Domains and DNS for a server owner
You can switch servers in an evening, but a domain stays with a project for years. Through DNS, the domain points to your server, your mail and third-party services, and a single wrong record can take the site offline or send your emails to spam. Here are the records a VPS owner will need, how caching works, where to keep the zone and how to move to a new server without visitors noticing.
A domain has three independent parts, and it helps to tell them apart. The registrar sells and renews the domain itself. The DNS servers listed at the registrar in the NS records host the zone, the list of the domain's records. The host provides the server with the IP address those records point to. All three roles can be played by one company or by three different ones, and that determines what you will have to change when you move.
The main DNS records
- A is the server's IPv4 address for a name (RFC 1035). A website usually needs two: one for
example.comand one forwww.example.com. - AAAA is the same for IPv6 (RFC 3596). Add it only if the server really responds over IPv6: browsers try this address first, and broken IPv6 causes delays for some visitors. More on this in the article IPv4 and IPv6 on a server.
- CNAME is an alias: one name points to another name, for example
wwwtoexample.comor a subdomain to a CDN address. Under RFC 2181, a name with a CNAME cannot have any other records, so a CNAME is not placed on the bare domain: it already has NS and SOA records. Some DNS providers work around this with their own ALIAS or ANAME types, but that is an extension of a particular service, not a standard. - MX lists the servers that receive the domain's mail, with a priority: the lower number is the primary. An MX record must point to a name with an A or AAAA record, not to an IP address and not to a CNAME.
- TXT holds arbitrary text. It is used for SPF, DKIM and DMARC for mail and for domain verification codes for search engines and other services. How to write the mail records is explained in the article Mail server on a VPS: SPF, DKIM, DMARC.
- CAA specifies which certificate authorities may issue certificates for the domain (RFC 8659). The record is optional, but if it exists, an authority not named in it will refuse to issue. Certificates are covered in the article SSL certificates: free and paid.
A typical zone for a site on a VPS with mail at a third-party service looks like this: A and AAAA records for the domain and www, the mail service's MX, TXT with SPF and DMARC, CNAME or TXT for DKIM and a few TXT records with service verifications.
TTL: why changes do not show up immediately
TTL is the time in seconds for which the DNS servers of internet providers and visitors' devices remember an answer (RFC 2181, section 8). Until it expires, they do not query the zone again, so a new record reaches everyone no sooner than the TTL of the old one. That is where the common saying "DNS takes up to 72 hours to update" comes from: in reality, everything depends on the TTL you set yourself.
- 3,600 seconds (an hour) is a sensible value for normal operation;
- 300 seconds is for the period of a move or setup, when you may need to change the address quickly;
- a day or more is for records that do not change for years, such as MX.
The absence of a record is cached too. If you query a subdomain before you have created it, the negative answer is remembered for the period set in the zone's SOA record (RFC 2308), often an hour. So create the record first and only then check it.
NS records at the registrar are a special case. Their TTL is set not by the domain owner but by the top-level zone. A query to the zone servers on 6 November 2026 showed that NS records for .com domains are cached for 172,800 seconds, that is two days, and for .ru domains for 345,600 seconds, four days. Changing a domain's DNS servers therefore always takes longer than changing an A record.
PTR: the reverse record for mail
Ordinary records translate a name into an address, while PTR translates an address into a name: 203.0.113.10 → mail.example.com. It does not live in your domain's zone but in the address zone in-addr.arpa or ip6.arpa, which is managed by the owner of the IP address, that is, the host. You set it in the host's control panel or through support.
A website does not need PTR, but mail does: Google requires senders to have a PTR record for the server's IP address and for the name in it to point back to the same address. Before buying a VPS for mail, check whether the host lets you change PTR and whether outgoing port 25 is open; such servers are collected in VPS for a mail server.
Where to keep the zone: registrar, host or a separate DNS service
- At the registrar. Free and independent of the host: when you change servers, you change one A record. The downsides are a limited choice of record types, no API or a restricted one, and response speed that depends on the registrar's infrastructure.
- At the host. Convenient when everything is in one panel, and some hosts fill in the zone for you. But if you move to another host, you will have to move the zone as well, and if the account is suspended or there is a dispute, DNS becomes unavailable along with the server, and with it your mail and all subdomains.
- A separate DNS service. Servers in different countries with anycast, fast responses, an API for automation and for issuing wildcard certificates, and a change history. Many offer free basic plans. It suits projects with several servers or those that use a CDN.
The rule for every option: the registrar account and the domain must belong to the project owner, not to a contractor or the host. According to the accsly.io catalog as of November 2026, a free domain is mentioned in 494 shared hosting plans from 153 of 1,655 hosts, usually with annual payment. Before accepting such an offer, find out in whose name the domain is registered and how much it costs to renew in the second year. Hosting plans are collected in the section Website hosting.
Protect the domain itself as you would money: two-factor login at the registrar, auto-renewal with a valid card and an up-to-date owner email. Under the current ICANN rules, a domain in generic zones such as .com cannot be transferred to another registrar for 60 days after registration or a transfer, so it is better to choose the registrar right away.
How to move a site without downtime
- A day or two in advance, lower the TTL of the A and AAAA records to 300 seconds and wait for the old TTL to expire.
- Prepare the new server and test the site on it before changing DNS:
curl --resolve example.com:443:203.0.113.10 https://example.com/or an entry in thehostsfile on your computer. - Change the A and AAAA records to the new address. Within a few minutes most visitors will be on the new server.
- Do not switch off the old server for at least a day: devices with the cached address will still connect to it. If the site accepts data, make the old copy read-only for the duration of the move so that orders and comments do not end up split between two databases.
- Restore the TTL to its normal value once everything works.
The full procedure for moving files, the database and mail is described in the article How to move a website from shared hosting to a VPS.
If you are changing the domain's DNS servers along with the server, do it as a separate step. First copy all the records to the new zone and compare the answers from the old and new servers: dig @new-ns example.com MX, and so on for each record type. Only then change the NS records at the registrar, and keep the old zone working for at least the delegation TTL: two days for .com and four for .ru. If DNSSEC is enabled for the domain, remove the DS record at the registrar before changing NS or migrate the keys following the scheme in RFC 6781: otherwise DNSSEC-validating resolvers will stop resolving the domain.
How to check
The command dig example.com A +short shows the current answer, while dig example.com A +trace shows the path from the root servers to yours and helps you find which server is returning the old record. dig -x 203.0.113.10 checks PTR. To see the TTL remaining in a particular resolver's cache, query it directly without +short. If the site is behind a CDN, the A record will point to the CDN rather than to your server; how this works is explained in the article CDN: when a website needs one.