Replit custom domain or SSL not working? Fix the DNS

You connected your domain in Replit, added the records, and it is still Verifying. Or the domain loads with a certificate warning, or shows The deployment could not be reached. Almost every case comes down to a handful of DNS details that Replit documents but that are easy to miss. Work through them in this order.

Symptoms

• The domain stays on Verifying for hours in Publishing → Domains.
• Browsers show NET::ERR_CERT_COMMON_NAME_INVALID or another SSL warning.
• The .replit.app URL works but the custom domain shows an error or another site.
• www works and the root domain does not, or the reverse.
• It worked for months, then the certificate expired.

Likely causes

1. The A or TXT record is missing, has a typo, or sits on the wrong host name.
2. Cloudflare proxy (orange cloud) is on, which blocks Replit's certificate setup and renewal.
3. An AAAA (IPv6) record or a second A record on the same name points somewhere else.
4. A CAA record does not allow Let's Encrypt, which Replit uses to issue certificates.
5. The TXT record was deleted after the first verification, so renewal failed.
6. Each subdomain (including www) needs its own records, and wildcards are not supported.

Step-by-step fix

1. Copy the records exactly

In Publishing → Domains, open the domain and copy the A record (IP address) and the TXT record (replit-verify=…). At your registrar, use @ for the root domain (or the domain name if @ is not accepted) and the subdomain name for anything else. Watch for registrars that append the domain automatically, which creates www.example.com.example.com.

2. Clean up conflicting records

Keep only one A record on the hostname, the one pointing to Replit. Delete AAAA records on the same name, old A records from a previous host, and any CNAME on the root domain.

3. Turn off the Cloudflare proxy

If your DNS is on Cloudflare, click the orange cloud on the A record so it becomes grey (DNS only). Replit cannot issue or renew certificates for proxied records.

4. Check CAA records

If your DNS has CAA records, one must allow letsencrypt.org. Otherwise no certificate can be issued.

5. Add each subdomain separately

To serve both example.com and www.example.com, connect both in Replit and add the records Replit shows for each. Each subdomain has its own TXT record.

6. Wait, then reconnect

DNS can take minutes to 48 hours to propagate. Check with a public lookup tool. If the records are right everywhere and SSL still fails, disconnect and reconnect the domain in Publishing → Domains → Manage to force a fresh certificate.

Copy-paste prompt for Replit Agent

Open a new Agent chat (a fresh chat keeps old attempts out of its context) and paste this:

My Replit custom domain is not working (stuck verifying / SSL error / deployment could not be reached).
I do not want code changes. Please:
1. Tell me exactly which DNS records Replit expects for example.com and www.example.com, using the values shown in Publishing > Domains.
2. Give me a checklist to compare with my registrar: one A record per hostname, the replit-verify TXT record kept permanently, no AAAA records on the same name, no CNAME on the root, Cloudflare set to DNS only, CAA allowing letsencrypt.org.
3. After the domain works, make sure the app builds absolute URLs (emails, OAuth callbacks, Stripe redirects) from an APP_URL secret set to https://example.com.
Here is my current DNS export: [paste records, no secrets]

How to verify the fix

• dig +short A example.com returns only Replit's IP, and dig +short AAAA example.com returns nothing.
• dig +short TXT example.com shows the replit-verify= value.
• curl -I https://example.com answers without certificate errors, for the root and for www.
• Publishing → Domains shows the domain as verified.

Once the domain works, update OAuth redirect URIs and Stripe URLs to it, then check that Google indexes the right domain.

FAQ

Can I use a CNAME for my root domain on Replit?

No. Replit's docs say apex (root) CNAMEs are not supported. Use the A record Replit gives you for the root domain.

Can I keep Cloudflare's proxy on with Replit?

Replit's docs ask you to set the record to DNS only, because proxied records block certificate setup and automatic renewal.

Can I delete the TXT record after verification?

No. Replit renews your certificate through DNS validation, so the replit-verify TXT record must stay for as long as you use the domain. Removing it makes the next renewal fail.