How Domains Find Your VPS: An Introduction to DNS, HTTPS, and Reverse Proxies
A beginner's guide explaining domain names, DNS A and AAAA records, ports, reverse proxies, TLS certificates, and HTTPS, showing how browser requests reach applications hosted on a VPS.
Running curl http://127.0.0.1:3000 on your VPS and seeing HTML proves the application works locally. However, enabling public users to visit https://example.com requires connecting domain names, DNS records, networking ports, reverse proxies, and HTTPS encryption.
While these terms often appear together, they solve distinct problems across the request pipeline.
1. Tracing a Complete Web Request
User enters domain in browser
↓ DNS Lookup
Resolves Server IP Address
↓ TCP 443 + TLS Handshake
Connects to Reverse Proxy on VPS
↓ Forwards to 127.0.0.1:3000
Application returns HTTP responseComponent analogies and responsibilities:
| Component | Analogy | Core Responsibility |
|---|---|---|
| Domain Name | Memorizable Name | Provides a human-readable identifier for your website |
| DNS | Telephone Directory | Resolves domain names into IP addresses and record types |
| IP Address | Street Address | Identifies the physical host or network interface on the internet |
| Port | Room Number | Directs network connections to the appropriate service daemon |
| Reverse Proxy | Reception Desk | Receives public requests and routes them to internal applications |
| TLS Certificate | Verified Passport | Enables clients to verify domain authenticity and encrypt traffic |
DNS does not host or transfer your web pages, nor do TLS certificates "point" domains to servers. Each layer must be configured and validated independently.
2. Common DNS Record Types
| Record | Primary Function | Beginner Considerations |
|---|---|---|
A | Points a hostname to an IPv4 address | Must be updated whenever the server's IPv4 changes |
AAAA | Points a hostname to an IPv6 address | Do not configure if the VPS lacks functional IPv6 connectivity |
CNAME | Aliases one hostname to another | Cannot typically coexist with other records at the apex zone |
TXT | Holds text for domain verification, SPF, etc. | Never paste unverified challenge tokens from untrusted sources |
To direct www.example.com to a VPS with a public IPv4 address, you add an A record. DNS provider interfaces vary, so refer to their official documentation.
DNS updates do not propagate instantaneously to all users worldwide. Recursive resolvers and client operating systems cache records according to configured TTL (Time to Live) values. When migrating servers, lower TTLs in advance to prevent prolonged DNS caching friction.
3. Why Reverse Proxies Are Crucial
A single VPS often hosts multiple applications:
blog.example.com → 127.0.0.1:3000
api.example.com → 127.0.0.1:4000A reverse proxy (such as Nginx or Caddy) listens on public ports 80/443 and routes incoming requests to the appropriate backend process based on the requested domain name. It also handles TLS termination, request logging, gzip/brotli compression, and rate limiting.
This architecture prevents backend processes from having to manage raw public ports. It separates concerns clearly:
- Validate backend application health on localhost;
- Validate reverse proxy upstream forwarding;
- Validate DNS resolution and public HTTPS delivery.
A reverse proxy is not an anonymization tool or an automatic vulnerability patcher—it is an HTTP gateway.
4. What HTTPS Actually Protects
HTTPS encrypts standard HTTP communication over a TLS connection. When functioning properly, it provides:
1. Authentication: Clients verify the certificate matches the intended domain; 2. Confidentiality: Payloads are encrypted, preventing passive eavesdropping; 3. Integrity: In-transit tampering or data corruption is detected immediately.
HTTPS does not certify that the website owner is trustworthy, nor does it make vulnerable application code secure. It protects the communication channel, not server-side data integrity.
Certificate Authorities like Let’s Encrypt automate certificate issuance and renewals via the ACME protocol. Verification requires passing automated domain validation challenges:
HTTP-01: Validates by placing a challenge file at an HTTP path; requires the validation server to reach port 80;DNS-01: Validates via a DNS TXT record; does not require exposing web ports 80 or 443;TLS-ALPN-01: Validates via a specialized TLS handshake on port 443.
Most standard web servers use HTTP-01. Confirm which challenge type your ACME client utilizes rather than conflating their networking requirements.
5. Beginner Deployment Workflow
1. Start your application on the VPS, ensuring it binds strictly to the intended localhost address; 2. Verify application responses and port bindings locally (curl -I http://127.0.0.1:3000); 3. Install and configure a reverse proxy from official repositories; 4. Validate reverse proxy configuration syntax before reloading or restarting; 5. Add authoritative DNS records and verify resolution using public DNS resolvers; 6. Ensure firewalls permit required public ports (port 80 must be accessible if using HTTP-01); 7. Request a TLS certificate using a trusted ACME client; 8. Test HTTPS access from an external network, checking certificate validity, HTTP status codes, and headers; 9. Verify automatic renewal timers rather than waiting until certificate expiration.
Follow the current official documentation for Nginx, Caddy, or your chosen web server rather than copying outdated configuration snippets from historical blogs.
6. Layered Troubleshooting Guide
Domain resolves to old server IP
Check authoritative DNS records, TTL settings, and local DNS cache. Do not reinstall web daemons before confirming traffic reaches the new VPS.
IPv4 works, but certain users report connection failures
Inspect for incorrect AAAA records. IPv6-capable clients will prioritize IPv6; if your server or firewall does not properly route IPv6 traffic, connections will time out.
Reverse proxy returns HTTP 502 Bad Gateway
The reverse proxy is operational, but cannot connect to the backend application. Check if the application process is running, verify its listening address and port, and test localhost requests.
ACME Certificate issuance fails
Inspect the specific ACME challenge error: HTTP-01 requires public reachability on port 80; DNS-01 requires valid TXT records and DNS API permissions; TLS-ALPN-01 requires port 443. Verify system clocks are synchronized via NTP.
HTTPS works, but backend ports are also exposed publicly
Check if the application binds to 0.0.0.0 and verify whether firewall rules expose backend ports. Backends should generally bind to localhost when fronted by a reverse proxy.
7. Summary
Domain names, DNS, HTTPS, and reverse proxies are not competing alternatives—they are specialized links in a delivery chain: DNS resolves the IP, network routing delivers traffic to port 443, TLS establishes authenticated encryption, and reverse proxies hand requests to backend applications.
Troubleshooting along this chain systematically is far more reliable than randomly flushing caches and rebooting servers.
Frequently Asked Questions
Can I use HTTPS with only an IP address and no domain?
While IP-specific certificates exist for specialized enterprise scenarios, standard personal projects use domain-based certificates. Domains also allow migrating servers without forcing users to remember new IP addresses.
What happens if I enable CDN proxying at my DNS provider?
Clients connect to the CDN provider's edge network first, which then proxies requests to your origin server. Caching, TLS handshakes, client IP headers, and firewall rules add an extra layer that must be configured per the CDN provider's documentation.
Once issued, do certificates require further maintenance?
Yes. Short-lived automated certificates rely on scheduled background renewal jobs. Monitor renewal timers, log outputs, and expiration dates regularly.
Sources
Share