You manage Vercel DNS records from the dashboard for manual edits, and from the CLI or REST API for scripted changes. Every path shares one requirement. Your domain has to use Vercel's nameservers.
If your records look correct but the dashboard still shows an Invalid Configuration error, that requirement is usually where to start. Here's how to work through it, from the prerequisite to the edge cases.
Copy link to headingWhat you need to manage Vercel DNS records
Everything here assumes your domain uses Vercel's nameservers. Records you add through the dashboard, CLI, or API only take effect when your domain resolves through ns1.vercel-dns.com and ns2.vercel-dns.com. That happens when you buy the domain through Vercel, transfer it in, or point your registrar's nameserver settings at Vercel. If your nameservers point elsewhere, you manage records at that provider instead, and the steps below won't apply.
Before you start, set up the access you'll use:
- A Vercel team: Domain management happens at the team level. Account-linked domains keep resolving, but you'll need to move them to a team to change their records.
- The Vercel CLI or an API token: Install the CLI with
npm i -g vercelfor terminal work, or create a personal access token or OAuth token for REST API calls.
If your domain fails the nameserver check, fix that first, since nothing below behaves as described until the domain resolves through Vercel.
Copy link to headingWhy Vercel DNS record management needs Vercel nameservers
Pointing your nameservers at Vercel gives Vercel write access to your DNS zone, and that access is what several features depend on. Once your domain resolves through Vercel, you get three things that external DNS can't provide:
- Wildcard SSL certificates: Vercel issues wildcard certificates through the DNS-01 challenge, which requires creating verification records in your zone. External nameservers make that impossible.
- Automatic apex and subdomain records: Domains on Vercel's nameservers don't need explicit records for the apex or first-level subdomains, because Vercel creates them for you.
- Domain Connect provisioning: Third-party services can add the records they need without asking you to copy and paste values by hand.
Choosing external DNS is a valid decision, but it opts you out of all three. Once your domain is on Vercel's nameservers, you can add, edit, and delete records from any interface.
Copy link to headingHow to add, edit, and delete DNS records on Vercel
The dashboard and CLI both handle interactive work, and both write to the same zone. Start with the record types Vercel supports, then use whichever interface fits the task.
Copy link to headingSupported DNS record types
Vercel supports ten record types, several with constraints worth knowing before you use them:
| Type | Use case | Notes on Vercel |
|---|---|---|
| A | Point the apex to an IPv4 address | Apex target is 76.76.21.21 |
| AAAA | Point to an IPv6 address | Accepted, but Vercel doesn't support IPv6 yet |
| ALIAS | CNAME-like record at the apex | Apex only; the target must resolve to an A or AAAA record |
| CAA | Restrict which authorities can issue certificates | Add 0 issue "letsencrypt.org" if you set CAA records |
| CNAME | Point a subdomain to a hostname | Subdomains only, never the apex |
| HTTPS | Bind a service with connection details | Supported in Vercel DNS |
| MX | Route email | Vercel doesn't provide email; pair with a third-party provider |
| NS | Delegate a subdomain | Used for the _acme-challenge delegation workaround |
| SRV | Locate a service | Takes priority, weight, port, and target |
| TXT | Verification, SPF, and DKIM | A _vercel TXT record proves domain access across accounts |
Most setups only need an A record at the apex, a CNAME for subdomains, and TXT or MX records for verification and email.
Copy link to headingAdd a record in the dashboard
Adding a record in the dashboard takes four steps:
- Open the Vercel dashboard, select Domains in the sidebar, pick your domain, and open Advanced Settings.
- Select Enable Vercel DNS to open the DNS record form.
- Enter the Name (the prefix only, such as
www), Type, Value, and TTL (60 seconds by default), plus any type-specific fields such as MX priority. - Select Add.
For common providers, the Add DNS Preset dropdown fills in a full set of records at once, such as Gmail's MX records. New records can take up to 24 hours to propagate and clear local caches.
Copy link to headingEdit and delete records
To edit a record, open your domain from the Domains page, find the record in the list, and select edit. To remove an entire zone, open Advanced Settings, select the ellipsis (⋯), then Delete DNS Zone. Default records can't be deleted, though new records can override them when you need different behavior.
Copy link to headingManage records from the CLI
The vercel dns commands cover the same add, list, remove, and import operations from a terminal:
Add --scope or --team for team-scoped operations. CLI additions carry the same propagation window as the dashboard, so wait for propagation rather than re-running a command that dig hasn't caught up with yet.
Copy link to headingHow to provision Vercel DNS records at scale with the REST API
When your product issues domains to many tenants, clicking through the dashboard stops being practical. The REST API creates, lists, and deletes records programmatically, and Domain Connect lets third-party services add their own records for you.
