Custom domain TLS handshake times out via proxy paths, while Vercel domain works
Hello Vercel Community,
I'm experiencing a reproducible HTTPS connectivity issue with my Vercel-hosted custom domain and would appreciate help from a Vercel networking or edge infrastructure engineer.
Project information
- Project:
pixlena-games - Custom domain:
game.pixlena.com - Working Vercel domain:
project-jx2nn.vercel.app - DNS provider: Spaceship
- CNAME:
f9ebe799bca9584e.vercel-dns-017.com - Test date: October 16, 2026
Domain configuration
The Vercel Support Agent has already confirmed:
- Valid DNS configuration
- Valid Let's Encrypt SSL certificate
- Correct DNSSEC and CAA configuration
- Valid production domain binding
- Successful HTTP 200 responses from its test location
Reproduction results
I conducted controlled tests using Windows curl 8.21.0 through a local HTTP proxy (127.0.0.1:10808).
- Direct access to
https://game.pixlena.com/favicon.pngsucceeds with HTTP 200 and downloads the expected 1,367-byte image. - Through proxy paths using nodes labeled Japan and Singapore, the same custom domain consistently times out after approximately 10 seconds, before receiving an HTTP response.
- Through those same proxy paths,
https://project-jx2nn.vercel.app/favicon.pngreturns HTTP 200. - Using curl's
--connect-toto target64.29.17.1and216.198.79.1:- HTTPS hostname/SNI
game.pixlena.com: timeout. - HTTPS hostname/SNI
project-jx2nn.vercel.app: HTTP 200.
- HTTPS hostname/SNI
- A deliberate SNI/HTTP Host mismatch returned HTTP 421 with
X-Vercel-Mitigated: deny. This was a synthetic diagnostic request and is not evidence that legitimate requests are being blocked.
The proxy exit countries have not been independently verified. Also, HTTP CONNECT 200 does not by itself confirm that the upstream TCP connection was established successfully.
Because the failure occurs even with a static PNG request before an HTTP response is received, it does not appear to be caused by the Next.js application code.
Request for assistance
Could a Vercel engineer help investigate:
- Whether TLS/SNI handling or certificate distribution differs across Vercel edge locations.
- Whether edge security or network routing could contribute to this behavior.
- Whether the issue is caused by a specific network path, an upstream intermediary, or Vercel edge infrastructure.
- What additional diagnostics or officially supported configuration changes would help resolve it.
I can provide redacted curl verbose logs, timestamps, screenshots, and connectivity diagnostic results.
I would prefer not to change production DNS or redeploy the application without evidence identifying the underlying problem.
Thank you!