Point Namecheap Domain to Vercel: Apex DNS and SSL Setup Guide

Hooking up a custom domain to Vercel should take two minutes. But Namecheap’s default parking records and apex DNS quirks often cause redirect loops or stuck SSL certificates. I hit this exact headache moving a production Next.js frontend to Vercel while trying to keep our existing Google Workspace email running on Namecheap BasicDNS.

Here is how to configure your apex domain and subdomains in Namecheap Advanced DNS, set up clean edge redirects in Vercel, and verify the Let’s Encrypt SSL certificate without breaking email.

The Apex vs Subdomain DNS Dilemma on BasicDNS

DNS specs (RFC 1912) don’t let you stick a CNAME on an apex domain (your root domain like example.com). That’s because the apex must hold SOA and NS records, and a CNAME can’t live alongside other records on the exact same host label.

Some providers offer “CNAME flattening” or ANAME/ALIAS records to fake it. Namecheap BasicDNS doesn’t support ANAME records on apex hosts unless you switch nameservers entirely. So pointing an apex domain from Namecheap to Vercel means using a static Anycast A record for the root, and a standard CNAME for the www subdomain.

If you’ve previously set up records for other hosts, like when you point a Namecheap domain to GitHub Pages, you know that leftover default records from Namecheap will fight your new setup every time.

Step 1: Add Your Custom Domain to the Vercel Project

Before touching anything in Namecheap, configure your canonical domain inside Vercel. Vercel needs this to issue certificates and wire up edge routing.

1. Open your Vercel dashboard and jump into your project.
2. Go to Settings > Domains.
3. Type your root domain (like yourdomain.com) and click Add.

Vercel will prompt you for a redirect strategy. Pick Recommend: Redirect yourdomain.com to www.yourdomain.com (or the other way around if you prefer root as canonical). This automatically adds both variants to your project and applies a 308 permanent redirect at the edge, so you don’t have to write custom middleware in Next.js.

You’ll see an “Invalid Configuration” badge right away alongside the target DNS records:

• Apex (yourdomain.com): Type A, Value 76.76.21.21
• Subdomain (www.yourdomain.com): Type CNAME, Value cname.vercel-dns.com.

Step 2: Clean Up Namecheap Default Parking Records

Fresh domains on Namecheap ship with active parking records and URL frame redirects. If you don’t nuke these first, half your visitors will hit a Namecheap ad page while the rest hit your app.

Log in to Namecheap, go to Domain List, hit Manage next to your domain, and open the Advanced DNS tab. Scroll down to the Host Records table.

Delete these default rows if they exist:

• CNAME Record | Host: www | Target: parkingpage.namecheap.com.
• URL Redirect Record | Host: @ | Target: http://www.yourdomain.com

Leave your MX records alone if you already have email configured. If you need to wire that up later, check out our guide to route custom domain email to Google Workspace with Namecheap DNS.

Step 3: Add Vercel A and CNAME Records in Namecheap

Now add the two records Vercel is waiting on under Host Records in Namecheap Advanced DNS.

Click Add New Record for the apex A record:

• Type: A Record
• Host: @
• Value: 76.76.21.21
• TTL: Automatic (or 1 min if you want rapid changes)

Click Add New Record again for the www CNAME:

• Type: CNAME Record
• Host: www
• Value: cname.vercel-dns.com.
• TTL: Automatic

Hit the green checkmark to save each entry. The final table should look like this:

Type Host Value TTL A Record @ 76.76.21.21 Automatic CNAME Record www cname.vercel-dns.com. Automatic

Step 4: Verify DNS Propagation via Terminal

Skip spamming the “Refresh” button on Vercel. Query public resolvers directly using dig to see what’s actually published.

Check if your apex domain resolves to Vercel’s Anycast IP:

dig A yourdomain.com +short @8.8.8.8

You should see:

76.76.21.21

Then verify the www CNAME target:

dig CNAME www.yourdomain.com +short @1.1.1.1

The output must resolve to Vercel’s endpoint:

cname.vercel-dns.com.

