Built an app with AI and shipped it to Vercel? Your own domain takes two DNS records and about ten minutes – no developer, no migration, and nothing to install. Here are the exact records, the trap that catches almost everyone, and what to buy the domain for in Ringgit.
Open your project in Vercel, go to Settings, then Domains, and add your domain. Vercel then shows the exact values for your project. They look like this:
| Type | Name / host | Value | Why |
|---|---|---|---|
| A | @ (the root, may show blank or your domain) |
The IP address Vercel shows – 76.76.21.21 on many projects |
A root domain cannot use a CNAME. It must be an A record. |
| CNAME | www |
The host Vercel shows, e.g. abc123.vercel-dns-017.com |
Every Vercel project now has its own CNAME host. |
Copy the values your own project displays. Guides that tell you to use cname.vercel-dns.com come from older Vercel behaviour and are not always right for a project created today. Vercel’s own documentation says each project gets its own CNAME host, so a value copied from a blog post is the most common reason a domain will not verify. A CNAME at the root of a domain is not valid DNS – that is not a Vercel limitation, it is the standard.
yourdomain.com and www.yourdomain.com. Adding only one leaves half your visitors on a broken address, and Vercel will not accept a connection it does not know about.@, CNAME at www. If your panel refuses a blank host name, use your domain name or @. On Cloudflare, use the steps in the next section.Set the records up yourself – it is the fastest route, and it is the only way to keep control of them. Every domain registration includes DNS hosting you can edit directly, so nothing has to be installed and nobody has to be asked. Add the two values yourself and the change is live within minutes; you also keep them in your own project, so you can update them the next time your platform rotates an address. Handing DNS changes to someone else adds a round trip to a job that is two fields long, and it means the values live in a ticket instead of with you. If a record will not verify, take a screenshot of your DNS panel next to the values your platform shows and send it to us – we will tell you which one is wrong.
A lot of AI-built apps end up on Cloudflare because it is a free DNS host and it sits in front of many Malaysian domains already. Two ways to combine it with Vercel – pick one, do not half-do both.
This is the setup we recommend. Cloudflare answers your DNS; Vercel serves the app and issues the certificate.
@, value the IP Vercel showed. CNAME: name www, target the host Vercel showed.One caution on the proxy. Turning it back on is optional, not required. If you see certificate warnings or a redirect loop after switching, set the records to DNS only again before changing anything else – that single toggle resolves most of them.
Only do this if you actually want Cloudflare running all of your DNS. It means changing the nameservers at your registrar, and that takes every other record with it.
replit-verify, _lovable or _github-pages-challenge.Cloudflare Pages is a deployment platform, like Vercel, not a DNS setting. If you deploy there, the apex domain has to be a full Cloudflare zone – the nameservers move – and you must add the domain inside the Pages project first, because a CNAME added by hand without that returns a 522. The www record is a CNAME to your-project.pages.dev. See the platform table below for the exact values.
This is the one that costs people a day of email. Adding records is safe; pointing the nameservers at another provider takes your MX records with it. Unless you deliberately want Vercel to manage all of your DNS, change nothing but the A and the CNAME.
If your DNS sits behind Cloudflare’s proxy, set the record to DNS only (grey cloud) until Vercel has verified the domain. A proxied record cannot be validated, and this is the single most common cause of a domain that simply refuses to confirm.
Certification Authority Authorization records restrict which certificate authorities may issue for your domain. If your domain has CAA records and they do not permit the authority your platform uses, the certificate silently fails. If you have never added a CAA record, this is not your problem.
Still stuck? Re-copy both values from the project’s Domains panel and compare them character by character with what is in your DNS panel. A stale IP or an old-style CNAME host accounts for most of the failures we see, and the fix is to overwrite the value, not to add a second record.
Any extension works – DNS does not care what the name ends with, and neither does Vercel. What matters is what you pay in year two. These are the current first-year prices on the Malaysian extensions:
.my
RM9.90
first year, renews at RM110
.com.my
RM9.90
first year, renews at RM75
.net.my / .org.my
RM9.90
first year, renews at RM75
.asia
RM9.90
first year, renews at RM78
Promo windows. The RM9.90 first-year price on the .my family (.my, .com.my, .net.my, .org.my) is scheduled to end on 27 September 2026. The .asia offer runs to the end of the year, 31 December 2026. Multi-year terms and renewals are not discounted. Prefer no surprises? Ask us to confirm the renewal rate in writing before you buy – a renewal jump in year two is the complaint people raise most about domains bought for AI-built apps.
Every other extension, including .xyz at RM93 and .com at RM69 for the first year, is listed on the domain price list. The Malaysian extensions, with notes on each one, are on the .my domain page, and the regional extension has its own .asia page.
