Custom domain TLS connection reset persists after fixing DNS conflict — needs edge/cert review - Help

I'm seeing a persistent outage on two custom domains under my team (nh-lacrosse) — nhlacrosse.com (project nhlacrosse) and nvelope.app (project nvelope) — while a third domain on the same account (nathanielhunt.com) works fine.

Symptoms:

HTTPS requests to the affected domains fail with a TLS connection reset during the ClientHello (before any certificate exchange). Plain HTTP (port 80) returns a 503 from the edge. The underlying deployments are completely healthy — hitting the *.vercel.app URLs for these same projects returns 200 with no issues.

What I've done:

Found and removed a leftover wildcard CNAME record at my registrar (*.nhlacrosse.com → uixie.porkbun.com) that was intercepting _acme-challenge.nhlacrosse.com. Confirmed removed by querying the authoritative nameserver directly. Removed and re-added the domain from the Vercel project, then re-created the alias to the current production deployment — twice, once before and once after the DNS fix. Even after the DNS fix, connecting directly to the edge IP (216.198.79.1) with the correct SNI hostname via curl --resolve still resets the connection. The SSL certificate for the domain shows the same cert ID and age from before all of this — it doesn't appear to have been reissued despite the remove/re-add cycles. No incidents reported on vercel-status.com.

This looks like a stuck edge routing/certificate state for these specific domains rather than a DNS or config issue on my end at this point. I'm on the Hobby plan, so I don't have access to a direct support ticket for this problem area — hoping someone from the team or community has run into this before. Happy to provide more diagnostic output if helpful.

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

https://vercel.com/docs/domains/troubleshooting

vercel.com

Troubleshooting domains

Learn about common reasons for domain misconfigurations and how to troubleshoot your domain on Vercel.

Update: I ran Let's Debug (letsdebug.net) against nhlacrosse.com using their HTTP-01 API — result: {"ok":true}, no issues found. This confirms Let's Encrypt's ACME validation path works completely fine for this domain, which rules out DNS/certificate issuance as the cause (I understand Vercel's edge intercepts /.well-known/acme-challenge/* requests through a separate path from normal site routing, and that path is healthy).

This means the problem is isolated specifically to Vercel's normal HTTPS/HTTP request routing for this domain — not DNS, not the certificate, not ACME validation. The domain still returns a TLS reset on 443 and a 503 on port 80 for regular traffic, while the ACME challenge path and the deployment's own *.vercel.app URL both work fine.