> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maski.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Vercel

> Create a Vercel access token scoped to the account or team that owns your domain, so Maski can publish your custom-domain records.

Vercel has no third-party sign-in flow for Maski yet, so there is no **Connect with
Vercel** button to look for. An access token is the way to authorize Maski, and it
takes about a minute to mint.

<Info>
  Vercel tokens have no per-resource permissions. The one thing you choose is the
  token's **Scope** — which account or team it acts on. Pick the one that owns the
  domain. A token scoped to your personal account cannot see a team's domain, and a
  token scoped to the wrong team cannot see it either.
</Info>

<Note>
  Your domain has to be using Vercel's nameservers (`ns1.vercel-dns.com` and
  `ns2.vercel-dns.com`) for this to work. Where the domain is *registered* does not
  matter — plenty of domains are registered elsewhere and pointed at Vercel for DNS.
  What matters is which provider answers for the zone.
</Note>

## Create the token

<Steps>
  <Step title="Open the tokens page">
    Sign in and go to
    [vercel.com/account/settings/tokens](https://vercel.com/account/settings/tokens).
    Choose **Create Token**.
  </Step>

  <Step title="Name it">
    Give the token a name you will recognise later, for example `Maski DNS setup`.
  </Step>

  <Step title="Choose the right Scope">
    This is the step that matters. The **Scope** dropdown lists your personal
    account and every team you belong to. Choose the one that owns the domain you
    are setting up.

    If you are not sure, open the domain in your Vercel dashboard and look at which
    account or team you were switched to when you found it.
  </Step>

  <Step title="Set an expiry">
    Pick the shortest expiry offered. Maski uses the token once, so a short
    lifetime costs you nothing.
  </Step>

  <Step title="Copy the token">
    Choose **Create**. Vercel shows the value once and cannot show it again. Copy it
    before you close the dialog.
  </Step>

  <Step title="Paste it into Maski">
    Open your domain in the Maski dashboard. In **Set up automatically**, pick
    Vercel, paste the token into **Access token**, and press **Review changes**.

    Maski reads your zone and shows you what it would change. Nothing is written
    until you press **Publish records**.
  </Step>
</Steps>

## Afterwards

Delete the token from the same page once your domain is set up. Maski does not keep
it and will not need it again.

This matters more on Vercel than on some other providers: a Vercel token grants full
access to whatever scope you picked, so it is worth removing rather than leaving it
to expire.

## What Maski leaves alone

If your domain also serves a site on Vercel, its zone already holds records Vercel
manages for you — typically an `ALIAS` at your apex and a few `CAA` records.

**Maski does not touch those.** It can see them, and it uses them to understand your
zone, but it will never modify or delete a record Vercel marks as system-managed.
Your site keeps working exactly as it did.

The one exception is the same on every provider: if another mail server already
answers at your apex, Maski lists those `MX` records and asks you to confirm before
replacing them. Maski converges your domain to its one permanent MX hostname; that
hostname can itself reach multiple active Maski receiving servers.

## If it does not work

**Maski cannot find the zone.** Nearly always the token's **Scope**. A personal
token cannot see a team's domain. Mint a fresh token, and this time set Scope to the
account or team that owns the domain.

If the domain sits under a team, Maski works this out on its own and addresses the
right team — you do not need to supply a team ID anywhere. But it can only do that
if the token can see the team in the first place.

**"Your DNS provider rejected the request."** The token has expired or was deleted.
Tokens are short-lived by design, so if some time passed between minting and
pasting, mint a fresh one.

**The domain is not hosted at Vercel.** Check your nameservers. If they are not
`ns1.vercel-dns.com` and `ns2.vercel-dns.com`, set the domain up at whichever
provider now answers for it instead.

If none of that helps, add the records by hand from the checklist on the domain
page. A manually configured domain works exactly the same.