Debelu DNS move: Vercel to Cloudflare

Prepared 2026-09-27; updated after the 2026-09-30 cutover. The registrar now delegates debelu.com to janet.ns.cloudflare.com and kolton.ns.cloudflare.com, and Cloudflare reports the zone active. The historical Vercel-versus-Cloudflare table below remains a cutover record, not an instruction to switch nameservers again. app.debelu.com and admin.debelu.com now serve Cloudflare Pages over HTTPS; cdn.debelu.com serves the R2 product-image bucket over HTTPS.

Record-by-record review

Name	Type	Current Vercel record	Staged Cloudflare record	Action before switch
@	ALIAS / A	Vercel-managed ALIAS to f69cd1cfe9957e10.vercel-dns-017.com	DNS-only A records 216.198.79.1 and 64.29.17.1	Aligned with Vercel's current external-DNS recommendation by the 30 September preflight workflow.
*	ALIAS / A	Vercel-managed ALIAS to cname.vercel-dns-017.com	Two DNS-only A records found by Cloudflare's scan	Do not rely on wildcard alone for app and admin; confirm both explicitly before switching.
www	A (scan)	Resolves through Vercel's managed DNS	DNS-only A records 216.198.79.1 and 64.29.17.1	Aligned with Vercel's current external-DNS recommendation. Keep marketing on Vercel.
app	Vercel-managed	Connected to debelu-app	Explicit DNS-only CNAME to debelu-storefront.pages.dev	Pages custom domain is active.
admin	Vercel-managed	Connected to debelu-admin	Explicit DNS-only CNAME to debelu-admin.pages.dev	Pages custom domain is active.
api	CNAME	w05yf0rl.up.railway.app	Same current Railway target	Recheck API TLS/CORS after switch.
_railway-verify.api	TXT	railway-verify=c014fb7078dd3f0cad1549906498b9d318e4f4bc598218cfc08b7eac1da97fad	Same current token	Preserve for Railway verification.
@	MX	Only Zoho (mx 10, mx2 20, mx3 50); owner confirmed tested mailboxes and the competing ImprovMX MX records were removed on 2026-09-30	Same three Zoho MX records	Check inbound mail after delegation.
@	TXT SPF	v=spf1 include:zohomail.com include:spf.improvmx.com ~all	Same SPF record	Remove the ImprovMX include only after its sending role is ruled out.
@	TXT Zoho verification	zoho-verification=zb06136049.zmverify.zoho.com	Same TXT	Preserve.
zmail._domainkey	TXT	Zoho DKIM public key	Copied and confirmed by direct staged-NS query	Preserve.
@	CAA	pki.goog, sectigo.com, letsencrypt.org	All three imported, DNS-only	Confirm the issuers needed for Vercel, Cloudflare, and any other certificates before switch.
_domainconnect	CNAME	Not listed in Vercel's 10-record DNS table	Auto-imported to _domainconnect.vercel-dns.com, DNS-only	Review whether still needed; it is not required for the Debelu app itself.

Cloudflare's scan produced A records from then-current DNS answers for @, *, and www, not durable copies of Vercel's automatically managed ALIAS records. Those answers can change. The original scan predates both SES and the newly added Zoho records. The explicit records above have since been corrected; the wildcard * still has scan-derived A answers that differ from Vercel's current wildcard answers. Check the wildcard before relying on unknown subdomains after delegation. The authoritative Vercel api CNAME and Railway verification TXT were updated on 2026-09-28 and publicly resolve to the values in the table. The staged Cloudflare copies were corrected on 2026-09-30 and direct queries to janet.ns.cloudflare.com now return the current Railway target and token. Railway's certificate for api.debelu.com was verified on 2026-09-28; the custom hostname returned HTTP 200 with valid TLS.

Completed cutover and rollback record

1. The Truehost domain detail page at https://truehost.com.ng/cloud/clientarea.php?action=domaindetails&id=186652 exposes the nameserver controls. The owner changed its two Vercel nameservers to the assigned Cloudflare nameservers on 30 September. Truehost is the account/reseller; the public registry identifies OwnRegistrar, Inc. as the underlying registrar. No DNSSEC DS record was present at the .com parent during cutover. An unpaid invoice appeared at the time of the earlier account review; the owner should check its status.
2. The root and www marketing targets, explicit app and admin Pages CNAMEs, Railway API target, Zoho mail records, and SES records were staged before cutover and are now authoritative in Cloudflare. The wildcard remains scan-derived, so do not rely on unknown subdomains.
3. The Pages sites deployed and passed preview smoke checks. Keep the old Vercel app/admin deployments available for rollback until the new custom domains are active and tested.
4. The owner changed only registrar delegation to Cloudflare; the .com parent nameservers and Cloudflare's active status were verified.
5. The Pages custom domains and R2 custom domain are active with valid TLS; the Railway API returned HTTP 200 and Zoho MX records resolved. Continue checking authentication, checkout, and inbound-mail delivery end to end. Keep the prior Vercel app/admin deployments available for rollback until the production storefront release is fully validated.

If critical traffic or mail fails, restore the Vercel nameservers at the registrar and investigate the missing/incorrect Cloudflare record. Rollback is subject to DNS caching, so the preferred safeguard is a complete staging review before changing delegation.

SES records preserved through DNS cutover

On 2026-09-27, the debelu.com SES identity was created in eu-west-2 (London) with 2048-bit Easy DKIM and bounce.debelu.com as the custom MAIL FROM domain. The SES identity is verified, and the owner reports that production sending access was approved. These records were published in Vercel DNS before cutover and copied into the now-authoritative Cloudflare zone. Zoho is the selected inbound-mail provider; the competing ImprovMX MX records were removed.

Name	Type	Value	Priority
el26mkey4vxsb4ylwfgo6frvgdb47yde._domainkey	CNAME	el26mkey4vxsb4ylwfgo6frvgdb47yde.dkim.amazonses.com	—
qqq7k2v4nm54tdhikj7csskxc4htnzam._domainkey	CNAME	qqq7k2v4nm54tdhikj7csskxc4htnzam.dkim.amazonses.com	—
ut4mgysdrkx4pr2i6g6c7swz7rypdlxm._domainkey	CNAME	ut4mgysdrkx4pr2i6g6c7swz7rypdlxm.dkim.amazonses.com	—
bounce	MX	feedback-smtp.eu-west-2.amazonses.com	10
bounce	TXT	v=spf1 include:amazonses.com ~all	—
_dmarc	TXT	v=DMARC1; p=none;	—

All six AWS-generated records were added and verified in the Cloudflare zone. An earlier lookup briefly returned an incorrect bounce MX target, but it was corrected to feedback-smtp.eu-west-2.amazonses.com at priority 10. SES is configured to reject mail if custom MAIL FROM MX fails. The production notification trigger sent a controlled owner-account message through SES on 30 September; inbox receipt and bounce/complaint monitoring still require confirmation.