Point a Domain to Your Server: DNS Records, Not Forwarding

Most registrar dashboards have a big “Forwarding” button and a small “DNS records” link, and new VPS owners click the big one. Forwarding sends visitors to another URL with an HTTP redirect. That is not what you need when you run your own server. You want the domain name itself to resolve to your machine’s IP address.

How pointing a domain to a server actually works

When someone opens example.com, their resolver walks down from the root servers to the .com servers and then to your domain’s nameservers, which answer with the A record. The browser connects to that IP on port 443.

Two separate layers are involved, and problems are easier to locate once you keep them apart:

• DNS only maps a name to an address. It knows nothing about ports, paths or protocols.
• Your web server looks at the SNI name in the TLS handshake and the Host header to decide which site to serve.

If DNS is wrong you get NXDOMAIN or someone else’s server. If the web server is wrong you get the nginx welcome page.

Nameservers or A record: which one to change

In almost every case you leave the nameservers alone and edit records. Find out where the zone is hosted:

dig NS example.com +short

Whatever comes back is where your records must go. If that’s your registrar, edit them in its dashboard. At betadomain you manage DNS records in the customer area next to the domain. If the nameservers belong to Cloudflare or another DNS host, records at the registrar are ignored, even though the registrar’s form will happily save them. That mismatch eats an afternoon for a lot of people.

The 48 hours for .com come from the TTL on delegation records in the .com zone, which Verisign sets to 172800 seconds. More on that in the guide to DNS propagation time.

Step by step: connect the domain to your VPS

1. Get the server’s IP

ip -4 addr show scope global
ip -6 addr show scope global

A private address such as 10.0.0.5 means the server is behind NAT, and the public IP is in your provider’s panel. The examples below use 192.0.2.10 and 2001:db8:10::1.

2. Check the current TTL

If the domain already has an A record from a parking page or an old host:

dig example.com A +noall +answer

example.com.		3600	IN	A	198.51.100.7

3600 means resolvers may keep the old answer for up to an hour after you change it. To cut over quickly, drop it to 300 first and wait an hour. The reasoning is in the DNS TTL guide.

3. Create the records

@     300  IN  A     192.0.2.10
@     300  IN  AAAA  2001:db8:10::1
www   300  IN  CNAME example.com.

Only add the AAAA record if the server answers on IPv6 and your web server listens on it. Clients and Let’s Encrypt prefer IPv6, so a broken AAAA record does more harm than a missing one. See the AAAA record guide for the checks, and CNAME vs A record for the choice on www.

4. Verify

dig @ns1.example-dns.net example.com A +short
dig @1.1.1.1 example.com A +short
dig @1.1.1.1 www.example.com AAAA +short

If the authoritative server already returns the new IP and 1.1.1.1 still has the old one, your records are right. You’re just waiting for a cache to expire.

5. Set up the web server

A minimal nginx server block in /etc/nginx/sites-available/example.com:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    root /var/www/example.com;
}

ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx

People forget listen [::]:80; all the time. Without it, nginx ignores IPv6 even though your AAAA record says otherwise.

6. Get a certificate

apt install certbot python3-certbot-nginx
certbot --nginx -d example.com -d www.example.com

Renewal, rate limits and the coming switch to shorter certificate lifetimes are covered in the Let’s Encrypt certificate guide.

Test before DNS has caught up

You don’t have to wait for caches to test the server. curl can override name resolution for one request:

curl -sI --resolve example.com:80:192.0.2.10 http://example.com

For a browser test, a temporary line in /etc/hosts does the same job. Remove it afterwards, or in a month you’ll be debugging a server that no longer exists.

When the domain still doesn’t reach your server

Right IP, wrong site. server_name doesn’t match or the file isn’t linked into sites-enabled. nginx -T | grep server_name shows what nginx actually loaded.

Ping works, curl hangs. Firewall. Either ufw allow 80,443/tcp is missing or your provider’s cloud firewall blocks the ports.

IPv4 works, IPv6 times out. Test with curl -6 -I http://example.com from a machine that has IPv6. If it fails, remove the AAAA record until IPv6 on the server is fixed.

Two IPs come back. The registrar’s parking record is still there next to yours:

192.0.2.10
198.51.100.7

Delete the old one, otherwise visitors alternate between your server and the parking page.

Many domains, one server

Ten domains can point at the same IP. They all get the same A record and the web server separates them by name. The setup for nginx, Caddy and Traefik is in reverse proxy for multiple domains.

If you still need a name for the project, you can search for an available domain at betadomain, where the yearly price is also the renewal price. A .com registration costs €14.99 a year and a .dev domain €22.99. Once it’s registered, add the records from step 3 in the customer area.

Step by step

1. Find the server's public IPRun ip -4 addr show scope global and ip -6 addr show scope global on the server, or check your provider's control panel if the server sits behind NAT.
2. Check the existing TTLRun dig example.com A +noall +answer. If you are replacing a record with a long TTL, lower it to 300 first and wait out the old value.
3. Create the A and AAAA recordsAt your DNS provider, add an A record for @ with the IPv4 address and an AAAA record with the IPv6 address, only if IPv6 actually works on the server.
4. Add wwwCreate www as a CNAME to the bare domain or give it the same A and AAAA records.
5. Verify with digQuery the authoritative nameserver and a public resolver with dig +short for both A and AAAA.
6. Configure the web server and TLSAdd a server block for the domain and issue a Let's Encrypt certificate with certbot or let Caddy do it automatically.