Pointing a domain at a VPS is two DNS records and a short wait. The confusion is usually about which record type to use and why the change “is not working” five minutes later, which is almost always caching, not a mistake. Here is the whole process.
1. Get your server’s IP addresses
ip -4 addr show # your IPv4
ip -6 addr show # your IPv6, if assigned2. Create the records at your DNS provider
In your registrar or DNS host’s panel, add an A record for IPv4 and, if you have one, an AAAA record for IPv6:
Type Name Value TTL
A @ 203.0.113.10 3600
AAAA @ 2001:db8::10 3600
CNAME www example.com. 3600@is the root domain (example.com).- The
wwwCNAME points the subdomain at the root, so both resolve. - Lower the TTL to 300 before a planned move so changes propagate faster.
Which panel holds these records depends on where the domain’s nameservers point. What nameservers are explains how to check that, and why you rarely need to change them.
3. Verify it resolves
dig +short example.com
dig +short AAAA example.com
# query a public resolver directly to bypass local cache
dig @1.1.1.1 example.comIf dig shows your IP but the browser does not, your machine cached the old answer. Wait for the TTL to expire or flush the local resolver. If you opened the site in Chrome before the record existed, it may show DNS_PROBE_FINISHED_NXDOMAIN for a while, because resolvers cache “no such name” too. On Windows, nslookup example.com 1.1.1.1 does the job of dig @1.1.1.1. Without a terminal at hand, the DNS lookup tool shows the same A, AAAA and CNAME records, with their TTLs, in the browser.
4. Why it takes a while
DNS changes are not instant. Resolvers worldwide cache the old record until its TTL runs out (usually minutes to a few hours). A record that shows up on dig @1.1.1.1 but not everywhere yet is normal and just needs time. The DNS propagation checker asks twelve public resolvers and your domain’s own name server at once, and shows which of them already return the new address.
5. Add HTTPS once DNS resolves
A certificate can only be issued after the domain points at the server. With that in place, Let’s Encrypt takes one command:
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.comcertbot installs the certificate, edits your nginx config for HTTPS and sets up auto-renewal. From there the site is live on https://.
If the domain is proxied through Cloudflare, set its SSL/TLS mode to Full (strict) now. In Flexible mode Cloudflare fetches every page over plain HTTP, and a server that redirects HTTP to HTTPS sends visitors into ERR_TOO_MANY_REDIRECTS.
Every VMHeaven VPS comes with its own IPv4 address, plus an IPv6 prefix when the location’s pool has one free, so you can point a domain (or many) straight at the box and terminate TLS yourself.
Frequently asked
A record or CNAME?
Use an A record (and AAAA for IPv6) to point the root domain at your server's IP. Use a CNAME to point a subdomain like www at another name, never at an IP.
I changed the record but the site still shows the old server. Why?
DNS is cached until the record's TTL expires. Query a public resolver directly with 'dig @1.1.1.1 example.com' to see the new answer, then wait for caches to clear.
When can I get an HTTPS certificate?
Only after the domain resolves to the server. Then 'sudo certbot --nginx -d example.com' issues and installs a free Let's Encrypt certificate with auto-renewal.