If the answer section is empty or returns stale IPs, Namecheap’s DNS is still syncing. In practice, Namecheap BasicDNS updates propagate to Google (8.8.8.8) and Cloudflare (1.1.1.1) resolvers within 3 to 7 minutes on Automatic TTL.

Fixing SSL Certificate Generation and CAA Errors

Once DNS resolves, Vercel initiates an ACME challenge via Let’s Encrypt or ZeroSSL as outlined in the Vercel Custom Domains Documentation.

If the dashboard hangs on “Generating SSL Certificate” and throws an error, you probably have a restrictive Certification Authority Authorization (CAA) record blocking Let’s Encrypt.

Check your domain’s CAA records with dig:

dig CAA yourdomain.com +short

If records specify another CA (like Sectigo or DigiCert) without an allow rule for Let’s Encrypt, the cert order will fail. To fix it, add a CAA record in Namecheap Advanced DNS:

• Type: CAA Record
• Host: @
• Value: 0 issue "letsencrypt.org"

You can check syntax details in the Let’s Encrypt CAA Documentation. Once saved, click Refresh in Vercel. The cert usually provisions within 60 seconds.

Configuring Subdomains and Staging Environments

For preview branches or staging environments (like staging.yourdomain.com or app.yourdomain.com), you just need standard CNAMEs. If you deploy heavier backend services elsewhere, you can also deploy Next.js on a VPS for specific microservices alongside Vercel.

To point a standard subdomain to Vercel:

1. In Vercel under Settings > Domains, add app.yourdomain.com.
2. In Namecheap Advanced DNS, add a new CNAME Record.
3. Set Host to app and Value to cname.vercel-dns.com..

For multi-tenant SaaS platforms needing dynamic subdomains, you can set up wildcard subdomains in Namecheap DNS by pointing host * to Vercel’s CNAME endpoint.

Testing SSL Handshake and HTTP Redirects

Once Vercel shows green checkmarks across both domains, test the redirect and TLS handshake directly from your terminal using curl.

Inspect the apex response headers:

curl -I https://yourdomain.com

You should see a clean 308 Permanent Redirect pointing to your canonical domain:

HTTP/2 308
location: https://www.yourdomain.com/
server: Vercel
x-vercel-id: iad1::iad1::5x8w9-1710928410291-a67bd4a3e210

Then hit the canonical URL to verify the 200 OK status over TLS:

curl -I https://www.yourdomain.com

If records haven’t propagated after 30 minutes, double-check your host settings against the Namecheap Host Records Knowledgebase.

Frequently Asked Questions

Can I point Namecheap nameservers directly to Vercel?

Yes. If you’d rather let Vercel manage all your DNS records, switch your nameservers in Namecheap from Namecheap BasicDNS to Custom DNS and enter ns1.vercel-dns.com and ns2.vercel-dns.com. Just remember that doing this moves email DNS management out of Namecheap, so you’ll need to re-create your MX records inside Vercel.

Why does Vercel say “Conflicting DNS Records”?

This happens when you have both an A record and a CNAME record assigned to the same host (like @ or www), or when Namecheap’s default URL Redirect records are still sitting in your table. Delete all other records for that host and keep only the single A record (for apex) or CNAME (for www).

Does changing DNS to Vercel affect my domain email?

No, as long as you only edit the A and CNAME records for web traffic. Your MX, TXT (SPF/DMARC), and DKIM records stay untouched on Namecheap BasicDNS and continue routing mail without interruption.

How long does SSL validation take on Vercel?

Once DNS resolves globally to 76.76.21.21 or cname.vercel-dns.com, Vercel issues the certificate in about 30 to 90 seconds. If it takes longer than 15 minutes, check for restrictive CAA records or stale AAAA records pointing to an old server.

Next Steps for Your Vercel Stack

Your custom domain is live on Vercel with automatic Let’s Encrypt TLS certificates and edge-level redirects. If you plan to send transactional emails from your custom domain or connect transactional auth services, make sure you configure your email authentication records properly next.