Hi everyone! Hoping someone can point me in the right direction on a tricky one. 🙏

Three of my custom subdomains (same apex, DNS at GoDaddy, each CNAME'd to its Vercel <hash>.vercel-dns-017.com target, all showing "Valid Configuration") intermittently time out on load, while the project's *.vercel.app URL always works perfectly. Happy to share the exact domains/account privately with a staff member.

To save everyone some back-and-forth, here's what I've already tested (so we can skip these and dig into the real cause):

• Reproduced from several different networks and devices — not just my machine.
• Flushed local DNS cache (ipconfig /flushdns) and retested over several days.
• No corporate VPN, proxy, or antivirus in the path.
• Waited well past 48h; the records are stable.
• The Vercel dashboard shows "Valid Configuration" for all three.

Here's what I found, which is where I'd love a second pair of eyes: the target <hash>.vercel-dns-017.com resolves — depending on the moment — to EITHER IPs that don't answer on port 443, OR IPs that do. So roughly half the time the site loads instantly, and the other half it hangs until timeout.

To take DNS/browser/cache out of the equation entirely, I opened a plain TCP socket straight to each IP on port 443 (4 times each):

216.198.79.1 -> FAIL FAIL FAIL FAIL (dead on 443) 64.29.17.1 -> FAIL FAIL FAIL FAIL (dead on 443) 216.198.79.65 -> OK OK OK OK (works) 64.29.17.65 -> OK OK OK OK (works) 76.76.21.93 -> OK OK OK OK (works — legacy range used by *.vercel.app) 66.33.60.194 -> OK OK OK OK (works)

What makes me think it's on the edge side rather than mine: 216.198.79.1 and 216.198.79.65 are in the SAME /24, yet .1 is dead and .65 works. A routing issue on my end would knock out the whole prefix, not a single IP — so it looks like the newer anycast IPs (216.198.79.1 / 64.29.17.1) just aren't terminating TLS on 443, even though DNS keeps handing them out. curl agrees: a .65 IP gives me 200/307 in <1s, a .1 IP gives http_code=000 (connection timed out). The *.vercel.app hostname is rock-solid because it uses the legacy range (76.76.21.x / 66.33.60.x = cname.vercel-dns.com).

I'd rather not lean on a client-side workaround (something like Cloudflare WARP would just route around the bad IP for me, but my visitors would still hit it) — I'm after a proper fix. A couple of questions:

1. Is this a known issue with the newer anycast range, and is anything being rolled out for it?
2. Would it be safe/supported to point these subdomains at cname.vercel-dns.com (the legacy healthy range) instead of the per-domain <hash>.vercel-dns-017.com — or could you route my domains off the .1 IPs?

Thanks so much in advance for any guidance — really appreciate it! (Hobby plan, glad to share more details privately.)