VPS Networking Fundamentals: IP Addresses, DNS, Reverse DNS, and Private Networking
Networking is the foundation of every VPS operation. Many VPS administrators set up their server following a tutorial without fully understanding the networking model, then encounter mysterious issues: email blacklisted (missing PTR record), slow DNS propagation (wrong TTL setting), IPv6 breaking services, or two VPS instances unable to communicate privately. This guide explains VPS networking from first principles with actionable configuration examples.
IP Addresses: What You Get
IPv4 — The Standard Public Address
Every VPS gets at least one public IPv4 address — a 32-bit number in dotted decimal notation (e.g., 203.0.113.47). This is how other computers reach your VPS on the internet.
# View your VPS's IPv4 address
ip addr show eth0 | grep 'inet ' | awk '{print $2}'
# Or query an external service
curl -4 https://ifconfig.meIPv6 — The Modern Standard
IPv6 addresses are 128-bit (e.g., 2001:db8:85a3::8a2e:370:7334). Most VPS providers assign a /64 block. IPv6 is increasingly important as IPv4 address space fills.
# View IPv6 address
ip addr show eth0 | grep 'inet6' | grep -v 'link' | awk '{print $2}'
# Test IPv6 connectivity
curl -6 https://ifconfig.me
# IPv6 troubleshooting tip: if a service fails and you have both IPv4 and IPv6,
# test forcing IPv4 to isolate the issue:
curl -4 https://yourdomain.comDNS Records Explained
A Record — Domain to IPv4
# Maps a domain name to an IPv4 address
yourdomain.com. 3600 IN A 203.0.113.47
www.yourdomain.com. 3600 IN A 203.0.113.47
# Verify with dig
dig yourdomain.com A +short
# Should return: 203.0.113.47AAAA Record — Domain to IPv6
yourdomain.com. 3600 IN AAAA 2001:db8::1
# Verify
dig yourdomain.com AAAA +shortCNAME Record — Domain Alias
# www is an alias for the root domain
www.yourdomain.com. 3600 IN CNAME yourdomain.com.
# cdn subdomain aliased to a CDN hostname
cdn.yourdomain.com. 3600 IN CNAME yourdomain.cloudflare.com.
# CRITICAL: CNAME cannot be used at the zone apex (root domain)
# yourdomain.com CNAME something ← INVALID
# yourdomain.com A 203.0.113.47 ← VALIDMX Record — Mail Routing
# Lower priority number = higher priority (preferred mail server)
yourdomain.com. 3600 IN MX 10 mail.yourdomain.com.
yourdomain.com. 3600 IN MX 20 mail2.yourdomain.com. # Backup
# The mail hostname must have its own A record:
mail.yourdomain.com. 3600 IN A 203.0.113.47TXT Record — SPF, DKIM, DMARC
# SPF: declare which servers can send email for your domain
yourdomain.com. 3600 IN TXT "v=spf1 mx ip4:203.0.113.47 ~all"
# DMARC: email authentication policy
_dmarc.yourdomain.com. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com"
# Verify
dig yourdomain.com TXT +shortReverse DNS (PTR Records) — Critical for Email Deliverability
A PTR record maps an IP address back to a hostname. Most mail servers check PTR records as part of spam filtering — a missing or mismatched PTR record causes email deliverability problems or outright rejection.
# Check your VPS's current PTR record
dig -x 203.0.113.47 +short
# Should return: mail.yourdomain.com.
# If it returns nothing: PTR record is not configured
# Your server's hostname
hostname -fHow to configure PTR records: PTR records are set by the IP address owner — your VPS provider, not your domain registrar. Configure them in your VPS control panel (look for “Reverse DNS” or “PTR Record” in the networking section) or contact support.
The three records must be consistent for email deliverability:
# Step 1: A record (domain → IP)
mail.yourdomain.com. IN A 203.0.113.47
# Step 2: PTR record (IP → domain) — set in VPS control panel
203.0.113.47 → mail.yourdomain.com.
# Step 3: SMTP HELO hostname — set in your mail server config
# Should match: mail.yourdomain.com
# All three must be consistentDNS TTL: Controlling Propagation Speed
TTL (Time to Live) tells DNS resolvers how long to cache a record before checking for updates.
