Project: kaix-mobility
Domains: kairuiai.com *.kairuiai.com www.kairuiai.com
Hi Vercel team,
I’m seeing what appears to be stale nameserver verification metadata that is preventing managed TLS certificate provisioning.
The domain has already been fully delegated to Vercel DNS:
ns1.vercel-dns.com ns2.vercel-dns.com
I verified the following independently:
- The .com parent delegation points only to the Vercel nameservers.
- Direct authoritative queries to both ns1.vercel-dns.com and ns2.vercel-dns.com return AA=true.
- Both authoritative nameservers return consistent SOA and DNS records.
- Public recursive resolvers also return the Vercel nameservers.
- No DS record exists and DNSSEC is disabled.
- No lame or mixed delegation was found.
- CAA permits:
- Vercel DNS zone is active.
- Apex and wildcard ALIAS records point to Vercel.
- Vercel domain config reports:
- misconfigured=false
- conflicts=[]
However, persisted Vercel domain metadata still reports the previous Cloudflare nameservers:
rosalyn.ns.cloudflare.com valentin.ns.cloudflare.com
and currently shows:
nsVerifiedAt=null configVerifiedAt=null
There are also zero certificate objects for:
kairuiai.com *.kairuiai.com www.kairuiai.com
TLS handshakes to the custom domains fail with EOF / connection closed.
The same Vercel edge IP successfully serves kaix-mobility.vercel.app with valid TLS, so this does not appear to be a general edge or local network issue.
Could a Vercel staff member please help with:
- Reconcile / refresh the nameserver verification metadata for kairuiai.com.
- Recalculate nsVerifiedAt and configVerifiedAt.
- Re-trigger managed certificate issuance.
- Confirm certificate binding for:
- kairuiai.com
- *.kairuiai.com
- www.kairuiai.com
I have not deleted or re-added the domains and have not modified the nameservers again because the public delegation is already correct.
Thanks.
