Vercel “Invalid Configuration” (Custom Domain)

What’s actually happening

The domain sits in Project Settings > Domains with a red “Invalid Configuration” badge instead of the green “Valid Configuration.” The site either 404s, shows another host’s content, or never gets an SSL cert (browser throws a cert warning). Vercel keeps showing the exact record it wants right under the badge. Refreshing the page doesn’t clear it because the problem is at your DNS provider, not on Vercel.

Common causes

• Apex domain has no A record pointing to 76.76.21.21, or points somewhere else (old host, parking page).
• www is pointed with the wrong record type — an A record or a CNAME to the bare apex instead of cname.vercel-dns.com.
• A leftover record from the previous host (old A, AAAA, or a CNAME at the apex) is conflicting with the new one. Vercel doesn’t support IPv6, so a stray AAAA record breaks resolution.
• The domain is still attached to another Vercel team/account, so Vercel wants a TXT verification record before it will validate.
• DNS hasn’t propagated yet — the old record’s TTL hasn’t expired.

How to fix it

1. Read the exact records Vercel is asking forIn Project Settings > Domains, click the domain. Vercel prints the literal A value (76.76.21.21) for the apex and the CNAME target (cname.vercel-dns.com) for www. Don’t guess — copy what’s shown, since the plan/region can change it.
2. Check what your DNS actually serves right nowRun dig a example.com +short and dig cname www.example.com +short. If the apex doesn’t return 76.76.21.21, or www doesn’t return cname.vercel-dns.com, that’s the gap. dig a example.com showing an old IP means the previous host’s record is still live.
3. Delete conflicting records, then add the right onesAt your DNS provider, remove any existing A/AAAA/CNAME on @ and www that don’t match Vercel. Add A @ 76.76.21.21 and CNAME www cname.vercel-dns.com. Never put a CNAME on the apex — RFC 1034 forbids a CNAME coexisting with the NS/MX records a zone apex needs, and Vercel will reject it.
4. Add the TXT record if Vercel asks for domain verificationIf the domain is in use elsewhere, Vercel shows a _vercel TXT challenge. Add it exactly as given; once it resolves, the domain moves to your project and validates.
5. Wait out propagation, then hit RefreshIf records are correct but still flagged, the old TTL hasn’t expired. Watch one record on dnschecker.org across regions; when it’s consistent, click Refresh on the Vercel domain row. SSL issues automatically once the A/CNAME resolves.