# View TTL for a record
dig yourdomain.com A
# ANSWER SECTION:
# yourdomain.com. 3600 IN A 203.0.113.47
# ^^^^
# TTL in seconds (3600 = 1 hour)
# Best practice for DNS changes:
# 1. At least 24 hours before: reduce TTL to 300 (5 minutes)
# 2. Make your DNS changes
# 3. Wait for old TTL to expire across the internet
# 4. After confirming propagation: restore TTL to 3600 or higherVPS Network Interfaces
# View all network interfaces and addresses
ip addr show
# View routing table
ip route show
# Typical output:
# default via 203.0.113.1 dev eth0 ← All internet traffic uses this gateway
# 203.0.113.0/24 dev eth0 ← Local network
# Check internet connectivity
ping -c 3 8.8.8.8
# Check DNS resolution from the VPS
dig yourdomain.com A @1.1.1.1
nslookup google.comPrivate Networking Between VPS Instances
Option 1: Provider Private Network
Check if your provider includes a private network interface — a secondary interface (eth1) with a private IP not routed over the internet:
ip addr show eth1
# If present: inet 10.0.0.x/24 scope global eth1
# Use private IP for inter-VPS communication:
mysql -h 10.0.0.2 -u user -p mydb
psql -h 10.0.0.2 -U user mydbOption 2: WireGuard Private Network
Create a secure private network between any VPS instances using WireGuard:
sudo apt install -y wireguard
# Generate keypairs on each VPS:
wg genkey | tee /etc/wireguard/privatekey | wg pubkey > /etc/wireguard/publickey
# /etc/wireguard/wg0.conf on VPS-1 (10.0.0.1):
[Interface]
Address = 10.0.0.1/24
PrivateKey = VPS1_PRIVATE_KEY
ListenPort = 51820
[Peer]
PublicKey = VPS2_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32
Endpoint = VPS2_PUBLIC_IP:51820sudo systemctl enable --now wg-quick@wg0
# Test private connectivity
ping 10.0.0.2 # From VPS-1 to VPS-2 via WireGuard tunnelDiagnosing Network Problems
# Is the VPS reachable from the internet?
ping -c 5 YOUR_VPS_IP
# What path does traffic take?
traceroute YOUR_VPS_IP
# Is a specific port open and accepting connections?
nc -zv YOUR_VPS_IP 443 # Test HTTPS
nc -zv YOUR_VPS_IP 22 # Test SSH
# What's listening on which ports?
sudo ss -tlnp # TCP listening
sudo ss -ulnp # UDP listening
# Check firewall rules
sudo ufw status verbose
# Real-time bandwidth monitoring
sudo apt install -y iftop
sudo iftop -i eth0 # Per-connection bandwidth
# Monthly bandwidth usage
sudo apt install -y vnstat
sudo vnstat -m # After data accumulatesCommon Network Mistakes and Fixes
- Email blacklisted: Missing or mismatched PTR record → Configure reverse DNS in VPS control panel
- Slow DNS changes: High TTL on old records → Reduce TTL to 300 at least 24 hours before making changes
- IPv6 breaking services: Nginx or app binds to IPv4 only → Add
listen [::]:443 ssl http2to Nginx; or disable IPv6 withsysctl -w net.ipv6.conf.all.disable_ipv6=1 - VPS instances can’t communicate: Using public IPs for internal traffic → Use provider private network or WireGuard
- Port not accessible: UFW blocking →
sudo ufw allow PORT/tcp
Getting Started
Every VPS at VPS.DO includes a public IPv4 address, IPv6 support, and reverse DNS configuration via the control panel. Setting PTR records for your mail server’s IP takes one minute in the dashboard and significantly improves email deliverability. For multi-VPS deployments, WireGuard private networking creates secure inter-VPS communication without exposing backend services to the internet.
Conclusion
VPS networking involves a small set of concepts that apply to every deployment: A records (domain to IP), PTR records (IP to domain — critical for email), TTL (controls DNS change propagation speed), and network interfaces (what’s publicly accessible versus private). Understanding these fundamentals prevents the most common VPS networking mistakes and makes troubleshooting network issues systematic rather than guesswork.
