--- title: Can I use my domain on Vercel with A records? description: Point your apex domain to Vercel with an A record (76.76.21.21 or your domain card's value), pair it with a www CNAME, and get SSL automatically. url: /kb/guide/use-domain-vercel-a-records canonical_url: "https://vercel.com/kb/guide/use-domain-vercel-a-records" last_updated: 2026-07-27 authors: Vercel related: - /docs/domains/working-with-dns - /docs/domains/working-with-domains/add-a-domain - /kb/guide/a-record-and-caa-with-vercel - /docs/domains/troubleshooting - /docs/cli - /docs/domains/working-with-domains/deploying-and-redirecting - /docs/cdn - /changelog/faster-and-more-reliable-managed-infrastructure - /blog/platforms-starter-kit - /kb/guide/resolve-err-too-many-redirects-when-using-cloudflare-proxy-with-vercel - /docs/domains/set-up-custom-domain - /docs/domains/working-with-ssl install_vercel_plugin: npx plugins add vercel/vercel-plugin --- Yes. You can point an apex domain like `example.com` to Vercel with an A record, and for most projects the value is `76.76.21.21`. An apex domain can't use a CNAME, so an A record (or delegating to Vercel's nameservers) is the standards-compliant way to point it at Vercel's network. Pair the apex A record with a `www` [CNAME](https://vercel.com/docs/domains/working-with-dns), and Vercel provisions SSL automatically once DNS propagates. Here's how to set it up, which value to use, and how to fix the errors that show up most often. ## Why your apex domain needs an A record Every DNS zone carries NS and SOA records at its apex, and the DNS spec [reserves a CNAME node](https://kb.isc.org/docs/aa-01640) for the CNAME alone. A name that already has NS and SOA records can't also be a CNAME, so a root domain has two standards-compliant options, an A record or nameserver delegation. Subdomains work differently. A name like `www` carries no NS or SOA records of its own, so it can use a CNAME. That's why the recommended setup pairs an apex A record with a `www` CNAME. If your goal is a wildcard such as `*.example.com`, an A record won't work. Wildcards require [nameserver delegation](https://vercel.com/docs/domains/working-with-domains/add-a-domain) so Vercel can run the certificate challenge on each renewal, which the FAQ covers below. ## Which IP to use for your Vercel A record Always use the value shown in your project's domain card. For most projects that value is `76.76.21.21`, a general-purpose anycast address. Newer projects draw a value from a [pool of anycast IPs](https://vercel.com/kb/guide/a-record-and-caa-with-vercel) matched to the plan and project, so your card may show a different address such as `216.198.79.1`. The card is the source of truth, so use whatever it displays. You might see other Vercel IPs mentioned in older guides or forum threads. Copy the value from your card rather than one you found elsewhere, because verification checks for the exact A record your project expects. If the record doesn't match the card, the domain stays in an invalid state. Skip IPv6. Vercel [doesn't support IPv6](https://vercel.com/docs/domains/troubleshooting) for custom domains added through a third-party DNS provider, so an AAAA record pointing at another host splits traffic between providers and can stall SSL provisioning. Remove any AAAA records for the apex before you continue. ## How to point your apex domain to Vercel with an A record You set this up in three parts, adding the domain in Vercel, creating the A record at your DNS provider, and pairing it with a `www` CNAME. Work through them in order. Follow these steps: 1. **Add the domain in Vercel.** In the dashboard, open **Settings**, then **Domains**, and enter your domain. Vercel detects the apex and shows the A record method, then displays the exact value for your project in the domain card. 2. **Create the A record at your DNS provider.** Add an A record with the value from your domain card. Delete any existing apex A records first, since stale records from a previous host block verification. 3. **Pair the apex with a www CNAME.