All templates
Namecheap → Vercel DNS~8 minCW-2

Verify DNS and SSL issuance — what to check, what to do if stuck

The post-propagation checklist. Verify DNS resolved correctly, SSL issued, all variants of your domain work, and your site is genuinely production-ready.

Before you start

  • •Nameservers changed to Vercel at Namecheap (see point-namecheap-to-vercel).

Once nameservers propagate, the normal flow is: Vercel marks domain valid → SSL issues → site loads with padlock. About 90% of the time, this just works. The other 10% needs investigation. This guide walks the verification checks every CW-2 graduate should do once the domain looks live, plus the troubleshooting trees for the cases where it doesn't.

The normal flow

When everything works, this is the timeline you should see.

  • •T+0: You change nameservers at Namecheap.
  • •T+30 min to 6 hours: DNS propagates globally.
  • •T+propagation: Vercel auto-verifies domain (Valid Configuration).
  • •T+verification+5 min: SSL issues automatically.
  • •T+SSL: yourdomain.com loads with a valid SSL padlock.

The verification checklist

  1. 1.Open three terminal tabs and run these commands

    These commands tell you the truth, regardless of what your browser cache thinks.

    • •Tab 1 should output: ns1.vercel-dns.com / ns2.vercel-dns.com
    • •Tab 2 should output: a Vercel IP (e.g. 76.76.21.21 — Vercel uses a few different IPs)
    • •Tab 3 should output: HTTP/2 200 OK, with server: Vercel header
    # Tab 1: confirm nameservers point at Vercel
dig yourdomain.com NS +short

# Tab 2: confirm A record resolves to Vercel
dig yourdomain.com +short

# Tab 3: confirm SSL responds correctly
curl -I https://yourdomain.com

    If you don't have dig

    Use https://dnschecker.org instead. Type your domain, select record type, see results from servers worldwide.

  2. 2.Test the www. variant

    Open https://www.yourdomain.com in a browser. It should redirect to https://yourdomain.com (or to https://www.yourdomain.com, depending on which you set as primary).

    If it shows an error, the www. record isn't set up. Vercel → Settings → Domains → Add 'www.yourdomain.com' as a separate domain. Vercel will issue SSL for it and configure the redirect.

  3. 3.Test from a different network

    Switch your phone to mobile data. Open yourdomain.com. Does it load? This proves the site works from outside your local network, ruling out home-network DNS caching.

  4. 4.Run Lighthouse

    Open Chrome DevTools → Lighthouse tab. Select Performance, Accessibility, Best Practices, SEO. Click 'Analyze page load'.

    Aim for ≥90 in each category. Below that, you have specific issues to fix. Paste the Lighthouse report back to Claude Code with 'Fix everything below 90, smallest possible changes only.'

    Lighthouse caveat

    Lighthouse runs locally with throttled CPU and slow network. Production performance is usually better. Don't chase the last 5 points if it requires architectural changes.

  5. 5.Submit to Search Console

    Visit https://search.google.com/search-console. Add a Domain property for yourdomain.com. Verify via DNS TXT record at Vercel (Vercel → Settings → Domains → click your domain → DNS Records → Add TXT).

    Once verified, submit your sitemap (just 'sitemap.xml' in the input).

    Do this on launch day, not 'later'

    Search Console indexing alerts catch problems within hours. Setting it up after the site is live is the difference between knowing a page is broken on day two vs week six.

Stuck flows and how to debug

  1. 1.Stuck: Vercel says 'Invalid Configuration' after 24 hours

    Run the dig check from step 1 of the verification checklist.

    • •If dig shows ns1.ns.namecheap.com (old): the Namecheap save didn't take. Re-enter nameservers at Namecheap.
    • •If dig shows ns1.vercel-dns.com (new) but Vercel says invalid: click Refresh in Vercel domain row, wait 5 min.
    • •If both above fail: remove domain from Vercel, re-add. Forces re-verification from scratch.

  2. 2.Stuck: SSL fails to issue (Pending issuance for hours)

    Vercel's SSL issuance via Let's Encrypt can fail for specific reasons:

    • •CAA record blocks Let's Encrypt: check at https://www.whatsmydns.net/#CAA. If present and not allowing 'letsencrypt.org', remove or update.
    • •Rate limit hit: Let's Encrypt rate-limits SSL issuance per domain. If you've added/removed the domain repeatedly, you may have hit it. Wait 1 hour, try again.
    • •Validation challenge fails: Vercel uses HTTP-01 challenge. If your domain has any redirect or strange routing during propagation, it can fail. Wait for full propagation, then click Re-issue.

  3. 3.Stuck: site loads on HTTP but not HTTPS

    SSL hasn't issued yet. Don't try to 'force HTTPS' in your Next.js config — that creates redirect loops. Wait for Vercel SSL issuance. Once issued, HTTP→HTTPS redirect happens automatically.

  4. 4.Stuck: site loads on yourdomain.com but not www.yourdomain.com

    www. is a separate hostname needing its own DNS + SSL. Vercel → Settings → Domains → Add 'www.yourdomain.com'. Vercel sets up the record + SSL automatically. ~5 minutes.

Troubleshooting

dig isn't installed on Windows.

Use the WSL Ubuntu terminal (sudo apt install dnsutils) or use https://dnschecker.org as the web alternative. Same information, friendlier UI.

Lighthouse scores are mysteriously low.

Run it 3 times — Lighthouse has high variance, especially Performance. Take the median. Below-90 from a single run isn't a real signal.

I can't add the Search Console TXT record because Vercel doesn't show DNS records.

Vercel only shows DNS records for domains using Vercel's nameservers. If you used A/CNAME instead, add the TXT at your registrar (Namecheap's Advanced DNS section).

Want to do this with us in the room?

Bring your real project to a full-day workshop and leave with it shipped.

See the workshops