Deployment platforms have converged on the same shape: one record for the root, one for www, and sometimes a verification record. Here is what each one asks for, taken from that platform’s own documentation.
| Platform | Root domain (apex) | www / subdomain | Also required |
|---|---|---|---|
| Vercel, incl. v0 | A – the value your project shows, 76.76.21.21 on many | CNAME – your project’s own host, e.g. abc123.vercel-dns-017.com | Nothing else. Nameservers stay put. |
| Netlify (also where Bolt publishes) | ALIAS, ANAME or flattened CNAME to apex-loadbalancer.netlify.com; if your provider has none, A to 75.2.60.5 | CNAME to your-site.netlify.app | Netlify adds the apex and www together, so configure both. |
| Cloudflare Pages | The apex must be a Cloudflare zone – the nameservers move to Cloudflare | CNAME to your-project.pages.dev | Add the domain inside Pages first. A CNAME added by hand without that returns a 522. |
| Render | ANAME or ALIAS to your-service.onrender.com; otherwise A to 216.24.57.1. On Cloudflare, Render requires a CNAME | CNAME to your-service.onrender.com | Delete every AAAA record, then press Verify in Render. |
| Railway | CNAME to your-id.up.railway.app – the apex needs CNAME flattening or ALIAS, which not every DNS provider offers | The same CNAME value | The TXT verification record is mandatory. With only the CNAME you get a 404 after it resolves. |
| Fly.io | A and AAAA – the addresses fly certs add prints for your app | CNAME to your-app.fly.dev | An _acme-challenge CNAME for wildcards; a _fly-ownership TXT record if you sit behind Cloudflare’s proxy. |
| Firebase Hosting | A to 199.36.158.100 | The same A record – Firebase does not use a CNAME here | The ownership TXT record must stay, and you must remove AAAA and any other A or CNAME. |
| GitHub Pages | A to 185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153, plus the matching AAAA records | CNAME to your-username.github.io | A _github-pages-challenge-username TXT record is optional, but it stops another account taking the domain over. |
| Lovable | A to 185.158.133.1 | Added as its own entry, with its own records | A TXT record on _lovable. No AAAA records, and set everything to DNS only on Cloudflare. |
| Replit | A – the address the Domains tab shows for that domain | Every subdomain, www included, is a separate entry with its own records | The replit-verify TXT record must stay for the life of the domain, or the certificate renewal fails later. |
| Bolt | Bolt hosts and manages domains itself – connect under Settings, then Domains and Hosting, and use the values it shows | The same panel | Publishing to Netlify instead is still supported; then use Netlify’s records above. |
Two rules that apply to all of them. A verification TXT record is permanent, not a setup step – Replit, Railway, Firebase, Lovable and GitHub Pages all renew certificates off it, and deleting it after launch makes the site serve an expired certificate weeks later. And a plain CNAME is never valid at the root of a domain; use an A record, or ALIAS, ANAME or flattening where your provider offers it.
Sources, so you can check us: Vercel, Netlify, Cloudflare Pages, Render, Railway, Fly.io, Firebase, GitHub Pages, Lovable and Replit.
No, and for most people you should not. Vercel’s own documentation notes that changing only the website’s A or CNAME record at your current DNS provider does not require moving the rest of your DNS records. The nameservers ns1.vercel-dns.com and ns2.vercel-dns.com are only for people who want Vercel to manage everything.
Not if you only add the A and CNAME records – those do not touch your MX records, so mail keeps flowing. It breaks the moment you point the nameservers elsewhere without first recreating your MX and TXT records at the new provider.
Almost always one of three things: the CNAME value is the old generic host instead of the project-specific one Vercel showed you, the Cloudflare proxy is switched on so the record cannot be validated, or an old record for the same name is still present alongside the new one. Delete the stale record rather than adding a second one.
No. A CNAME at the apex is not permitted by the DNS standard. Use an A record for the root – that is what Vercel asks for anyway.
Usually 5 to 15 minutes, occasionally a few hours while cached records expire. Once the records resolve, the certificate is issued automatically and can take another 5 to 30 minutes.
Yes. Add both in Vercel and create both records – the A at the root and the CNAME for www. Adding only the root is the single most common half-finished setup we see, and it leaves anyone typing www in front of your name on a broken address.
Yes. A domain is a domain for DNS purposes – the extension does not change what you paste into the DNS panel, and Vercel does not care which one you chose.
No. Vercel serves your site directly and handles HTTPS. If your DNS already sits behind Cloudflare for other reasons, set the records to DNS only while you connect the domain, then decide later whether you want the proxy on.
Malaysian extensions currently start at RM9.90 for the first year – .my renews at RM110, and .com.my, .net.my and .org.my renew at RM75. The .asia first-year offer runs to the end of 2026 and renews at RM78. Renewals are not discounted, so the year-two price is the number to check before you commit, and you can ask us to confirm it in writing.
Set it up yourself – it is two records, about ten minutes, and nothing to install. Your domain comes with DNS hosting you can edit directly, and doing it yourself means the values stay in your own project where you can change them the next time your platform rotates an address. If a record will not verify, send us a screenshot of your DNS panel alongside the values your platform shows and we will tell you which one is wrong.
Not to connect a domain – you can add the two records wherever your DNS already lives. Move to Cloudflare only if you want it managing every record, and then copy your MX, SPF, DKIM and DMARC across first, because switching nameservers takes them with it. If Cloudflare already runs your DNS, see the Cloudflare section above.
You have the domain and the deployment. These are the layers that usually come next for an AI-built product.
Tell us what you are building and we will point you at the extension that fits, in Ringgit, with the renewal price up front. If a record will not verify, send a screenshot of your DNS panel and we will tell you which value is wrong.
Prefer WhatsApp? Message us on +60 11-5581 8160 and we will help you work out which record is off.