How to Connect a Custom Domain to Your Site With an AI Agent

Every host publishes the same two shapes: a CNAME for a subdomain such as www, pointing at the host's hostname, and an A (or ALIAS) record for the bare apex. On Vercel the agent can do this half itself — add_project_domain attaches the name to the project, and list_project_domains reports whether it is verified and what it expects. On other hosts the value sits on the custom-domain screen of the dashboard; paste it into the conversation. Do not let the agent guess an IP.

I am adding www.example.com to my site on Vercel. Add the
domain to the project "example-site" and tell me exactly
which DNS record the project expects for it.

Three of the six writing servers replace the whole record set if you let them: Namecheap's set_dns_hosts always, Hostinger's dns_records_update with overwrite, Vercel's BIND replace. Even on the per-record servers, reading first is how the agent notices an existing record it would collide with. Porkbun: dns_list. Hostinger: dns_records_list through execute. Namecheap: get_dns_hosts. Name.com: ManageDNS with operation list. Cloudflare: the zone's DNS records endpoint through execute.

List every DNS record on example.com and show me the table
before you change anything. Tell me if a record already
exists for www or for the apex.

Prefer the tool that cannot delete what you did not send. Porkbun: dns_upsert for one record, or domain_cutover_web to move the whole web presence to a new target in one call. Hostinger: dns_records_validate, then dns_records_update without overwrite. Name.com: ManageDNS create. Vercel (when Vercel manages the DNS): update_record, or create the record the project asked for. Namecheap: get_dns_hosts, merge, then set_dns_hosts with the complete set. Cloudflare: execute against the DNS records endpoint, with the record set to DNS only (not proxied) unless the host tells you otherwise.

Add a CNAME for www.example.com pointing at
cname.vercel-dns.com with a 300-second TTL. Use the upsert
tool if this server has one. Do not modify or delete any
other record. Show me the exact call before you run it.

A record the agent reads back from the same server one second after writing it will always look right; that is the authoritative answer, not what the internet sees. Wait a few minutes, then ask IntoDNS: check_dns_propagation asks nine resolvers and reports the ones that still disagree, and lookup_dns reads the record over DNS-over-HTTPS. On the command line, dig does the same for one resolver.

Wait for me to say "check". Then use IntoDNS
check_dns_propagation for www.example.com, record type
CNAME, and report which resolvers agree. Do not edit the
record again unless I ask.

Hosts provision TLS automatically once the record resolves; a pending certificate a few minutes after a DNS change is normal. On Vercel the agent can check with list_certs and request one with issue_cert; Porkbun's ssl_retrieve fetches the bundle Porkbun issues for its own domains. The one thing to forbid: an agent that "fixes" a pending certificate by rewriting the record it just set.

Check whether the certificate for www.example.com has been
issued. If it is still pending, tell me how long to wait.
Do not change any DNS record.