How to Configure Custom Domains, Including the Apex Record Problem
Pointing a domain at a host is four DNS records and usually works first try. The parts that generate support tickets are narrower and predictable: you cannot put a CNAME on an apex domain, TLS certificates need the DNS to already resolve before they can be issued, and picking `www` versus bare is a decision you should make once rather than support both.
This guide covers the records, the ordering, and the specific traps.
Pick one canonical hostname and redirect the other
`example.com` and `www.example.com` are different origins. Serving both without redirecting splits your SEO signals, doubles your cookie surface, and produces caching bugs that only reproduce on one of them.
- ›Choose one. `www` is technically easier because it can be a CNAME, which lets your host change IPs without you touching DNS.
- ›301 the other one to it at the edge, not with a meta refresh or JavaScript.
- ›Make the canonical hostname consistent everywhere: sitemap, canonical tags, OAuth callbacks, cookie domain, and any hardcoded absolute URLs.
- ›Set DNS first, then request the certificate. Providers verify by resolving the name, so the order isn't optional.
- ›Lower the TTL a day before any planned move, so a mistake takes minutes to correct instead of hours.
The approaches
Apex domains: A records, ALIAS, or ANAME
// best for: Anyone who wants `example.com` without `www` to work.
- Cloudflare
- AWS
- Vercel
- Netlify
- DigitalOcean
The DNS spec forbids a CNAME coexisting with other records at the same name, and an apex domain must have SOA and NS records. So `example.com` cannot be a CNAME. This is the single most common DNS confusion, and the error messages rarely explain it.
There are two ways out. You can use A records pointing at your host's IPs, which works but breaks silently if the host changes them. Or you use a provider-specific flattening record — Cloudflare calls it CNAME flattening, Route 53 calls it an ALIAS, others call it ANAME — which behaves like a CNAME at the apex by resolving it server-side and returning the resulting A records.
Flattening is the right answer wherever available. Your host can rotate infrastructure without breaking you.
# Illegal: a CNAME cannot coexist with the SOA/NS records
# that every apex domain must have.
example.com. CNAME cname.vercel-dns.com. # rejected
# Option A — flattening (Cloudflare / Route 53 ALIAS / ANAME):
example.com. CNAME cname.vercel-dns.com. # resolved server-side
www.example.com. CNAME cname.vercel-dns.com.
# Option B — A records. Works, but breaks silently
# if the host ever changes its IPs.
example.com. A 76.76.21.21The gotcha
Leftover records from a previous host. An old A record alongside a new CNAME means DNS round-robins between them, so the site works for some visitors and 404s for others — and it looks like intermittent caching rather than a DNS problem. Delete old records before adding new ones.
TLS certificate provisioning
// best for: Every domain. There is no reason to serve plain HTTP.
- Cloudflare
- Vercel
- Netlify
- AWS
- Railway
- Render
Nearly every platform provisions Let's Encrypt certificates automatically once the domain resolves to them, then renews without intervention. The dependency is one-directional and worth internalizing: DNS must be correct first, because issuance works by proving control through the DNS or an HTTP challenge.
Wildcard certificates require the DNS-01 challenge, which means the issuer needs API access to create a TXT record in your zone. That's why wildcards generally require your DNS to be hosted somewhere the platform integrates with.
If you use Cloudflare in proxy mode, there are two certificates: Cloudflare to visitor, and Cloudflare to your origin. Setting SSL mode to Flexible terminates TLS at Cloudflare and talks plain HTTP to your origin, which means the padlock is a lie. Use Full (strict).
The gotcha
Cloudflare's Flexible SSL mode with a host that redirects HTTP to HTTPS produces an infinite redirect loop: Cloudflare requests over HTTP, the origin redirects to HTTPS, Cloudflare follows and requests HTTP again. The site is completely down and the DNS looks correct.
Subdomains and multi-tenant domains
// best for: Per-customer subdomains, or letting customers bring their own domain.
- Cloudflare
- Vercel
- AWS
- Netlify
Per-tenant subdomains (`acme.yourapp.com`) are straightforward: one wildcard DNS record and a wildcard certificate, then route on the `Host` header. Most platforms support wildcard domains directly.
Customer-supplied domains are meaningfully harder. Each needs its own certificate, issued on demand after the customer points DNS at you, and you need to detect when that DNS is correct so you can trigger issuance. Platforms like Vercel expose an API for exactly this; building it yourself means running an ACME client and storing certificates.
The operational reality is that customers misconfigure DNS constantly, so a status page showing exactly which record is wrong pays for itself in support time.
The gotcha
Wildcard certificates cover one level only. A cert for `*.example.com` does not cover `a.b.example.com`, and the failure is a browser security warning rather than a helpful error. Nested subdomains need their own wildcard.
Common pitfalls
Serving both www and apex without redirecting
Two origins serving identical content splits ranking signals, and cookies set on one aren't visible on the other — so users appear logged out depending on which they typed. Pick one, 301 the other.
High TTL during a migration
A 24-hour TTL means a mistake is visible to some visitors for a day. Drop TTL to 300 seconds a day before any change, migrate, confirm, then raise it back.
Assuming propagation is instant
Resolvers cache for the previous TTL, so it works for you and not for a colleague. Check with `dig @8.8.8.8` and `dig @1.1.1.1` rather than trusting your own browser, which may also be caching at the OS level.
Forgetting email records when moving DNS
Changing nameservers moves the entire zone. If MX, SPF, DKIM, and DMARC records aren't recreated at the new provider, email stops — and the failure is silent to you and visible to everyone emailing you. Export the full zone first.
Questions people actually ask
Why can't I use a CNAME on my root domain?
DNS forbids a CNAME coexisting with other records at the same name, and an apex must have SOA and NS records. Use your provider's flattening equivalent — CNAME flattening, ALIAS, or ANAME — or A records.
www or no www?
Either, consistently. `www` is technically easier because it can be a real CNAME, letting your host change IPs without DNS edits. Bare looks cleaner. What matters is picking one and redirecting the other.
How long does DNS propagation take?
Bounded by the previous TTL, since resolvers cache until it expires. New records appear in minutes; changed records take up to the old TTL. Lowering TTL in advance is what makes a migration fast.