Vercel tokens have no per-resource permissions. The one thing you choose is the
token’s Scope — which account or team it acts on. Pick the one that owns the
domain. A token scoped to your personal account cannot see a team’s domain, and a
token scoped to the wrong team cannot see it either.
Your domain has to be using Vercel’s nameservers (
ns1.vercel-dns.com and
ns2.vercel-dns.com) for this to work. Where the domain is registered does not
matter — plenty of domains are registered elsewhere and pointed at Vercel for DNS.
What matters is which provider answers for the zone.Create the token
1
Open the tokens page
Sign in and go to
vercel.com/account/settings/tokens.
Choose Create Token.
2
Name it
Give the token a name you will recognise later, for example
Maski DNS setup.3
Choose the right Scope
This is the step that matters. The Scope dropdown lists your personal
account and every team you belong to. Choose the one that owns the domain you
are setting up.If you are not sure, open the domain in your Vercel dashboard and look at which
account or team you were switched to when you found it.
4
Set an expiry
Pick the shortest expiry offered. Maski uses the token once, so a short
lifetime costs you nothing.
5
Copy the token
Choose Create. Vercel shows the value once and cannot show it again. Copy it
before you close the dialog.
6
Paste it into Maski
Open your domain in the Maski dashboard. In Set up automatically, pick
Vercel, paste the token into Access token, and press Review changes.Maski reads your zone and shows you what it would change. Nothing is written
until you press Publish records.
Afterwards
Delete the token from the same page once your domain is set up. Maski does not keep it and will not need it again. This matters more on Vercel than on some other providers: a Vercel token grants full access to whatever scope you picked, so it is worth removing rather than leaving it to expire.What Maski leaves alone
If your domain also serves a site on Vercel, its zone already holds records Vercel manages for you — typically anALIAS at your apex and a few CAA records.
Maski does not touch those. It can see them, and it uses them to understand your
zone, but it will never modify or delete a record Vercel marks as system-managed.
Your site keeps working exactly as it did.
The one exception is the same on every provider: if another mail server already
answers at your apex, Maski lists those MX records and asks you to confirm before
replacing them. Maski converges your domain to its one permanent MX hostname; that
hostname can itself reach multiple active Maski receiving servers.
If it does not work
Maski cannot find the zone. Nearly always the token’s Scope. A personal token cannot see a team’s domain. Mint a fresh token, and this time set Scope to the account or team that owns the domain. If the domain sits under a team, Maski works this out on its own and addresses the right team — you do not need to supply a team ID anywhere. But it can only do that if the token can see the team in the first place. “Your DNS provider rejected the request.” The token has expired or was deleted. Tokens are short-lived by design, so if some time passed between minting and pasting, mint a fresh one. The domain is not hosted at Vercel. Check your nameservers. If they are notns1.vercel-dns.com and ns2.vercel-dns.com, set the domain up at whichever
provider now answers for it instead.
If none of that helps, add the records by hand from the checklist on the domain
page. A manually configured domain works exactly the same.