--- title: How can I manage my Vercel DNS records? description: Add, edit, and delete Vercel DNS records from the dashboard, CLI, or REST API, and fix the Invalid Configuration error once your domain uses Vercel nameservers. url: /kb/guide/manage-vercel-dns-records canonical_url: "https://vercel.com/kb/guide/manage-vercel-dns-records" last_updated: 2026-07-27 authors: Vercel related: - /docs/cli/dns - /docs/rest-api/dns - /docs/domains/working-with-domains - /docs/domains/troubleshooting - /docs/domains/working-with-nameservers - /docs/sign-in-with-vercel/tokens - /docs/domains/domain-connect - /kb/guide/cloudflare-with-vercel - /docs/domains/managing-dns-records - /docs/domains/set-up-custom-domain install_vercel_plugin: npx plugins add vercel/vercel-plugin --- You manage Vercel DNS records from the dashboard for manual edits, and from the [CLI](https://vercel.com/docs/cli/dns) or [REST API](https://vercel.com/docs/rest-api/dns) for scripted changes. Every path shares one requirement. Your domain has to use Vercel's nameservers. If your records look correct but the dashboard still shows an Invalid Configuration error, that requirement is usually where to start. Here's how to work through it, from the prerequisite to the edge cases. ## What you need to manage Vercel DNS records Everything here assumes your domain uses Vercel's nameservers. Records you add through the dashboard, CLI, or API only take effect when your domain resolves through `ns1.vercel-dns.com` and `ns2.vercel-dns.com`. That happens when you buy the domain through Vercel, transfer it in, or point your registrar's nameserver settings at Vercel. If your nameservers point elsewhere, you manage records at that provider instead, and the steps below won't apply. Before you start, set up the access you'll use: - **A Vercel team:** Domain management happens at the [team level](https://vercel.com/docs/domains/working-with-domains). Account-linked domains keep resolving, but you'll need to move them to a team to change their records. - **The Vercel CLI or an API token:** Install the CLI with `npm i -g vercel` for terminal work, or create a personal access token or OAuth token for REST API calls. If your domain fails the nameserver check, fix that first, since nothing below behaves as described until the domain resolves through Vercel. ## Why Vercel DNS record management needs Vercel nameservers Pointing your nameservers at Vercel gives Vercel write access to your DNS zone, and that access is what several features depend on. Once your domain resolves through Vercel, you get three things that external DNS can't provide: - **Wildcard SSL certificates:** Vercel issues wildcard certificates through the [DNS-01 challenge](https://vercel.com/docs/domains/troubleshooting), which requires creating verification records in your zone. External nameservers make that impossible. - **Automatic apex and subdomain records:** Domains on [Vercel's nameservers](https://vercel.com/docs/domains/working-with-nameservers) don't need explicit records for the apex or first-level subdomains, because Vercel creates them for you. - **Domain Connect provisioning:** Third-party services can add the records they need without asking you to copy and paste values by hand. Choosing external DNS is a valid decision, but it opts you out of all three. Once your domain is on Vercel's nameservers, you can add, edit, and delete records from any interface. ## How to add, edit, and delete DNS records on Vercel The dashboard and CLI both handle interactive work, and both write to the same zone. Start with the record types Vercel supports, then use whichever interface fits the task. ### Supported DNS record types Vercel supports ten record types, several with constraints worth knowing before you use them: | Type | Use case | Notes on Vercel | | ----- | ------------------------------------------------- | -------------------------------------------------------------- | | A | Point the apex to an IPv4 address | Apex target is `76.76.21.21` | | AAAA | Point to an IPv6 address | Accepted, but Vercel doesn't support IPv6 yet | | ALIAS | CNAME-like record at the apex | Apex only; the target must resolve to an A or AAAA record | | CAA | Restrict which authorities can issue certificates | Add `0 issue "letsencrypt.org"` if you set CAA records | | CNAME | Point a subdomain to a hostname | Subdomains only, never the apex | | HTTPS | Bind a service with connection details | Supported