagate, the domain card shows Valid Configuration and Vercel begins issuing the certificate.

Create these two records at your registrar or DNS provider, using the exact values from your domain card:

Most providers use @ for the zone apex, though some use a blank host field instead. A short TTL such as 300 seconds keeps propagation fast, so the dashboard flips to Valid Configuration soon after you save.

If your domain's nameservers already point to Vercel, you can add the apex record from the Vercel CLI instead of the dashboard:

vercel dns add example.com '@' A 76.76.21.21

If you manage DNS with an external provider, add the record in that provider's dashboard rather than through the CLI.

A CNAME lets Vercel adjust traffic steering for routing and DDoS mitigation, while an A record points at a fixed value. Setting www as the primary domain with the apex redirecting to it gives you that flexibility, so open the www domain card and use the Redirect to input to wire up the redirect.

To confirm the setup end to end, check propagation and the certificate from your terminal:

dig a example.com +short              # returns your domain card's A value
dig cname www.example.com +short      # returns your card's CNAME target
curl -I <https://example.com>           # look for HTTP/2 200 and an SSL response

If the records match your domain card and curl returns a secure response, the domain is live.

Copy link to headingHow anycast routing makes a single A record enough

The value on your domain card is an anycast address announced from many locations at once. A request to it is routed to a nearby Point of Presence out of 126 across 51 countries, then travels over Vercel's private network to the nearest of 20 compute regions. Because that routing happens at the network layer, a single apex A record reaches the same global network a CNAME-based CDN setup reaches through DNS.

This is what makes ALIAS and ANAME records unnecessary on Vercel. Those record types exist to give an apex CNAME-like behavior on other platforms, but anycast already provides the steering, so they add no routing benefit here. A November 2023 infrastructure upgrade improved this routing by up to 45% at p99 for all plans.

The pattern holds at scale. Mintlify runs 2,500 custom domains on its Vercel-powered docs platform, and Hashnode manages over 35,000, both on programmatic domain setup with automatic SSL that provisions in under 5 seconds.

Copy link to headingHow to fix common A record problems on Vercel

Most A record issues fall into a few buckets, and each has a clear fix. Work by symptom.

Copy link to headingInvalid Configuration after adding the A record

Vercel checks for the exact A record value on your domain card, so a stale record from a previous host or a value mismatch produces this state. Run dig a example.com +short and compare the output to the card. If the record is correct and propagated but the status stays stuck, remove the domain from the project and add it again to reset the check.

Copy link to headingCloudflare proxy conflicts and err\_too\_many\_redirects

A proxied Cloudflare record (the orange cloud) sits between the public DNS answer and Vercel's expected A record, which blocks verification and the SSL challenge. The err_too_many_redirects error appears when Cloudflare's SSL/TLS mode is set to Flexible.

To resolve it, adjust these Cloudflare settings:

• SSL/TLS mode: Set it to Full, since Flexible forces HTTP to your origin and creates the redirect loop that triggers the error.
• Proxy status: If verification still fails, switch the record to DNS-only temporarily so Vercel can verify and issue the certificate, then re-enable the proxy if you need it.

After the certificate issues, your site loads over HTTPS whether or not the proxy is on.

Copy link to headingSSL certificate stuck generating

Certificate issuance stalls for a handful of reasons, and the /.well-known path is central to the challenge. Vercel uses a Let's Encrypt HTTP-01 challenge on that path, so anything that intercepts it blocks the certificate.

Check these causes in order:

• A conflicting AAAA record: An AAAA record pointing at a third party splits traffic so the challenge lands elsewhere. Remove all AAAA records for the apex.
• A restrictive CAA record: A CAA record that doesn't permit Let's Encrypt blocks issuance. Add or update the CAA record so Let's Encrypt is allowed to issue.
• A redirect on the challenge path: A redirect or rewrite on /.well-known/acme-challenge/ breaks the HTTP-01 challenge. Remove it, since that path is reserved.
• A stale challenge record: An old _acme-challenge TXT record from a previous provider interferes with validation. Delete it.

Clearing these lets Vercel complete the challenge and provision the certificate, usually within a few minutes.

Copy link to headingDomain already in use by another Vercel account

If the domain is assigned to a different project or team, Vercel prompts you to prove ownership. Add a vercel TXT record at vercel.example.com, and Vercel makes the domain available to your project once the record verifies.

Copy link to headingCustom domain times out from some regions while the .vercel.app URL works

Some networks have reported regional reachability issues from Brazil and Oman, where a custom domain on an apex A record times out while the matching .vercel.app URL keeps working. Set www as the primary domain with the apex redirecting to it, so most traffic reaches Vercel through the CNAME path instead of the fixed apex IP.

Copy link to headingNext steps

With the A record and www CNAME in place, your apex domain is ready to serve traffic over HTTPS. Add your custom domain to a project, or start a new Vercel project to try the flow end to end.

Copy link to headingRelated resources

• Setting up a custom domain
• Working with SSL certificates
• Troubleshooting domains
• How Vercel's CDN works
• CNAME vs A record

Copy link to headingFrequently asked questions

Copy link to headingCan I use a CNAME for my apex domain instead of an A record?

No. Every zone apex carries NS and SOA records, and the DNS spec reserves a CNAME node for the CNAME alone, so the two can't coexist. Use an A record or delegate the domain to Vercel's nameservers. Subdomains like www have no such restriction and can use a CNAME.

Copy link to headingWhat is the correct Vercel A record IP?

The general-purpose value is 76.76.21.21, but the correct value for your project is whatever your domain card shows. Newer projects are assigned an address from Vercel's anycast pool, such as 216.198.79.1, so verify against the card rather than reusing an IP from another guide.

Copy link to headingDo I need ALIAS or ANAME records for global routing?

No. A single A record is enough. The value behind it is an anycast address that routes each request to the nearest of Vercel's 126 Points of Presence, so an apex domain gets global routing without ALIAS or ANAME records. Those record types add no routing benefit on Vercel.

Copy link to headingHow do I configure a wildcard domain like \*.example.com?

An A record can't provision wildcard SSL. Delegate the domain to Vercel's nameservers, ns1.vercel-dns.com and ns2.vercel-dns.com, so Vercel can run the DNS-01 certificate challenge on every renewal. Wildcards require nameserver delegation because Vercel needs control of the DNS to create the validation record.

Copy link to headingWhy does my custom domain time out from some regions while my .vercel.app URL works?

This matches regional reachability reports where an apex on a fixed A record times out from certain networks while the matching .vercel.app URL routes normally. Set www as the primary domain with the apex redirecting to it, since the CNAME path doesn't share the apex IP's routing dependency.