Cloudflare and Vercel DNS Checklist
Connecting a Cloudflare-managed domain to Vercel is usually simple, but small DNS details can create confusing symptoms: the apex works while www fails, SSL is pending, or Cloudflare proxy mode changes what the origin sees.
Check the apex and www separately
The root domain and www hostname are different DNS names. A successful apex configuration does not prove that www has a valid CNAME or redirect target.
dig example.com A +short
dig www.example.com CNAME +short
dig @1.1.1.1 www.example.com CNAMEUnderstand Cloudflare proxy mode
- DNS only exposes the DNS target directly and is usually easiest during initial validation.
- Proxied records return Cloudflare edge IPs instead of the origin target.
- Vercel domain validation may need the exact record that Vercel requested.
- SSL certificate generation can lag behind DNS propagation.
Verify before changing redirects
Set the domain in Vercel, wait for a valid configuration, then decide whether www should redirect to the apex or the apex should redirect to www. Test both hostnames over HTTPS.
curl -I https://example.com
curl -I https://www.example.comCommon setup mistakes
Only adding the apex record
The www hostname needs its own CNAME or redirect configuration.
Switching proxy mode too early
It can make validation and troubleshooting harder while SSL is pending.
Expecting CNAME at every apex
Some providers use flattened CNAME, ALIAS or A records for root domains.
Testing from one resolver
One DNS cache can update before others.