in Vercel DNS | | MX | Route email | Vercel doesn't provide email; pair with a third-party provider | | NS | Delegate a subdomain | Used for the `_acme-challenge` delegation workaround | | SRV | Locate a service | Takes priority, weight, port, and target | | TXT | Verification, SPF, and DKIM | A `_vercel` TXT record proves domain access across accounts | Most setups only need an A record at the apex, a CNAME for subdomains, and TXT or MX records for verification and email. ### Add a record in the dashboard Adding a record in the dashboard takes four steps: 1. Open the [Vercel dashboard](https://vercel.com/dashboard), select **Domains** in the sidebar, pick your domain, and open **Advanced Settings**. 2. Select **Enable Vercel DNS** to open the DNS record form. 3. Enter the **Name** (the prefix only, such as `www`), **Type**, **Value**, and **TTL** (60 seconds by default), plus any type-specific fields such as MX priority. 4. Select **Add**. For common providers, the **Add DNS Preset** dropdown fills in a full set of records at once, such as Gmail's MX records. New records can take up to 24 hours to propagate and clear local caches. ### Edit and delete records To edit a record, open your domain from the [Domains page](https://vercel.com/~/domains), find the record in the list, and select edit. To remove an entire zone, open **Advanced Settings**, select the ellipsis (⋯), then **Delete DNS Zone**. Default records can't be deleted, though new records can override them when you need different behavior. ### Manage records from the CLI The `vercel dns` commands cover the same add, list, remove, and import operations from a terminal: `vercel dns ls [domain] # List records (20 by default) vercel dns add [domain] [name] [type] [value] # Add an A, AAAA, ALIAS, CNAME, or TXT record vercel dns add [domain] '@' MX [value] [priority] # Add an MX record at the apex vercel dns add [domain] [name] SRV [priority] [weight] [port] [target] vercel dns rm [record-id] # Remove a record by ID vercel dns import [domain] [zonefile] # Import records from a zone file` Add `--scope` or `--team` for team-scoped operations. CLI additions carry the same propagation window as the dashboard, so wait for propagation rather than re-running a command that `dig` hasn't caught up with yet. ## How to provision Vercel DNS records at scale with the REST API When your product issues domains to many tenants, clicking through the dashboard stops being practical. The REST API creates, lists, and deletes records programmatically, and Domain Connect lets third-party services add their own records for you. The DNS group of the API exposes four endpoints: `# List records GET # Create a record POST # Update a record PATCH # Delete a record DELETE ` Authenticate with a Bearer token in the `Authorization` header, and pass `teamId` or `slug` as query parameters for team resources. OAuth [access tokens](https://vercel.com/docs/sign-in-with-vercel/tokens) last one hour, and refresh tokens last 30 days and rotate on each exchange, so build token refresh into any long-running provisioning job. For third-party setups, [Domain Connect](https://vercel.com/docs/domains/domain-connect) removes manual entry. A service discovers Vercel support through a `_domainconnect` TXT query, redirects the user to Vercel with a signed URL, the user consents, and Vercel applies the records. Email providers commonly use this flow to set up their DNS. ## How to fix an Invalid Configuration error for DNS records on Vercel An Invalid Configuration error is one label sitting on top of several different causes, so a single fix often targets the wrong one. Work through the common causes in order. These six causes account for most Invalid Configuration errors: | Cause | Fix | Verify | | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | | CNAME at the zone apex | A CNAME can't coexist with the apex's required NS and SOA records. Use `A @ 76.76.21.21` at the apex and reserve CNAME for subdomains. | `dig A example.com` | | Conflicting A and CNAME at one hostname | The A record takes precedence and masks the CNAME. Remove the conflicting A record at your registrar. | `dig CNAME sub.example.com` | | Cloudflare proxy enabled (orange cloud) | Cloudflare returns its own IPs, so Vercel can't verify DNS or renew SSL. Set the record to DNS only. | `dig example.com +short` | | Missing or restrictive CAA record | A restrictive CAA can block Let's Encrypt from issuing. Add `0 issue "letsencrypt.org"`. | `dig -t CAA +noall +answer example.com` | | Domain in use by another Vercel account | Add a `_vercel` TXT record to verify access, then wait 5 to 10 minutes. | `dig TXT _vercel.example.com` | | Wildcard without Vercel nameservers | The DNS-01 challenge needs zone write access. Switch to Vercel nameservers, or delegate `_acme-challenge` with NS records. | `dig NS example.com +short` | The Cloudflare proxy case is the most common of these, and it needs a little more care. Vercel [doesn't recommend](https://vercel.com/kb/guide/cloudflare-with-vercel) running a reverse proxy in front of your deployment, because it limits the traffic visibility Vercel's security products rely on and adds latency. With the proxy on and SSL/TLS mode set to Full, you may see Cloudflare error 525 alongside a Failed to Generate Cert message in the dashboard. Switch the record to DNS only long enough for Vercel to issue the certificate, then re-enable the proxy if you need it. Nameserver and CNAME changes take 24 to 48 hours because registrar and resolver caches vary. Before a live migration, lower the TTL to 60 seconds at least 24 hours ahead so most traffic follows the new record soon after cutover. If the dashboard still reports Invalid Configuration after propagation completes, removing the domain from the project and re-adding it refreshes validation. ## How to verify Vercel DNS records before moving traffic Before you cut traffic over, confirm the records resolve at Vercel's nameserver directly rather than waiting on resolver caches. Query the authoritative nameserver and check your ownership and CAA records: `# Check an A record at Vercel's nameserver directly dig A api.example.com +short @ns1.vercel-dns.com # Confirm the _vercel ownership TXT record dig TXT _vercel.example.com # Confirm CAA records so certificate issuance succeeds dig -t CAA +noall +answer example.com` The dashboard's **Check DNS Configuration** button runs the same verification, and [whatsmydns.net](http://whatsmydns.net) shows propagation by region. Querying `@ns1.vercel-dns.com` directly tells you whether a delay lives at Vercel's nameserver or in downstream resolver caches, which changes what you do next. ## Next steps With your domain on Vercel's nameservers, your records and certificates stay in sync as you deploy. [Start a new Vercel project](https://vercel.com/new) to add and manage a domain, or [browse the templates](https://vercel.com/templates) for a framework-ready starting point. ## Related resources - [Managing DNS records](https://vercel.com/docs/domains/managing-dns-records) - [Working with nameservers](https://vercel.com/docs/domains/working-with-nameservers) - [Set up a custom domain](https://vercel.com/docs/domains/set-up-custom-domain) - [Troubleshooting domains](https://vercel.com/docs/domains/troubleshooting) - [DNS REST API](https://vercel.com/docs/rest-api/dns) ## Frequently asked questions ### Can I manage DNS records if my domain uses external nameservers? No. The dashboard DNS editor, `vercel dns` commands, and DNS REST API all require Vercel's nameservers. With external nameservers, you manage records at your DNS provider instead. Add an A record pointing to `76.76.21.21` for the apex, or a CNAME to `cname.vercel-dns-0.com` for a [subdomain](https://vercel.com/docs/domains/set-up-custom-domain). ### How do I add a wildcard domain like \\\*.[example.com](http://example.com)? Wildcard domains require Vercel's nameservers, because Vercel issues wildcard certificates through the DNS-01 challenge and needs write access to your zone. Point your nameservers at Vercel, add the apex domain, then add the wildcard in your project settings. Vercel issues a certificate for each subdomain automatically. ### How long does DNS propagation take after a change? New records can take up to 24 hours to propagate and clear local caches. Nameserver and CNAME changes can take 24 to 48 hours, since registrar and resolver caches vary. To shorten the window for a live migration, lower the record's TTL to 60 seconds about a day before you cut over. ### How do I edit an existing DNS record in the dashboard? Open the [Domains page](https://vercel.com/~/domains), select your domain, find the record in the list, and select edit. Deleting the record and adding a corrected one works too. Changes take up to 24 hours to propagate, so confirm with `dig` against Vercel's nameserver before you rely on the update.