Vercel

"records": { "CNAME": "cname.vercel-dns.com" }

cname.vercel-dns.com is the target Vercel gives most projects. Some accounts get a project-specific one instead, of the form <hash>.vercel-dns-017.com. Copy whatever your own Domains tab shows rather than the value above, and leave off any trailing dot: example.com. fails the hostname grammar, example.com passes.

Two ways to apply this. The quickest is runs-at.dev/manage: sign in, pick the record type, paste the value, save. It writes the same commit to the registry and DNS follows within seconds. The steps below do it by pull request instead, which is what you want if you would rather review the change first. Either way handles subdomains entries.

1. Fork the registry and edit domains/you.json to the record above.
2. Open a pull request. Once merged, the CNAME is synced to DNS automatically.
3. In the Vercel dashboard: your project → Settings → Domains → add you.runs-at.dev. Vercel then shows you the DNS it wants. Usually that is the CNAME alone. If it also shows a TXT record, read the next section before adding anything.

Vercel sometimes asks you to prove you control the domain, and shows a TXT record whose value starts with vc-domain-verify=. It belongs at _vercel.you.runs-at.dev, one label below your name, which is what the subdomains key is for:

{
  "records": { "CNAME": "cname.vercel-dns.com" },
  "subdomains": {
    "_vercel": {
      "TXT": ["vc-domain-verify=you.runs-at.dev,PASTE-YOUR-TOKEN"]
    }
  }
}

Do not put that TXT beside the CNAME in records. A name carrying a CNAME cannot carry any other record type, which is a DNS rule rather than something this registry chose, and the record will be rejected. Under subdomains it is a different name, so the two coexist happily.

The record form sets this without a pull request: add a subdomain row, label it _vercel, pick TXT, and paste the value.

The registry mirrors that TXT to _vercel.runs-at.dev · the zone-level host Vercel actually reads the challenge from, since the apex itself sits in a Vercel account · automatically on every DNS sync. You only ever manage the subdomains entry above; the zone-level copy is how the registry completes the handshake.

The Domains tab in Vercel shows a green "Valid Configuration" once DNS has propagated and the certificate is issued, usually within a few minutes of the record landing. Visiting https://you.runs-at.dev should then serve your project. If it stays on "Invalid Configuration", check the CNAME target character for character against what the Domains tab shows.