DEV Community: Volyte

How to Point Your Domain to Your VPS (DNS A Record + Free SSL)

Volyte — Fri, 30 Oct 2026 08:19:46 +0000

You have a VPS and a domain name. To make example.com open your website, you add one small DNS record that says "this domain lives at this server's IP address". It takes about 5 minutes to set up, and usually works within an hour.

This guide works wherever your domain is registered — GoDaddy, Hostinger, Namecheap or anyone else — and for Linux and Windows VPS.

What you need

Your VPS IP address — in your provider's welcome email or client area. We'll use the example 203.0.113.25.
A login to wherever your domain's DNS is managed — usually your domain registrar. If you use Cloudflare, make the changes in Cloudflare instead.
Your website ready on the VPS — or set it up after Step 3 while DNS updates.

Step 1: Find where your DNS is managed

Your DNS is managed wherever your domain's nameservers point. Open your registrar's domain page and look at "Nameservers":

If they are the registrar's own (for example ns1.registrar.com), edit DNS at the registrar.
If they say something like xxx.ns.cloudflare.com, edit DNS in your Cloudflare account.

Step 2: Add the A records

An A record connects a name to an IPv4 address. Add (or edit) these two records:

Type	Name / Host	Value / Points to	TTL
A	`@` (the domain itself)	`203.0.113.25`	Auto or 1 hour
A	`www`	`203.0.113.25`	Auto or 1 hour

Some panels want the full name instead of @ — type example.com.
Instead of the second A record, you can use a CNAME: name www, value example.com. Either works.
Delete any old A records for @ and www that point somewhere else (such as a "parked" page). Two different A records for the same name make visitors land on either server at random.
If there is an AAAA record (IPv6) pointing to your old host, delete it too — or change it to your VPS's IPv6 address if it has one.

Don't touch your MX records. They decide where your email goes. Changing A records moves your website only — your email keeps working where it is.

Step 3: Check that DNS has updated

Changes usually show within 5–60 minutes. Sometimes it takes a few hours, because internet providers remember (cache) the old address until the old TTL runs out.

On Windows, open Command Prompt and type:

nslookup example.com 8.8.8.8

On Mac or Linux:

dig +short example.com @8.8.8.8

When it shows your VPS IP (203.0.113.25), DNS is ready. You can also check from many countries at once with a free online "DNS checker".

Step 4: Tell your web server about the domain

DNS sends visitors to your server — now the server must know which website to show for that domain.

cPanel / Plesk: add the domain in the panel (cPanel: Domains → Create a New Domain; Plesk: Websites & Domains → Add Domain). Done — skip to Step 5.
Nginx: put both names in your site's server_name line, then reload:

server_name example.com www.example.com;

sudo nginx -t && sudo systemctl reload nginx

Apache: set ServerName example.com and ServerAlias www.example.com in your virtual host, then sudo systemctl reload apache2.
Windows VPS (IIS): in IIS Manager, open your site → Bindings → add example.com and www.example.com on port 80.

Make sure ports 80 and 443 are open in your server's firewall.

Step 5: Add a free SSL certificate (HTTPS)

Once the domain opens your site, add HTTPS so browsers show the padlock. It's free with Let's Encrypt.

cPanel / Plesk: AutoSSL (cPanel) or the Let's Encrypt extension (Plesk) does it automatically, usually within minutes.
Nginx on Ubuntu / Debian:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot sets up HTTPS and renews the certificate automatically.

Windows (IIS): use the free win-acme tool, which adds and renews Let's Encrypt certificates for IIS.

SSL only works after DNS points to your VPS — if Certbot says the domain can't be verified, wait a little and try again.

If it doesn't work

What you see	What to do
The old website still shows	DNS hasn't updated for you yet. Check with `nslookup example.com 8.8.8.8`. If that shows the new IP, clear your browser cache or try mobile data.
Sometimes old site, sometimes new	There are two A (or AAAA) records for the same name. Delete the one that points to the old server.
"This site can't be reached"	DNS is fine but the server isn't answering: check the web server is running and ports 80/443 are open in the firewall.
The server's default page appears	Your web server doesn't know the domain yet — repeat Step 4.
Email stopped working	An MX record was changed or deleted. Put back the MX records your email provider gave you.

Originally published on the Volyte blog. Next step: secure your Linux VPS in 10 minutes.

Secure Your Linux VPS in 10 Minutes: 8 First Steps (Ubuntu, Debian, AlmaLinux)

Volyte — Sun, 25 Oct 2026 10:27:47 +0000

A new server with a public IP gets its first login attempts from bots within minutes. The good news: a handful of steps stop almost all of them. Do these right after your VPS is ready — it takes about 10 minutes.

