Pointing a Domain at a Reverse Proxy: DNS Records Explained
In this article
To point a domain to a reverse proxy, you swap the origin IP in the domain’s A record (and the AAAA record, if you run IPv6) for the proxy’s IP. From then on the proxy forwards every request to your server. Simple enough on paper. Below: which records to touch, why you drop the TTL first, how to switch without downtime and what to check once it’s done.
What Happens When You Point a Domain to a Reverse Proxy?
Visitors and crawlers now resolve the domain to the proxy IP, and the proxy hands each request to the origin server IP, which nobody outside needs to see anymore. Two terms, quickly. The origin server is the box where the site actually lives. The reverse proxy is the public front door: it takes the traffic first and passes it along.
Resolution itself is boring (in a good way). A visitor’s resolver asks the authoritative name server about the domain, gets the record back and caches it for a while. That caching is baked into how the DNS resolves names. And it’s exactly why a DNS switch never lands everywhere at once.
Which DNS Records Do You Need to Change?
Usually just the A record for the apex domain and www, plus AAAA if the domain has IPv6. Everything else stays put.
- A record for the reverse proxy: point both the apex (@) and www at the proxy’s IPv4 address.
- www as a CNAME: or point www at the apex, so there’s only one A record to edit.
- AAAA record: point it at the proxy’s IPv6 address.
- Leave alone: MX, TXT and SPF, DKIM keys and any site verification records.
The AAAA record is where people trip. Forget an old one pointing at the origin and every IPv6 visitor walks straight past the proxy. So update it, or delete it if the proxy has no IPv6 address. Subdomains like mail., ftp. or cpanel. that still resolve to the origin give its address away too. Go through them one by one and decide.
Lower the DNS TTL Before Switching
Drop the TTL on the records you’re about to change well ahead of the switch, so resolvers let go of the old IP fast once you update them. TTL (time to live) is how long a resolver is allowed to cache an answer.
First, check what you have now: dig example.com A. The number next to the record is the remaining TTL. Lower it in your DNS panel. Then wait. At least as long as the old TTL, because caches keep the earlier value until it runs out. Once the proxy has been running without surprises, bump the TTL back up to cut down on lookups.
How to Switch DNS to the Proxy Without Downtime
Set up and test the proxy before DNS gets touched, so the record change comes last, not first.
- Add the domain and the origin server IP in the proxy panel. With Jalvo you can set up the reverse proxy on NGINX, using IP addresses in the EU or the USA, and point domains from one panel.
- Make sure the origin actually answers requests coming from the proxy address.
- Test through the proxy before switching:
curl --resolve, or a hosts file entry mapping the domain to the proxy IP. - Update the A and AAAA records.
- Ask a few public resolvers with
dig @resolver example.comand compare what comes back. - Watch the origin logs until requests start showing up from the proxy IP.
Keep the origin up on its old address the whole time. Anyone whose resolver still has that IP cached will keep reaching the site while the new record spreads. No gap, no angry emails.
How Do You Keep the Origin Server IP Hidden?
Once the proxy is live, allow HTTP and HTTPS on the origin only from the proxy IPs. Otherwise the old address is a side door around the proxy. One firewall rule on the origin does the job.
Is that the end of it? Not quite. The address can still leak through historical DNS records, subdomains pointing at the origin and headers in emails sent by the origin server. On your own origin NGINX, log the real client IP from the header the proxy sets. And look at an actual request to see which header arrives, rather than guessing its name (people guess wrong here more often than you’d think).
The IPs visitors and crawlers see carry their own signals, too, so reverse DNS and PTR records are worth a look. Moving addresses for several domains at once? Our guide on moving sites to new IPs covers the SEO side.
Checklist After You Point the Domain to the Reverse Proxy
You’re done when every resolver you check returns the proxy IP, the site answers over HTTPS through the proxy and the origin only accepts traffic from the proxy.
- A and AAAA records return the proxy address.
- The SSL certificate on the proxy is valid for the apex and www.
- Redirects and canonical tags behave exactly as before.
- Email goes out and comes in normally.
- The TTL is back at its usual value.
One thing to take away? The order. TTL down first, test with curl --resolve, and only then change the record. Do it in that sequence and you can point a domain to a reverse proxy without visitors noticing a thing. For more on this, browse our technical SEO articles on hosting.
FAQ
How long does it take for DNS changes to reach all visitors?
Depends on the TTL the record had before the change and on how resolvers treat their caches. Lowering the TTL ahead of time shortens the transition, since cached copies of the old IP expire sooner.
Do I need to change MX records when I point my domain to a reverse proxy?
No. Mail follows the MX records, not the web A record, so leave them alone. Do check, though, that the mail host name doesn’t resolve to the origin and give its address away.
What happens if I forget the AAAA record?
IPv6 clients keep connecting straight to the origin and skip the proxy. Point the AAAA record at the proxy’s IPv6 address, or remove it if the proxy doesn’t have one.
