What is an FQDN? Fully qualified domain names explained, found and set on a server

Short answer: a fully qualified domain name (FQDN) is the complete DNS name of one host, from its own label up to the top-level domain. web01.example.com. is the FQDN of the host web01 in the domain example.com. Strictly, it ends with a dot that stands for the DNS root; in everyday writing the dot is left out, and web01.example.com still counts as fully qualified. A bare web01 is a short host name that only works where something fills in the rest.

On a server the difference is practical: mail servers introduce themselves with the FQDN, TLS certificates are issued for it, and reverse DNS has to point at it. Below: the rules, how to find the FQDN on Linux and Windows, how to set it on a VPS so it survives a reboot, and where a wrong one breaks things.

What are the parts of an FQDN?

A DNS name is read from right to left, one label per level of the tree. How a resolver walks that tree from the root servers down is explained in What is DNS.

• Label length: 1 to 63 characters each (RFC 1035, section 2.3.4).
• Total length: at most 255 octets in the wire format, where every label carries a length byte and the root counts as one (RFC 9499). Written out without the final dot, that leaves 253 characters.
• Characters: letters, digits and hyphens, not starting or ending with a hyphen. Since RFC 1123 a label may start with a digit. Underscores appear in service names such as _dmarc, but are not allowed in host names.
• Case: DNS ignores it; WEB01.Example.COM is the same name. Non-ASCII names are stored as punycode labels starting with xn--.
• Linux: the system hostname is limited to 64 characters (stated in man hostnamectl). A longer FQDN can still resolve, through /etc/hosts or DNS, with a short name as the hostname.

Why does the trailing dot matter?

The final dot says “this name is complete, append nothing”. Two places make it visible.

Zone files

In a BIND-style zone file, a name without the final dot is relative and gets the zone’s origin appended (RFC 1035, section 5.1). Forgetting the dot on a target is one of the classic DNS mistakes:

$ORIGIN example.com.
www    3600  IN  CNAME  web01.example.com.   ; correct
api    3600  IN  CNAME  web01.example.com    ; becomes web01.example.com.example.com.

Web panels of DNS providers usually add the dot for you, but some take a target literally. If a CNAME resolves to a name with your domain in it twice, this is why.

Search domains

Resolvers complete short names. On Linux, /etc/resolv.conf can list search domains; a name with fewer dots than the ndots option (default 1) gets them appended first, so web01 becomes web01.example.com. Names with a dot are tried as written first, and a name with the trailing dot is never extended. Windows’ nslookup goes further: Microsoft documents that it appends the default DNS domain to a name without the final dot, depending on its search settings, so on a company network nslookup example.com. with the dot is the safe spelling. The nslookup command guide shows how to read those answers.

FQDN vs hostname vs domain vs URL

A domain’s apex can be an FQDN as well: example.com is the full name of whatever its A record points to. A wildcard such as *.example.com is a pattern for many names, not the FQDN of any one host. In an e-mail address the part after the @ is a domain; its MX records decide which hosts take the mail.

How do I find the FQDN on Linux?

hostname
hostname -f
hostname -s
getent hosts "$(hostname -f)"
hostnamectl

web01
web01.example.com
web01
203.0.113.10    web01.example.com web01
 Static hostname: web01

• hostname prints the kernel’s host name, normally the value from /etc/hostname. It may be short or full.
• hostname -f asks the resolver for that name’s canonical form, which in practice comes from /etc/hosts first. The man page warns that it depends on the resolver configuration and suggests hostname -A (every name that reverse DNS gives for the machine’s addresses) where possible.
• getent hosts shows the line the system actually uses; the first name after the address is the canonical one.
• hostnamectl shows the static name systemd keeps. dnsdomainname prints only the domain part.

If hostname -f prints only web01, or localhost, the full name is not mapped anywhere; the setup steps below fix that. If it hangs for several seconds, the machine is waiting for DNS to answer a question about its own name, which the same /etc/hosts line also solves. macOS has hostname too, and scutil --get HostName shows the name set in its own configuration.

How do I find the FQDN on Windows?

ipconfig /all

   Host Name . . . . . . . . . . . . : WEB01
   Primary Dns Suffix  . . . . . . . : example.com

The FQDN is the two joined: WEB01.example.com. An empty Primary Dns Suffix, normal on a standalone server, means the machine has no FQDN of its own yet. In PowerShell:

[System.Net.Dns]::GetHostEntry($env:COMPUTERNAME).HostName
Get-CimInstance Win32_ComputerSystem | Select-Object DNSHostName, Domain, PartOfDomain

Two traps: $env:COMPUTERNAME is the NetBIOS name, upper-case and at most 15 characters, not the DNS name. And the Domain property returns the workgroup name, usually WORKGROUP, when the machine is not in a domain, so check PartOfDomain before gluing the two together. To set the suffix, open System Properties (sysdm.cpl), then Computer Name → Change → More, enter it under Primary DNS suffix of this computer, and restart. On a server you reach over Remote Desktop, plan for the session to drop while it reboots.

How do I set the FQDN on a Linux VPS?

The example uses web01.example.com and 203.0.113.10; replace them with your name and your server’s public IPv4 address. The order avoids the sudo: unable to resolve host warning you get when the hostname changes before /etc/hosts knows it.