** Add a CNAME for `www` that points to your domain card's CNAME target, then redirect the apex to `www`. Once the records propagate, the domain card shows **Valid Configuration** and Vercel begins issuing the certificate. Create these two records at your registrar or DNS provider, using the exact values from your domain card: | Type | Name/Host | Value/Points to | Domain type | | ----- | -------------- | ---------------------------------------------------------------------------------- | ----------- | | A | `@` (or blank) | your domain card's value, often `76.76.21.21` | apex | | CNAME | `www` | your domain card's CNAME target, for example `d1d4fc829fe7bc7c.vercel-dns-017.com` | subdomain | Most providers use `@` for the zone apex, though some use a blank host field instead. A short TTL such as 300 seconds keeps propagation fast, so the dashboard flips to **Valid Configuration** soon after you save. If your domain's nameservers already point to Vercel, you can add the apex record from the [Vercel CLI](https://vercel.com/docs/cli) instead of the dashboard: `vercel dns add example.com '@' A 76.76.21.21` If you manage DNS with an external provider, add the record in that provider's dashboard rather than through the CLI. A CNAME lets Vercel adjust traffic steering for routing and DDoS mitigation, while an A record points at a [fixed value](https://vercel.com/docs/domains/working-with-domains/deploying-and-redirecting). Setting `www` as the primary domain with the apex redirecting to it gives you that flexibility, so open the `www` domain card and use the **Redirect to** input to wire up the redirect. To confirm the setup end to end, check propagation and the certificate from your terminal: `dig a example.com +short # returns your domain card's A value dig cname www.example.com +short # returns your card's CNAME target curl -I # look for HTTP/2 200 and an SSL response` If the records match your domain card and `curl` returns a secure response, the domain is live. ## How anycast routing makes a single A record enough The value on your domain card is an [anycast address](https://vercel.com/docs/cdn) announced from many locations at once. A request to it is routed to a nearby Point of Presence out of 126 across 51 countries, then travels over Vercel's private network to the nearest of 20 compute regions. Because that routing happens at the network layer, a single apex A record reaches the same global network a CNAME-based CDN setup reaches through DNS. This is what makes ALIAS and ANAME records unnecessary on Vercel. Those record types exist to give an apex CNAME-like behavior on other platforms, but anycast already provides the steering, so they add no routing benefit here. A [November 2023 infrastructure upgrade](https://vercel.com/changelog/faster-and-more-reliable-managed-infrastructure) improved this routing by up to 45% at p99 for all plans. The pattern holds at scale. [Mintlify runs 2,500 custom domains](https://vercel.com/customers/mintlify-scaling-a-powerful-documentation-platform-with-vercel) on its Vercel-powered docs platform, and [Hashnode manages over 35,000](https://vercel.com/blog/platforms-starter-kit), both on programmatic domain setup with automatic SSL that provisions in [under 5 seconds](https://vercel.com/solutions/multi-tenant-saas). ## How to fix common A record problems on Vercel Most A record issues fall into a few buckets, and each has a clear fix. Work by symptom. ### Invalid Configuration after adding the A record Vercel checks for the exact A record value on your domain card, so a stale record from a previous host or a value mismatch produces this state. Run `dig a example.com +short` and compare the output to the card. If the record is correct and propagated but the status stays stuck, [remove the domain](https://community.vercel.com/t/vercel-custom-domain-shows-invalid-configuration-after-updating-dns-records/37946) from the project and add it again to reset the check. ### Cloudflare proxy conflicts and err\\\_too\\\_many\\\_redirects A proxied Cloudflare record (the orange cloud) sits between the public DNS answer and Vercel's expected A record, which [blocks verification](https://community.vercel.com/t/invalid-configuration-error-when-cloudflare-proxy-enabled/38060) and the SSL challenge. The `err_too_many_redirects` error appears when Cloudflare's SSL/TLS mode is set to Flexible. To resolve it, adjust these Cloudflare settings: - **SSL/TLS mode:** Set it to Full, since Flexible forces HTTP to your origin and creates the redirect loop that [triggers the error](https://vercel.com/kb/guide/resolve-err-too-many-redirects-when-using-cloudflare-proxy-with-vercel). - **Proxy status:** If verification still fails, switch the record to DNS-only [temporarily](https://community.vercel.com/t/custom-domain-stuck-on-failed-to-generate-cert-cloudflare-proxy/22662) so Vercel can verify and issue the certificate, then re-enable the proxy if you need it. After the certificate issues, your site loads over HTTPS whether or not the proxy is on. ### SSL certificate stuck generating Certificate issuance stalls for a handful of