Custom domain on Vercel stuck on "Invalid Configuration"
Filed under Deployment failures
Your domain's DNS records do not match the values Vercel expects — typically records left over from a previous host, a missing record, or a DNS proxy interfering with verification.
Fastest route
Give your AI this prompt
Copy it, replace the bracketed part with your error, and send it.
Preview the prompt
I added a custom domain to my Vercel project and it is stuck on "Invalid Configuration" (or shows a DNS / 404 problem). My domain is [your domain]. My DNS is managed at [registrar / Cloudflare / other]. In Vercel's Domains settings, the expected records shown are: [paste what Vercel says it expects]. The DNS records currently set for my domain are: [list the A, AAAA, and CNAME records for the root and www from your DNS screen — these are public records, safe to paste]. Please: 1) compare the two lists and tell me exactly which records to add, change, or delete, one by one, 2) flag anything that looks like a leftover from an old host or a conflicting record, 3) tell me whether a Cloudflare proxy setting could be interfering and what to set it to while verifying. Constraints: do not tell me to change anything in my app code, do not suggest touching MX or email records, and warn me before suggesting I delete any record you cannot identify.
Fix it yourself
Follow the repair
- Read Vercel's exact complaint before touching DNS. In your Vercel project, open Settings, then Domains, and click the domain showing the error. Vercel displays what it expects and what it found — expected record type and value on one side, current reality on the other. Screenshot it if it helps. Every change you make should move the "found" column toward the "expected" column; generic blog-post values are a fallback, not the source of truth.
- Set the records exactly as Vercel specifies. Go to wherever your DNS is actually managed — your registrar, or Cloudflare if you moved it there — and enter the records. The standard Vercel setup is:
If your Vercel dashboard shows different values for your domain, copy those instead — Vercel's instructions for your account outrank any written guide, including this one.Root domain (example.com): Type: A Name: @ Value: 76.76.21.21 www subdomain (www.example.com): Type: CNAME Name: www Value: cname.vercel-dns.com - Delete conflicting records left by the old host. In the same DNS screen, look for other records answering for the same names: a second A record for the root, any AAAA record you do not recognise, a CNAME for www pointing at a builder or old host, registrar "parked" entries. Two live answers for one name is precisely what "Invalid Configuration" means. Remove the stale ones so each name gives exactly the answer from step 2. (Leave unrelated records — email MX records especially — untouched.)
- If your DNS is on Cloudflare, switch the proxy off while verifying. Click the orange cloud next to these records so they read "DNS only" (grey). With the proxy on, the world — including Vercel — sees Cloudflare's addresses instead of your records, and the certificate Vercel tries to issue can fail. Keep it off until the domain verifies and the site loads cleanly; whether to proxy afterwards is a separate decision you can make with a working site in hand.
- Wait for propagation, then re-check the dashboard. DNS changes spread as caches around the internet expire their stored answers. Most domains verify within minutes to a couple of hours; Vercel re-checks on its own and issues the HTTPS certificate once the records look right, so the error clears itself. A free DNS checker will show you the answers different regions are getting. But set a limit: if 24 hours pass unchanged, propagation is not your problem — a record is still wrong, and step 3 deserves a second, slower look.
- Pick one primary address and let the other redirect. Root domain and www are both "your site," but logins, cookies, and analytics treat them as different places. In Vercel's Domains settings, choose the one you actually say out loud — most people pick the root — as the primary, and let the other redirect to it. One canonical address, no split personality, and shared links always land in the same place.
Why this happensOptional explanation
A custom domain works because of DNS records — the internet's address book — that you manage wherever your domain is registered or hosted. When you add a domain to Vercel, Vercel looks up those records and checks whether they send visitors to Vercel's network. "Invalid Configuration" is the verdict when the lookup disagrees: the record Vercel needs is missing, points somewhere else, or has competition.
Competition is the usual story. Domains accumulate history: an A record from the WordPress host you left, a CNAME from a website builder trial, a "parked" page record the registrar added by default, an AAAA record nobody remembers creating. Each name can only give one consistent answer, and while an old record and a new record disagree, Vercel quite correctly refuses to claim the domain. The other classic is a helpful middleman: Cloudflare's proxy, switched on, answers DNS lookups with Cloudflare's own addresses, so Vercel cannot see the records you so carefully entered — and cannot complete the certificate process it runs before serving your site over HTTPS.
- Leftover records: your old host, a builder, or a registrar parking page still claims the same name.
- Missing half: www is configured but the root domain is not — they are separate records, always.
- Proxy in the way: Cloudflare's orange cloud hides the real answers and can block certificate issuing.
- Simple propagation: everything is right, but cached old answers have not expired yet — the only cause fixed by time alone.
Quick answers
How long should I wait for DNS to propagate?
In most cases minutes to a couple of hours. Vercel re-checks on its own, and DNS changes spread as old cached answers expire — which is why a domain can look broken to you and fine to someone else for a while. If nothing has changed after 24 hours, a record is wrong somewhere; do not just keep waiting past that.
Vercel says the domain is valid but browsers show a certificate warning. Why?
Usually a timing or proxy issue: the certificate is issued right after verification completes, so give it a few minutes after the domain shows valid. If Cloudflare's proxy sits in front of the domain, its own certificate handling can interfere — keep the proxy off until the site loads cleanly over HTTPS, then decide whether to re-enable it.
www works but the root domain doesn't (or the other way round). Why?
Because DNS is per-name, not per-project. The root (apex) name and www are separate records pointing at Vercel in different ways — an A record for the root, a CNAME for www. Configuring one never configures the other, so set both, and choose one as the primary in Vercel with the other redirecting to it.