Every self-hosting tutorial skips straight to “once your domain points at the server.” This guide covers that missing step — from finding your IP address to verifying the record resolves worldwide.
A record vs CNAME vs AAAA
Before touching the DNS panel, it helps to know what the record types actually mean.
| Record | Maps | Use for |
|---|---|---|
| A | domain → IPv4 address | Pointing a domain or subdomain at your VPS |
| AAAA | domain → IPv6 address | Same as A but for IPv6; add alongside A if your VPS has one |
| CNAME | hostname → hostname | Aliasing one name to another name, never to a raw IP |
The key distinction: a CNAME cannot point at an IP address — it must resolve to another hostname. For a VPS with a static IP, you always want an A record. AAAA records are optional but worth adding if your provider assigns a public IPv6 address.
Step 1 — Find your VPS IP
Log into your provider’s control panel and look for the server’s public IPv4 address — usually shown on the server overview page. Alternatively, SSH into the server and run:
curl -4 ifconfig.meCopy that address exactly. A single typo means DNS resolves to the wrong host.
Step 2 — Create the A record
Open your domain registrar’s DNS settings (sometimes called “Zone Editor” or “DNS Management”). Add one or more A records:
| Type | Name | Value | TTL |
|---|---|---|---|
| A | @ | 203.0.113.42 | 3600 |
| A | cloud | 203.0.113.42 | 3600 |
A few notes on the fields:
- Name
@represents the root domain itself (yourdomain.com). Some registrars show the full domain name here instead. - Name
cloudcreates the subdomaincloud.yourdomain.com. Add as many rows as you need — one per subdomain. - All subdomains point at the same IP. The reverse proxy running on the server reads the incoming hostname and routes traffic to the right app.
- TTL (time-to-live) is in seconds.
3600means resolvers cache the record for one hour. Lower it before making changes if you need faster propagation.
Step 3 — Understand TTL and propagation
When you save a DNS record, it does not update everywhere instantly. Resolvers around the world cached your old record and will keep serving it until the TTL expires. This is normal.
What to do in practice:
- Before any planned DNS change, lower the TTL to
300(5 minutes). Wait for the current TTL to expire so the short TTL propagates. - Make your change. Resolvers will pick it up within 5 minutes.
- Once everything is stable, raise the TTL back to
3600or higher to reduce DNS lookup overhead.
For a brand-new domain with no cached records, propagation is usually fast — often under 10 minutes. For domains with existing records, plan for up to a few hours in the worst case.
Step 4 — Verify the record resolves
Once you have saved the A record, test it from your local machine:
dig +short cloud.yourdomain.comThe command should print your server’s IP address. If it prints nothing or a different IP, the record has not propagated yet or was entered incorrectly.
Alternative checks:
ping cloud.yourdomain.com # confirms name resolution
nslookup cloud.yourdomain.com # works on Windows and macOS without digYou can also use a web-based DNS checker (such as dnschecker.org) to see how the record looks from multiple locations simultaneously.
Cloudflare proxy (orange cloud)
If you manage DNS through Cloudflare, each record has a proxy toggle — an orange cloud icon means traffic routes through Cloudflare’s network first, a grey cloud means DNS-only.
Which to choose:
- DNS-only (grey): the record returns your real server IP. Required when issuing a Let’s Encrypt certificate through Nginx Proxy Manager, because the ACME challenge must reach your server directly.
- Proxied (orange): hides your real IP and adds Cloudflare’s DDoS protection, caching, and global CDN. Switch to this later, after certificates are issued, if you want those benefits.
Start with grey (DNS-only) while setting up your reverse proxy. You can toggle it to orange any time afterwards without changing the A record itself.
Troubleshooting
DNS still resolves to the old IP. The TTL on your previous record has not expired yet. Wait for the TTL duration, then flush your local DNS cache (sudo dscacheutil -flushcache on macOS; ipconfig /flushdns on Windows) and test again.
DNS is correct but the site won’t load. The domain resolves, so DNS is not the problem. Check your server’s firewall — ports 80 and 443 must be open. Most providers have a firewall in the control panel separate from the OS-level firewall; check both.
Let’s Encrypt certificate won’t issue. The ACME HTTP-01 challenge requires that http://yourdomain.com/.well-known/acme-challenge/ is publicly reachable on port 80. Confirm the domain resolves publicly (not just locally), port 80 is open, and Cloudflare proxy is toggled off while issuing the cert.
www subdomain doesn’t resolve. A record for @ covers the root domain only. Add a separate A record with name www pointing at the same IP, or add a CNAME for www pointing at your root domain.
Next steps
Once dig returns your server IP, the domain is wired up. The next step is adding HTTPS — set up Nginx Proxy Manager to issue Let’s Encrypt certificates and route subdomains to your apps without touching config files. Then deploy your first app, for example Nextcloud for file storage.
Need a server before any of this? Hetzner offers excellent value for European and US workloads; Cloudways is the managed option if you prefer not to handle the OS yourself. Full comparison at Best VPS for Self-Hosting. For servers accessible from China, see the VPS for China access guide.
