Skip to main content
Custom domains are TLS-terminated for you — there’s no proxy to set up, no certificate to manage. The trade-off is that the platform needs to prove you own the domain and see your DNS pointing at it before it’ll start serving traffic.

​
What the records mean

The verification_records array on a freshly-connected domain contains one or more entries. Each entry is one DNS record you need to publish.
typeWhy it’s there
AApex domain (acme.com) routing — value is the IP edge addresses traffic should hit.
CNAMESubdomain routing (scans.acme.com, support.acme.com) — value is the host edge addresses traffic should hit.
TXTOwnership proof for domains that already exist on another account. Less common — only appears when the upstream needs explicit ownership confirmation.
The records returned are upstream-specific. Always read them from verification_records on your response — don’t hard-code IPs or hostnames.

​
Apex vs subdomain

The domain shape determines which record you publish: 
Type:  A
Name:  @          (or acme.com — depends on provider)
Value: 76.76.21.21
TTL:   3600
Apex domains are auto-paired with a www.<apex> 308 redirect — point www at the same CNAME target and visitors to either form land on the canonical apex.

​
Propagation

DNS changes propagate at the speed of your provider’s TTL. Common timings:
  • Cloudflare, Vercel DNS, Route 53: under 5 minutes
  • Squarespace, GoDaddy default: 10–30 minutes
  • Cached intermediaries (some corporate networks): up to ~24 hours
The platform polls every few minutes for the first hour after connect, so the domain often flips to verified without you doing anything. If you want a faster signal, call POST /custom-domains/{id}/verify after publishing the records — it’s safe to retry as often as you like.

​
Troubleshooting

DNS hasn’t propagated yet. Confirm the records resolve with dig:
dig +short acme.com A
# → 76.76.21.21

dig +short scans.acme.com CNAME
# → cname.vercel-dns.com.
If these return nothing or the wrong value, the record isn’t live yet — give it more time or check your DNS provider’s UI.

​
Once verified

Once verified: true, the TLS cert provisions in the background (usually within 30 seconds) and the domain starts serving traffic. Visitors hitting the hostname see whatever you’ve configured via Custom Domain Routes. A verified domain with no routes returns a generic “domain configured but no routes” placeholder. Set up at least one route — typically a default route at slug "" — to start serving content.