Migrating a Live Custom Domain (Zero-Downtime Switchover)
Use this guide when you are moving an existing production help center domain (for example, support.yourcompany.com) from another provider to Brainfish and want HTTPS to be ready before DNS cutover.
For a brand-new custom domain with no existing traffic, follow How to Set Up a Custom Domain instead.
Why pre-generate the certificate?
By default, certificates are issued with HTTP-01 after your hostname already points at Brainfish (Vercel). That usually takes a few minutes, but delays can happen. For a live customer-facing domain, plan for the worst case of up to ~24 hours if you wait until after the CNAME flip.
Brainfish can pre-issue the SSL certificate using a DNS-01 TXT challenge so cutover day is just a DNS change.
Recommended production flow
1. Add the domain in Brainfish
- Go to Distribution → Agents → Help Center Agent → Advanced Settings.
- Open Domain Settings.
- Enter the production hostname (for example,
support.yourcompany.com) and add it.
You do not need to remove staging or test subdomains for this step.
2. Publish the ownership verification TXT
If the status is Pending Verification, Brainfish shows a TXT record similar to:
_vercel.yourcompany.com TXT
vc-domain-verify=support.yourcompany.com,<token>
Add it at your DNS provider. You can keep verification TXT records for staging/test hostnames alongside this one.
Wait until Brainfish shows the domain as recognized / verified.
3. Pre-issue the certificate (DNS-01)
Coordinate with Brainfish support. We generate an ACME challenge from our side and send you:
_acme-challenge.support.yourcompany.com TXT <challenge-value>
- Publish that TXT record exactly as provided.
- Confirm it answers from public resolvers (
1.1.1.1,8.8.8.8, etc.). - Reply to Brainfish so we can complete certificate issuance.
- Confirm HTTPS against the Brainfish edge before changing the live CNAME, for example:
curl --resolve support.yourcompany.com:443:<vercel-edge-ip> -I https://support.yourcompany.com
Brainfish will share the resolve target / edge IP to use for this check.
4. Flip the CNAME on cutover day
Once the certificate exists:
- Point the hostname at Brainfish with a CNAME (shown in Domain Settings), typically:
support.yourcompany.com CNAME cname.vercel-dns.com.
- Use DNS only (do not proxy through Cloudflare or similar) for cutover.
- Keep SEO indexing disabled on staging/test hostnames if content would otherwise be duplicated. Production indexing can be enabled after go-live.
Because the cert already exists, HTTPS should work as soon as DNS propagates.
Cloudflare / proxy guidance
Cloudflare proxy can interfere with HTTP-01 certificate challenges. Prefer DNS-01 pre-generation for production, and keep proxy off until the cert is confirmed.
Staging and test subdomains
Before production cutover, use alternate hostnames (for example, support-test.yourcompany.com / support-staging.yourcompany.com) to validate cookies, auth, and custom scripts on your apex domain.
Typical setup:
- Add each test hostname in Help Center → Advanced Settings.
- Publish the ownership TXT values shown there.
- Add the CNAME targets shown in Domain Settings (DNS only).
- Confirm Valid Configuration and HTTPS before relying on them for QA.
Day-of checklist
Troubleshooting
- HTTP works, HTTPS fails — Certificate may not be issued yet. Prefer DNS-01 pre-generation for production rather than waiting after cutover.
- Panel still shows Invalid Configuration — Re-check after CNAME / TXT records propagate; refresh Domain Settings.
- Proxy enabled too early — Switch to DNS only until the certificate is confirmed.
- CAA restrictions — Ensure Let's Encrypt is allowed for the hostname.