1. 1Create the DNS record first

   At your DNS provider, add an A record for web01.example.com with the server’s IPv4 address, and an AAAA record if it has IPv6. Point a domain to your VPS walks through the records. Then check it from outside, with the command below or the DNS lookup tool:

   nslookup web01.example.com 1.1.1.1

2. 2Map the name in /etc/hosts

   sudoedit /etc/hosts

   127.0.0.1       localhost
   203.0.113.10    web01.example.com web01
   ::1             localhost ip6-localhost ip6-loopback

   The full name goes first, because the first name after the address is the canonical one; the short name follows as an alias. Debian’s own reference uses 127.0.1.1 for machines without a permanent address and the real IP for those that have one, which a VPS does. If an old 127.0.1.1 line names the previous host name, change that line instead of adding a second one.

3. 3Set the host name

   sudo hostnamectl set-hostname web01

   Debian’s convention is the short name in /etc/hostname and the FQDN in /etc/hosts, as above. Many RHEL-family guides store the full name instead (sudo hostnamectl set-hostname web01.example.com); systemd accepts both, and either way hostname -f returns the FQDN. Since systemd 249 the same command is also spelled hostnamectl hostname web01; set-hostname still works. No reboot is needed, but services that read the name at start-up need a restart, and an installed Postfix keeps its own copy of the old name (see the mail section below).

4. 4Make sure cloud-init does not undo it

   Many cloud images are set up by cloud-init; VMHeaven’s Ubuntu template, for example, receives its addresses, password and SSH key that way. Check whether it manages your hosts file:

   head -n 3 /etc/hosts

   If the first line reads Your system has configured 'manage_etc_hosts' as True, cloud-init rewrites the file from a template at every boot and your edit disappears. Edit the template instead, /etc/cloud/templates/hosts.debian.tmpl on Debian and Ubuntu, and replace its 127.0.1.1 line with your own. On RHEL-family systems the file is hosts.redhat.tmpl, where the same placeholders sit on the 127.0.0.1 and ::1 lines.

   127.0.1.1 {{fqdn}} {{hostname}}

   203.0.113.10 web01.example.com web01

   A setting in /etc/cloud/cloud.cfg.d/ does not help here when the value comes from the provider’s user-data, which takes priority over local configuration files. The host name itself is safe: cloud-init leaves /etc/hostname alone once you have changed it by hand.

5. 5Verify

   hostname -f
   getent hosts web01.example.com

   Both should print web01.example.com. Finally, set the reverse DNS (PTR) of the IP address to the same name; see the mail section below for why.

Why does the FQDN matter on a server?

Mail: EHLO name and reverse DNS

An SMTP client opens with EHLO and its FQDN (RFC 5321, section 4.1.1.1). Receivers treat a bare or invalid name as a bad sign, and Postfix can reject it outright with reject_non_fqdn_helo_hostname. Postfix’s built-in default for myhostname is the system host name if that is already a full name, or the short name with .$mydomain appended, and mydomain then falls back to localdomain. A server named plain web01 can therefore greet the world as web01.localdomain. The Debian and Ubuntu package goes a step further: when it is installed, it writes the result of hostname --fqdn into /etc/postfix/main.cf as myhostname (a short name gets the search domain from /etc/resolv.conf appended), and that value stays there when you rename the server later. So set the FQDN before installing Postfix, and check what it uses:

postconf myhostname mydomain

If it shows an old or short name, write the FQDN into main.cf and reload Postfix:

sudo postconf -e 'myhostname=web01.example.com'
sudo systemctl reload postfix

The second half is forward-confirmed reverse DNS. Google’s sender guidelines require the sending IP to have a PTR record whose host name resolves back to that same IP, and many other receivers check the same. All three should name one FQDN: the EHLO greeting, the PTR record and the A record. On a VMHeaven server you set the PTR yourself in the panel; changes take effect within about 30 minutes, and the name must resolve back to the IP. The mail server check shows the PTR and its forward match for a domain’s mail servers, and SMTP ports covers which ports the server needs. Before you run a mail server on any VPS, read the provider’s acceptable use policy or ask support about outbound mail. The PTR setup step by step is in Reverse DNS and PTR records.

TLS certificates

A certificate lists the names it is valid for in its Subject Alternative Name field, and browsers compare the FQDN in the address bar against that list; a name that is not on it makes Chrome show NET::ERR_CERT_COMMON_NAME_INVALID. Publicly trusted CAs have not issued certificates for internal names like web01 or web01.local since 2015 under the CA/Browser Forum rules, so a server that needs a public certificate needs a public FQDN with a DNS record. A wildcard such as *.example.com covers exactly one label: web01.example.com, but neither example.com nor web01.ams.example.com. The SSL checker shows which names a live certificate covers.

Kerberos and Active Directory

Kerberos service principals are built from the FQDN, such as host/web01.example.com@EXAMPLE.COM. MIT Kerberos canonicalizes the host name with a forward lookup and, by default, a reverse lookup as well (rdns and dns_canonicalize_hostname both default to true). A short host name or a PTR that points elsewhere produces the wrong principal, typically reported as Server not found in Kerberos database. In Active Directory a joined computer’s FQDN is its name plus the domain’s DNS name, which becomes the primary DNS suffix.

Logs, monitoring and SSH

Short names collide: two servers called web01, one in Amsterdam and one in Frankfurt, look identical in a central log or a monitoring dashboard. Names like web01.ams.example.com stay unique. SSH stores host keys under the name you typed, so ssh web01 and ssh web01.example.com keep separate entries in known_hosts; connecting with the FQDN everywhere avoids duplicate entries and confusing key prompts.

Setting the FQDN when you order a server

The hostname field at VMHeaven’s checkout takes a full name such as web01.example.com: letters, digits, dots and hyphens. Use a name under a domain you control, create its A record when the panel shows the IP address, and set the PTR to the same name. After the first boot, hostname -f on a Debian VPS or Ubuntu VPS tells you whether the system agrees.

Frequently asked