Point a Domain to a VPS with DNS, Cloudflare, and Nginx

Connecting a domain to a VPS has three separate parts: DNS records point the name to an IP address, Nginx selects the correct site, and HTTPS proves the connection is intended for that name.

1. Create DNS records

At your DNS provider, create records similar to these:

Type	Name	Value	Purpose
A	@	203.0.113.10	Root domain
A	www	203.0.113.10	www hostname
AAAA	@	Your VPS IPv6	Optional IPv6

Add an AAAA record only when IPv6 is configured and reachable on the VPS. An incorrect AAAA record can make some visitors fail even when IPv4 works.

2. Verify resolution

dig +short example.com
dig +short www.example.com
nslookup example.com

The result should be the intended server address. DNS caches mean that changes are not always visible immediately, so check from a second resolver or network when diagnosing propagation.

3. Configure Cloudflare deliberately

If Cloudflare is authoritative for the domain, create the records in Cloudflare and choose the proxy status intentionally:

• DNS-only is simpler while first testing the origin.
• Proxied traffic hides the origin IP and adds Cloudflare features.
• Use Full (strict) once the origin has a valid certificate.

Do not enable a Cloudflare mode that expects HTTPS at the origin before Nginx is configured for HTTPS. It can create redirect loops or origin TLS errors.

4. Configure Nginx for the hostnames

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Validate and reload:

sudo nginx -t
sudo systemctl reload nginx
curl -I -H 'Host: example.com' http://127.0.0.1

The server_name must match the requested hostname. If the default Nginx site appears, inspect enabled site symlinks and the order of server blocks.

5. Add HTTPS after HTTP works

Allow ports 80 and 443 in the VPS firewall, then issue a certificate for every hostname that will be used:

sudo ufw allow 'Nginx Full'
sudo apt install -y certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
sudo certbot renew --dry-run

Troubleshooting

The root domain works but www does not

Check the www DNS record, include www in Nginx’s server_name, and include it in the certificate request.

DNS points correctly but the browser times out

Check UFW, the provider firewall, Nginx status, and whether the service listens on ports 80 and 443:

sudo ss -ltnp | grep -E ':80|:443'
sudo systemctl status nginx

HTTPS returns a Cloudflare error

Check the selected SSL mode, the origin certificate, and whether the VPS accepts Cloudflare traffic. Temporarily use DNS-only to isolate DNS, Nginx, and origin issues.

DNS answers “which address?” Nginx answers “which application?” and HTTPS answers “can this connection be trusted?” All three must agree.