Commands are for Ubuntu and Debian, with the AlmaLinux / Rocky Linux version where it differs. Log in as root with the details from your welcome email.

Golden rule: when you change SSH settings, keep your current session open and test the new login in a second window. If something is wrong, you can still fix it from the first one.

1. Update everything

apt update && apt upgrade -y

AlmaLinux / Rocky: dnf upgrade -y. Reboot if the kernel was updated: reboot.

2. Create your own user with sudo

Working as root all the time is risky — one wrong command can damage the system. Create a normal user (replace deploy with your name):

adduser deploy
usermod -aG sudo deploy

Debian says sudo: command not found? Install it first: apt install sudo -y. AlmaLinux / Rocky: adduser deploy && passwd deploy && usermod -aG wheel deploy.

3. Log in with an SSH key instead of a password

A key is far harder to guess than any password. On your own computer (Windows PowerShell, Mac or Linux terminal), create a key once:

ssh-keygen -t ed25519

Press Enter to accept the defaults (adding a passphrase is a good idea). Then copy it to the server — on Mac / Linux:

ssh-copy-id deploy@203.0.113.25

On Windows PowerShell:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh deploy@203.0.113.25 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

Now open a new window and check you can log in without a password: ssh deploy@203.0.113.25.

4. Turn off root login and password login

Only after the key login works, edit the SSH settings:

sudo nano /etc/ssh/sshd_config

Set these two lines (remove the # at the start if there is one):

PermitRootLogin no
PasswordAuthentication no

On Ubuntu, also check the files in /etc/ssh/sshd_config.d/ — a file such as 50-cloud-init.conf can switch PasswordAuthentication yes back on. Change it to no there too. Then test and restart SSH:

sudo sshd -t && sudo systemctl restart ssh

AlmaLinux / Rocky: the service is called sshd — sudo systemctl restart sshd. Test the login again in a new window before closing the old one.

Optional: moving SSH from port 22 to another port (for example 2222) doesn't make it unbreakable, but it cuts automated login attempts dramatically. If you do, open the new port in the firewall (Step 5) before restarting SSH. On Ubuntu 24.04, also run sudo systemctl daemon-reload && sudo systemctl restart ssh.socket.

5. Switch on the firewall

Allow only what you use — SSH, and web traffic if you host websites:

sudo ufw allow OpenSSH
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status

Changed the SSH port? Use sudo ufw allow 2222/tcp instead of OpenSSH. AlmaLinux / Rocky use firewalld, which is on by default and already allows SSH:

sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload

6. Block repeated login attempts with Fail2ban

sudo apt install fail2ban -y
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

Fail2ban bans an IP for a while after several failed logins. On Ubuntu the SSH protection is on out of the box. On Debian 12, if Fail2ban doesn't start, create /etc/fail2ban/jail.local with these lines and restart it — Debian 12 keeps logs in the system journal instead of auth.log:

[sshd]
backend = systemd

AlmaLinux / Rocky: install it from EPEL (sudo dnf install epel-release -y && sudo dnf install fail2ban -y) and turn on the sshd jail in /etc/fail2ban/jail.local.

7. Install security updates automatically

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades

Choose Yes. Security fixes now install by themselves every day. AlmaLinux / Rocky:

sudo dnf install dnf-automatic -y
sudo systemctl enable --now dnf-automatic.timer

(Set apply_updates = yes in /etc/dnf/automatic.conf so updates are installed, not just downloaded.)

8. Take a snapshot and set up backups

Security also means being able to recover. Now that the server is clean and configured, take a snapshot from your hosting control panel — if anything goes wrong later, you can roll back in minutes. Turn on automatic backups too, so you always have a recent copy kept off the server.

Quick check: what is listening?

See which services accept connections from the internet:

sudo ss -tulpn

Anything you don't recognise or don't need (an old database open to the world, a test app) — stop it, or allow it only from your own IP.

Your checklist

Step	Done when…
Updates	`apt upgrade` shows nothing left to install
Own sudo user	`sudo whoami` prints `root`
SSH key	You log in without typing the server password
No root / password login	`ssh root@your-ip` is refused
Firewall	`ufw status` shows active with only the ports you need
Fail2ban	`fail2ban-client status sshd` shows the jail running
Auto updates	unattended-upgrades (or dnf-automatic) is enabled
Snapshot + backups	A snapshot exists and backups are on

Originally published on the Volyte blog. Next step: point your domain to your VPS.