reasons, and the `/.well-known` path is central to the challenge. Vercel uses a Let's Encrypt HTTP-01 challenge on that path, so anything that intercepts it blocks the certificate. Check these causes in order: - **A conflicting AAAA record:** An AAAA record pointing at a third party [splits traffic](https://community.vercel.com/t/vercel-ssl-certificate-stuck-on-generating-status-despite-https-working/32985) so the challenge lands elsewhere. Remove all AAAA records for the apex. - **A restrictive CAA record:** A CAA record that doesn't permit Let's Encrypt blocks issuance. Add or update the CAA record so Let's Encrypt is allowed to issue. - **A redirect on the challenge path:** A redirect or rewrite on `/.well-known/acme-challenge/` breaks the HTTP-01 challenge. Remove it, since that path is reserved. - **A stale challenge record:** An old `_acme-challenge` TXT record from a previous provider [interferes with validation](https://community.vercel.com/t/custom-domain-remains-invalid-configuration-after-dns-propagation/44360). Delete it. Clearing these lets Vercel complete the challenge and provision the certificate, usually within a few minutes. ### Domain already in use by another Vercel account If the domain is assigned to a different project or team, Vercel prompts you to prove ownership. Add a `_vercel_` _TXT record at_ `vercel.example.com`, and Vercel makes the domain available to your project once the record verifies. ### Custom domain times out from some regions while the .[vercel.app](http://vercel.app) URL works Some networks have reported regional reachability issues from [Brazil](https://community.vercel.com/t/custom-domains-timing-out-in-brazil-while-vercel-app-domains-work-normally/41889) and [Oman](https://community.vercel.com/t/vercel-custom-domains-resolving-to-216-198-79-1-time-out-from-oman-while-vercel-app-domains-work/45765), where a custom domain on an apex A record times out while the matching `.vercel.app` URL keeps working. Set `www` as the primary domain with the apex redirecting to it, so most traffic reaches Vercel through the CNAME path instead of the fixed apex IP. ## Next steps With the A record and `www` CNAME in place, your apex domain is ready to serve traffic over HTTPS. [Add your custom domain](https://vercel.com/docs/domains/working-with-domains/add-a-domain) to a project, or [start a new Vercel project](https://vercel.com/new) to try the flow end to end. ## Related resources - [Setting up a custom domain](https://vercel.com/docs/domains/set-up-custom-domain) - [Working with SSL certificates](https://vercel.com/docs/domains/working-with-ssl) - [Troubleshooting domains](https://vercel.com/docs/domains/troubleshooting) - [How Vercel's CDN works](https://vercel.com/docs/cdn) - [CNAME vs A record](https://vercel.com/i/cname-vs-a-record) ## Frequently asked questions ### Can I use a CNAME for my apex domain instead of an A record? No. Every zone apex carries NS and SOA records, and the DNS spec reserves a CNAME node for the CNAME alone, so the two can't coexist. Use an A record or delegate the domain to Vercel's nameservers. Subdomains like `www` have no such restriction and can use a CNAME. ### What is the correct Vercel A record IP? The general-purpose value is `76.76.21.21`, but the correct value for your project is whatever your domain card shows. Newer projects are assigned an address from Vercel's anycast pool, such as `216.198.79.1`, so verify against the card rather than reusing an IP from another guide. ### Do I need ALIAS or ANAME records for global routing? No. A single A record is enough. The value behind it is an anycast address that routes each request to the nearest of Vercel's 126 Points of Presence, so an apex domain gets global routing without ALIAS or ANAME records. Those record types add no routing benefit on Vercel. ### How do I configure a wildcard domain like \\\*.example.com? An A record can't provision wildcard SSL. Delegate the domain to Vercel's nameservers, `ns1.vercel-dns.com` and `ns2.vercel-dns.com`, so Vercel can run the DNS-01 certificate challenge on every renewal. Wildcards require nameserver delegation because Vercel needs control of the DNS to create the validation record. ### Why does my custom domain time out from some regions while my .vercel.app URL works? This matches regional reachability reports where an apex on a fixed A record times out from certain networks while the matching `.vercel.app` URL routes normally. Set `www` as the primary domain with the apex redirecting to it, since the CNAME path doesn't share the apex IP's routing dependency.