How to point a domain to your VPS (including via Cloudflare)

For a website, panel or other service on your VPS to work under your domain, the domain has to point to the VPS's IP address. We'll show which records to create with a regular DNS provider and in Cloudflare, when to turn on Cloudflare's proxy and when not to, and how to fix typical errors.

What you'll set up#

In the customer area, open My services, click the VPS and in the Network tab copy the IPv4 address (for example 203.0.113.10) and IPv6 address (for example 2001:db8::10).

Replace example.cz with your domain and the IP addresses with the ones from the Network tab. If you want www to point somewhere other than the root, use its own A record instead of a CNAME.

Creating the records#

First find out where your domain's DNS runs: either at your registrar or elsewhere (for example in Cloudflare). You can check with nslookup -type=NS example.cz (Windows) or dig +short example.cz NS (macOS, Linux). Edit the records where the nameservers point.

New records usually show up within a few minutes. A change to an existing record takes effect only after its old TTL expires.

Adding a domain to Cloudflare#

You do this only once, if you want to manage DNS in Cloudflare. Cloudflare changes its interface from time to time; the names below match its documentation as of October 1, 2026.

1. In Cloudflare, open Domains and click Onboard a domain.
2. Enter the root domain (example.cz, without www) and continue.
3. Choose a plan. The free one is enough for pointing a domain.
4. Review the records Cloudflare found. Add any that are missing (especially email MX and TXT records, if you use the domain for email) and delete incorrect ones.
5. If DNSSEC is turned on for the domain at your registrar, turn it off at the registrar before changing the nameservers. Otherwise the domain stops working after the change.
6. At your registrar, replace the current nameservers with the two nameservers Cloudflare assigned to you. Copy them exactly.
7. Wait until Cloudflare shows the Active status (usually within 24 hours; you'll also get an email).
8. Optionally turn DNSSEC back on afterwards, this time through Cloudflare.

DNS only or Proxied?#

Every A, AAAA and CNAME record in Cloudflare has a Proxy status:

• Proxied (orange cloud): visitors connect to Cloudflare's servers, which forward the traffic to your VPS. Cloudflare adds protection and caching and hides the VPS's IP address. It works only for websites (HTTP and HTTPS) on supported ports: HTTP 80, 8080, 8880, 2052, 2082, 2086, 2095 and HTTPS 443, 2053, 2083, 2087, 2096, 8443.
• DNS only (gray cloud): Cloudflare only answers with the VPS's IP address and doesn't touch the traffic. It works for everything.

Proxied records always have the TTL set to Auto (300 seconds) and can be used only with A, AAAA and CNAME types.

SSL/TLS mode in Cloudflare#

When a website is Proxied, there are two connections: between the visitor and Cloudflare, and between Cloudflare and your VPS. The second one is set by the mode in Cloudflare, in the SSL/TLS section on the Overview page.

Cloudflare also offers automatic mode selection (Automatic SSL/TLS), which picks the most secure mode your server can handle. It's more reliable to set Full (strict) by hand once you have a certificate on the VPS.

Firewall on the VPS#

For the website to respond, ports 80 and 443 (TCP) must be open on the VPS:

• in the firewall in the customer area: Firewall in the customer area,
• in the firewall inside the VPS, if you use one: UFW.

Verification#

1. Check where the domain points:

   dig +short example.cz A
   dig +short www.example.cz A

   • dig +short – prints only the record's value.
   • example.cz A – the name and record type.

   With DNS only you'll see the VPS's IP address. With Proxied you'll see Cloudflare's IP addresses, which is fine. On Windows, use nslookup example.cz.

2. Check that the website responds:

   curl -I http://example.cz

   • curl – fetches the web server's response.
   • -I – only the response headers, without the page content.

   The response starts with a status line, for example HTTP/1.1 200 OK or a 301 redirect. With a Proxied record, the headers include server: cloudflare.

   On Windows, type curl.exe -I http://example.cz in PowerShell. Plain curl in Windows PowerShell is an alias for a different command (Invoke-WebRequest) that doesn't know the -I switch.

3. Open the domain in your browser.

For the web server and HTTPS, continue with Website on a VPS: Nginx and Let's Encrypt; for Minecraft on your own domain, with Server address and domain.

Troubleshooting#

Cloudflare shows Error 521: Web server is down#

Cloudflare reached the VPS, but the VPS refused the connection. No web server is running on the VPS, or it isn't listening on the right port.

systemctl status nginx
ss -tlnp | grep -E ':(80|443) '

• systemctl status nginx – shows whether the Nginx service is running (active (running)).
• ss -tlnp – lists listening ports: -t TCP, -l listening only, -n numbers instead of names, -p the program holding the port.
• grep -E ':(80|443) ' – keeps only the lines with ports 80 and 443.

If Nginx isn't running, start it (systemctl start nginx) and look for the error in the status output. If it is running, check the firewall: ports 80 and 443 must be allowed for Cloudflare's IP addresses too.

Error 522: Connection timed out#

Cloudflare couldn't reach the VPS at all. Most often the firewall is dropping the traffic (port 80/443 isn't allowed), the DNS has the wrong IP address, or the VPS is stopped or overloaded. Compare the IP in the record with the Network tab and check the firewall rules.

ERR_TOO_MANY_REDIRECTS (too many redirects)#

Cloudflare is in Flexible mode and the server redirects HTTP to HTTPS. Cloudflare connects to the server over HTTP, the server sends it to HTTPS, and round it goes. Set the mode to Full (strict) (the VPS needs a certificate).

Error 526: Invalid SSL certificate#

The mode is Full (strict) and Cloudflare didn't accept the certificate on the VPS: it has expired, was issued for a different name, or is self-signed. Get a valid certificate for exactly this domain (and for www too, if you use it), or temporarily switch the record to DNS only. Full mode would hide the error because it doesn't check the certificate, but the connection to the VPS would then be unverified.

Error 525: SSL handshake failed#

The mode is Full or Full (strict), but an HTTPS connection to port 443 on the VPS couldn't be established. Most often the website on port 443 has no certificate set up at all (the Nginx config is missing a listen 443 ssl block). Set up HTTPS following the Nginx and HTTPS guide, or temporarily switch the record to DNS only.

The website works, but SSH, Minecraft or SFTP over the domain don't#

The record is Proxied. For these services, create a separate subdomain set to DNS only (for example ssh.example.cz or mc.example.cz), or connect directly to the IP address.

Certbot reports a validation error behind Cloudflare#

Temporarily switch the record to DNS only, check that port 80 is open and issue the certificate again. If you have an AAAA record, make sure the website also responds on IPv6, or delete the AAAA record temporarily.

The domain still shows the registrar's parking page#

An old A record is still set for the domain, or the nameservers point somewhere other than where you edited the record. Go through DNS records explained and check the NS.

Further reading#

• Cloudflare: Proxy status (opens in a new window)
• Cloudflare: Network ports supported by the proxy (opens in a new window)
• Cloudflare: SSL/TLS encryption modes (opens in a new window)
• Cloudflare: Adding a domain (full setup) (opens in a new window)
• Let's Encrypt: Challenge types (opens in a new window)