Custom domain not connecting — DNS and SSL troubleshooting
A custom domain that won't connect is usually a wrong CNAME target, a missing ownership TXT record, a proxied Cloudflare record, or a stale DNS cache.
When a custom domain doesn't connect on VeloCMS, the failure is almost always in one of four places: the CNAME record isn't pointing at the target your panel shows, the ownership TXT record is missing, the SSL certificate is still being issued (usually a few minutes), or a DNS resolver is caching a stale answer.
Check 1 — Verify the CNAME and TXT records
Open Admin → Settings → Branding → Custom domain. The panel shows a CNAME target generated for your domain and an ownership TXT record (name and value). Both are unique to your domain, so copy them from the panel instead of reusing values from another domain or an older setup. Then check what your DNS actually serves with dig www.yourdomain.com CNAME +short: the output should be exactly the target from the panel. If it shows your old hosting provider's address, or nothing, the record hasn't been created or hasn't propagated yet. DNS propagation takes anywhere from a few minutes to 48 hours depending on the previous TTL value.
# Compare the answer with the target shown in your VeloCMS panel:
dig www.yourdomain.com CNAME +short
# Check the ownership TXT record (use the name shown in the panel):
dig TXT <record-name-from-panel> +short
# Check the certificate once the status is Active:
curl -I https://www.yourdomain.com 2>&1 | head -20
# Expected: HTTP/2 200Check 2 — Read the status in the panel
In Admin → Settings → Branding → Custom domain, the status next to your domain cycles from Pending DNS to Verifying to Active as your records resolve and the certificate is issued. Pending DNS means the records haven't resolved yet: wait a few minutes, then click Verify Now or Check DNS records. If the status shows Failed, the panel gives the reason — usually a record that is wrong or missing. Fix the record at your DNS provider and check again.
Check 3 — The Cloudflare proxy gotcha
If your DNS is hosted on Cloudflare, the record must be DNS-only (gray cloud). An orange cloud (Proxied) hides the target from our hosting platform, which can only route your domain when the DNS record points at it directly — the status then sits at Pending DNS or flips to Failed. If the CNAME shows the orange cloud icon in Cloudflare DNS, click it to switch to gray (DNS-only).
Apex domains (yourdomain.com, without www) on Cloudflare can still use CNAME flattening while staying DNS-only — Cloudflare resolves the CNAME at the apex and serves it as A/AAAA records, no proxy toggle required. This is a Cloudflare-specific feature and only works when the domain's DNS is managed in Cloudflare.
Check 4 — DNS cache flush
After fixing the CNAME or SSL issue, the reader's browser may still see the old cached DNS response. Ask the reader to try a private browsing window or clear their DNS cache with sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder on macOS. For a quick external check, use nslookup or Google's DNS Checker tool to verify the CNAME is resolving globally.