Plan: Hobby

Issue: None of my custom domain's hostnames (root, www, and several subdomains across multiple separate projects on the same account) are reachable over HTTPS - the TLS handshake is reset by the edge before any server response, even though every diagnostic I can run shows correct configuration:

• DNS is correct and has been fully propagated for several days (verified via an external DoH resolver): root domain has an A record to Vercel's shared IP, each subdomain has a CNAME to its own *.vercel-dns-017.com target, all resolving to Vercel's anycast IPs as expected.
• The dashboard shows "Valid Configuration" for every domain entry.
• vercel certs ls shows valid, unexpired certificates for all affected hostnames.
• I removed and re-added the domain pair in the dashboard to force revalidation - it re-added cleanly, still shows "Valid Configuration," still unreachable.
• I force-issued a brand new certificate via the CLI (vercel certs issue) - succeeded immediately with a fresh 90-day cert. TLS still resets right after.
• Direct diagnostic: connecting straight to a Vercel edge IP with curl --resolve and sending a TLS ClientHello with my domain as SNI gets an immediate "Connection reset by peer" - no ServerHello, no certificate at all. The exact same IP, same request, but with a *.vercel.app hostname as SNI instead, completes the TLS handshake correctly and returns the expected wildcard cert. Same reset result on a second anycast IP, testing a different subdomain on a completely different project.
• No CAA restrictions on the domain.
• No duplicate domain registration across teams/scopes - registered exactly once.
• Checked vercel-status.com - no active incidents.

Summary: Config, DNS, and certificate issuance all appear correct and Vercel's own tooling confirms it, but the edge network is actively resetting TLS connections for every hostname under this domain, across multiple unrelated projects on the same account, while unrelated *.vercel.app hostnames work fine on the identical edge IP at the same moment. This looks like a stuck/broken edge routing or SNI-cert-binding state on Vercel's side that isn't visible or fixable from the dashboard or CLI - similar to reports others have posted here where a Vercel staff member had to manually re-bind the certificate at the edge. Could someone from the team take a look?