Use this guide after you have the correct server IP and an application or web server ready to receive traffic. Buying a server does not automatically change DNS at your domain provider.
1. Update the authoritative DNS zone
- Find the DNS provider responsible for your domain's current nameservers. Save the existing records before editing.
- Create or update the intended hostname's A record to the server's assigned IPv4 address. Add an AAAA record only when IPv6 is configured and reachable on that server.
- Keep unrelated mail, verification and other subdomain records unchanged. For a migration, keep the old server available while cached DNS records expire.
- Check resolution from your computer. Replace the example hostname:
Run each command separately:
nslookup app.example.com
The returned address should match the service. If you deliberately use a CDN proxy, its addresses may appear instead; verify the origin setting in that provider's dashboard. A stale AAAA record can send some visitors to a different server even when the A record is correct.
2. Configure the website and certificate
Set the exact hostname in your web server or reverse proxy and point it to the intended application. Use the existing control panel's certificate function when provided. Do not install a second web server on ports already owned by your panel.
For a self-managed reverse proxy, Caddy can obtain and renew certificates for a public hostname when DNS, network access and certificate-authority validation are correct. Standard HTTP/TLS validation needs the relevant inbound ports; DNS-based validation has different provider requirements. Keep certificate storage persistent and use a scoped DNS token if your selected method needs one.
3. Verify from a browser
- Open the actual HTTPS hostname without bypassing certificate warnings.
- Confirm the certificate covers that hostname and that HTTP redirects correctly.
- Check login, images and a second page for mixed-content or redirect errors.
- Check both IPv4 and IPv6 when both records exist. Monitor certificate renewal rather than checking only the initial issue.
4. Resolve common failures
Wrong site: check the virtual-host name and CDN origin. Certificate pending: check DNS, CAA restrictions, firewall reachability and the certificate log; avoid repeatedly requesting certificates. Redirect loop: align the application's base URL, proxy forwarded scheme and CDN TLS mode. Do not switch off HTTPS as a permanent workaround.
If a migration fails, restore only the DNS/configuration values you changed using your saved record. DNS rollback can also take time to reach cached clients.
Reference: Caddy automatic HTTPS and validation requirements.
Technical guidance reviewed: 28 October 2026. Match instructions to your actual service and application version.