The DNS group of the API exposes four endpoints:
Authenticate with a Bearer token in the Authorization header, and pass teamId or slug as query parameters for team resources. OAuth access tokens last one hour, and refresh tokens last 30 days and rotate on each exchange, so build token refresh into any long-running provisioning job.
For third-party setups, Domain Connect removes manual entry. A service discovers Vercel support through a _domainconnect TXT query, redirects the user to Vercel with a signed URL, the user consents, and Vercel applies the records. Email providers commonly use this flow to set up their DNS.
Copy link to headingHow to fix an Invalid Configuration error for DNS records on Vercel
An Invalid Configuration error is one label sitting on top of several different causes, so a single fix often targets the wrong one. Work through the common causes in order.
These six causes account for most Invalid Configuration errors:
| Cause | Fix | Verify |
|---|---|---|
| CNAME at the zone apex | A CNAME can't coexist with the apex's required NS and SOA records. Use A @ 76.76.21.21 at the apex and reserve CNAME for subdomains. | dig A example.com |
| Conflicting A and CNAME at one hostname | The A record takes precedence and masks the CNAME. Remove the conflicting A record at your registrar. | dig CNAME sub.example.com |
| Cloudflare proxy enabled (orange cloud) | Cloudflare returns its own IPs, so Vercel can't verify DNS or renew SSL. Set the record to DNS only. | dig example.com +short |
| Missing or restrictive CAA record | A restrictive CAA can block Let's Encrypt from issuing. Add 0 issue "letsencrypt.org". | dig -t CAA +noall +answer example.com |
| Domain in use by another Vercel account | Add a _vercel TXT record to verify access, then wait 5 to 10 minutes. | dig TXT _vercel.example.com |
| Wildcard without Vercel nameservers | The DNS-01 challenge needs zone write access. Switch to Vercel nameservers, or delegate _acme-challenge with NS records. | dig NS example.com +short |
The Cloudflare proxy case is the most common of these, and it needs a little more care. Vercel doesn't recommend running a reverse proxy in front of your deployment, because it limits the traffic visibility Vercel's security products rely on and adds latency. With the proxy on and SSL/TLS mode set to Full, you may see Cloudflare error 525 alongside a Failed to Generate Cert message in the dashboard. Switch the record to DNS only long enough for Vercel to issue the certificate, then re-enable the proxy if you need it.
Nameserver and CNAME changes take 24 to 48 hours because registrar and resolver caches vary. Before a live migration, lower the TTL to 60 seconds at least 24 hours ahead so most traffic follows the new record soon after cutover. If the dashboard still reports Invalid Configuration after propagation completes, removing the domain from the project and re-adding it refreshes validation.
Copy link to headingHow to verify Vercel DNS records before moving traffic
Before you cut traffic over, confirm the records resolve at Vercel's nameserver directly rather than waiting on resolver caches. Query the authoritative nameserver and check your ownership and CAA records:
The dashboard's Check DNS Configuration button runs the same verification, and whatsmydns.net shows propagation by region. Querying @ns1.vercel-dns.com directly tells you whether a delay lives at Vercel's nameserver or in downstream resolver caches, which changes what you do next.
Copy link to headingNext steps
With your domain on Vercel's nameservers, your records and certificates stay in sync as you deploy. Start a new Vercel project to add and manage a domain, or browse the templates for a framework-ready starting point.
Copy link to headingRelated resources
- Managing DNS records
- Working with nameservers
- Set up a custom domain
- Troubleshooting domains
- DNS REST API
Copy link to headingFrequently asked questions
Copy link to headingCan I manage DNS records if my domain uses external nameservers?
No. The dashboard DNS editor, vercel dns commands, and DNS REST API all require Vercel's nameservers. With external nameservers, you manage records at your DNS provider instead. Add an A record pointing to 76.76.21.21 for the apex, or a CNAME to cname.vercel-dns-0.com for a subdomain.
Copy link to headingHow do I add a wildcard domain like \*.example.com?
Wildcard domains require Vercel's nameservers, because Vercel issues wildcard certificates through the DNS-01 challenge and needs write access to your zone. Point your nameservers at Vercel, add the apex domain, then add the wildcard in your project settings. Vercel issues a certificate for each subdomain automatically.
Copy link to headingHow long does DNS propagation take after a change?
New records can take up to 24 hours to propagate and clear local caches. Nameserver and CNAME changes can take 24 to 48 hours, since registrar and resolver caches vary. To shorten the window for a live migration, lower the record's TTL to 60 seconds about a day before you cut over.
Copy link to headingHow do I edit an existing DNS record in the dashboard?
Open the Domains page, select your domain, find the record in the list, and select edit. Deleting the record and adding a corrected one works too. Changes take up to 24 hours to propagate, so confirm with dig against Vercel's nameserver before you rely on the update.