Custom domain

V1 uses the default Vercel URLs (https://lending-agent-oversight.vercel.app, https://lending-agent-oversight-docs.vercel.app). To swap in a custom domain, follow this checklist. The procedure applies to both projects; do each project separately.

Add the domain in Vercel

Vercel dashboard, the project (lending-agent-oversight).
Settings → Domains → Add.
Enter the apex domain (e.g. oversight.example.com) or the subdomain you want.
Vercel shows the DNS records you need to add at your registrar.

If you also want www.oversight.example.com, add it as a second domain in the same project. Vercel will offer a “Redirect to …” control on the second domain to forward www to the apex (or vice versa).

DNS records

The records depend on whether you are pointing the apex (root) or a subdomain.

Subdomain (recommended)

For oversight.example.com:

Type	Name	Value	TTL
CNAME	`oversight`	`cname.vercel-dns.com`	300

CNAME flattening is supported at most modern DNS providers (Cloudflare, Route 53, Gandi). The provider transparently resolves the CNAME at query time so the record appears as an A/AAAA to clients.

Apex / root domain

For example.com itself (when the registrar does not support CNAME at the apex):

Type	Name	Value	TTL
A	`@`	`76.76.21.21`	300

Vercel publishes the canonical IP to use; check the project’s Domains panel for the current value before configuring. Vercel may rotate the IP rarely; keep TTL low (300 seconds) so propagation is quick if it does.

If your DNS provider supports ALIAS or ANAME records (Route 53 alias, DNSimple ALIAS, Cloudflare CNAME-flattening), prefer those over a hard-coded A record:

Type	Name	Value
ALIAS / ANAME	`@`	`cname.vercel-dns.com`

www redirect

Two domains, one redirect. Add both oversight.example.com and www.oversight.example.com to the project. Configure one as the canonical (commonly the apex) and let the other redirect to it.

Vercel handles the redirect with a 308 (Permanent Redirect, preserves request method). HTTPS is preserved on both ends.

Domain	Role	Action
`oversight.example.com`	Canonical	Serve content
`www.oversight.example.com`	Alias	308 redirect to canonical

HTTPS auto-provisioning

Vercel provisions a Let’s Encrypt certificate automatically once the DNS records resolve. The provisioning typically completes within minutes; the Domains panel shows the status.

Renewal is automatic at 60 days before expiry. No action required.

For domains with HTTPS Strict Transport Security (HSTS) preload, ensure the domain is fully on HTTPS before adding the preload header (a misconfigured HSTS preload locks users out of plain-HTTP for 1 year minimum).

Verifying the setup

After DNS propagation (usually under 10 minutes; up to 24 hours for some providers):

# DNS resolves to a Vercel IP
dig oversight.example.com +short

# HTTPS works, certificate is valid, redirect lands
curl -sIL https://www.oversight.example.com | head -20
curl -sI  https://oversight.example.com  | head -10

Expected: a 308 from www to apex, a 200 from apex, both with valid certificates and a server: Vercel header.

Health and monitoring

Once a custom domain is live, point uptime monitoring (Pingdom, Better Stack, UptimeRobot, internal Datadog synthetic) at the canonical URL, not the *.vercel.app URL. Otherwise an outage of the custom-domain DNS or HTTPS layer will not page.

For production, also monitor:

TLS certificate expiry (alerts at 30 days; Vercel renews at 60 but verify)
DNS resolution from at least two vantage points (UK and EU)
HTTP response code for / and /api/health

Rollback

Removing a custom domain from the Vercel project does not delete the DNS records at your registrar; the domain stops resolving to Vercel only after DNS propagation. To roll back cleanly:

Re-promote the previous deployment in Vercel (atomic, seconds).
If reverting to the default URL is required, remove the custom domain from the project and update any links that point at the custom URL.

v1 default

V1 ships on lending-agent-oversight.vercel.app and lending-agent-oversight-docs.vercel.app. The custom-domain step is a future operational task. The pages, redirects, and HTTPS config above are the runbook when it lands.