Module 7 · 7.1
English
DNS to your VPS and reverse DNS
Module 7: Domain, web server and https · Reading time: 10 minutes
Learning objective: After this lesson you can point a domain or subdomain at your VPS with A and AAAA records, set up your server's reverse DNS correctly, and check that name and address match in both directions.
Key concepts: A record, AAAA record, TTL, one subdomain per service, www, server hostname, PTR, reverse DNS, forward-confirmed reverse DNS (FCrDNS), CAA, forgetting IPv6
From IP address to name
So far you have reached your server by its IP address, for example ssh anna@192.0.2.10. For a website, a certificate (lesson 7.3) and the services from module 9 you need a name. You create that link in your domain's DNS, wherever your DNS is managed: your registrar, your hosting company or a DNS service. The VPS itself plays no part in this; your server doesn't "know" which names point to it.
You learned the basics of DNS in the DNS course. For a VPS you mainly need two records:
| Record | What | Example |
|---|---|---|
| A | name to IPv4 address | web1.example.com. 3600 IN A 192.0.2.10 |
| AAAA | name to IPv6 address | web1.example.com. 3600 IN AAAA 2001:db8::10 |
Your VPS usually has a fixed IPv4 and a fixed IPv6 address. In that case, set both records. Visitors with IPv6 (in the Netherlands a large share of home connections and mobile networks) will then use IPv6, everyone else IPv4.
Which names do you create?
A common layout for a VPS with a website and a few services:
web1.example.com. A 192.0.2.10 ; the server itself (hostname, PTR)
web1.example.com. AAAA 2001:db8::10
example.com. A 192.0.2.10 ; the website
example.com. AAAA 2001:db8::10
www.example.com. CNAME example.com.
status.example.com. CNAME web1.example.com. ; Uptime Kuma (les 9.4)
kluis.example.com. CNAME web1.example.com. ; Vaultwarden (les 9.4)This layout includes a few choices:
- The server has its own name (
web1), separate from the website. You use that name for SSH, for reverse DNS and as the system's hostname. If the website later moves to another server,web1simply stays correct. - One subdomain per service. Uptime Kuma and Vaultwarden each get their own name. That is much simpler (and safer) than putting services under a path such as
example.com/kluis: each service gets its own certificate, cookies don't get mixed up, and you can later move a service to another server by changing one record. - CNAME for the subdomains. A CNAME to
web1means that if the server's IP address changes, you only update the records ofweb1. The bare domain name (example.com) cannot have a CNAME; there you set A and AAAA.
You set the hostname of the system itself on the server:
anna@web1:~$ sudo hostnamectl set-hostname web1.example.com
anna@web1:~$ hostname -f
web1.example.comAlso check that /etc/hosts doesn't contain an old name. A correct hostname matters most if the server ever sends mail.
TTL: how quickly a change shows up everywhere
The TTL (time to live) is the number of seconds resolvers may remember an answer. With 3600 it can take up to an hour before everyone sees a new address. Moving a website to your VPS? Set the TTL to 300 (five minutes) a day in advance, wait at least the old TTL, change the address, and then raise the TTL again. This is exactly the step-by-step plan from the DNS course, lesson 6.3.
Use dig (DNS course lesson 8.2) to check what the rest of the internet sees, and ask a public resolver rather than your own computer:
anna@laptop:~$ dig +short A example.com @1.1.1.1
192.0.2.10
anna@laptop:~$ dig +short AAAA example.com @1.1.1.1
2001:db8::10On Windows: Resolve-DnsName example.com -Type AAAA -Server 1.1.1.1.
The pitfall: an AAAA record without working IPv6
If you set an AAAA record, the service must really be reachable over IPv6. A common mistake: the record is there, but the web server only listens on IPv4, or the firewall blocks IPv6 (lesson 5.2), or IPv6 isn't configured on the VPS. Visitors with IPv6 then get a slow or broken site, while it "just works" for you because you might only have IPv4 at home. Let's Encrypt also tries IPv6 first when there is an AAAA record (lesson 7.3). If your server gives a different answer over IPv6 than over IPv4, the certificate request fails.
So test IPv6 separately, from another machine that has IPv6: curl -6 -I https://example.com. If you don't have IPv6 yourself, use an online test such as internet.nl.
Reverse DNS: from address back to name
Reverse DNS links an IP address back to a name, using a PTR record (DNS course lesson 4.6). That record isn't in your domain's zone but in the zone of the IP address, which belongs to whoever manages the address: your VPS provider. So you set the PTR in your provider's panel, not in your own DNS.
Why would you do this?
- Mail. Receiving mail servers reject or distrust mail from an address without proper reverse DNS. If your VPS sends mail (even just a notification from a form), this is a must (see the Email in order course, lesson 5.1).
- Recognisability. In logs and traceroutes, others see
web1.example.cominstead of a generic provider name. - Tidiness. Some services and spam filters give penalty points to addresses with a generic or missing PTR.
The rule is forward-confirmed reverse DNS (FCrDNS): the address points to a name with PTR, and that name points back to the same address with A or AAAA. So first create the A and AAAA records, then request the PTR, for both IPv4 and IPv6.
anna@laptop:~$ dig +short -x 192.0.2.10
web1.example.com.
anna@laptop:~$ dig +short A web1.example.com
192.0.2.10
anna@laptop:~$ dig +short -x 2001:db8::10
web1.example.com.
anna@laptop:~$ dig +short AAAA web1.example.com
2001:db8::10If all four return the expected answer, it matches both ways.
CAA: who may issue certificates?
With a CAA record (DNS course lesson 5.2) you state which certificate authorities may issue certificates for your domain. If you only use Let's Encrypt:
example.com. 3600 IN CAA 0 issue "letsencrypt.org"It isn't required, but it's a nice extra layer. Note: if you already have a CAA record with a different authority, Let's Encrypt will refuse your request. So check first with dig CAA example.com.
In practice: reverse DNS in the VPS screen
At WebOké you set reverse DNS in the VPS screen, on the "ISO and rDNS" tab. If your domain's DNS is also at WebOké, the panel can create the A and AAAA records for you straight away; if your DNS is elsewhere, create those records yourself first and then enter the full name. At other providers this is called "Reverse DNS", "rDNS" or "PTR" in the customer panel; some require you to request it through a ticket. It works the same everywhere: first the name to the address, then the address to the name.
Summary
- You link a name to your VPS with an A record (IPv4) and an AAAA record (IPv6), in your domain's DNS.
- Give the server its own name (
web1.example.com) and each service its own subdomain; CNAMEs to the server name make moving easy. - Lower the TTL before a move and check with
digagainst a public resolver. - Don't set an AAAA record if the service doesn't really work over IPv6; test IPv6 separately.
- You set the PTR at your VPS provider; it must match both ways (FCrDNS), for IPv4 and IPv6.
Quiz
Exercise
Exercise Z7.1: A, AAAA and PTR of your server. Give your server its own name (for example web1.<jouwdomein>), create the A and AAAA records and set up reverse DNS at your provider. In the exercise, enter your server's name, its IPv4 and IPv6 addresses, and the name you got from dig -x for both addresses. The program looks up the A and AAAA records and the PTR of both addresses live and checks that everything matches both ways. If your server has no IPv6, it only checks IPv4 and reports this in orange.