An A or AAAA record can be syntactically valid while pointing to an address that public visitors cannot reach. Use the public endpoint allocated for the service, and distinguish it from private, loopback, link-local and documentation addresses.
IN THIS ARTICLE
Information to have ready
Obtain the address from the hosting provider's service details. Determine whether the application sits behind NAT, a reverse proxy or a CDN, because its local interface address may differ from the address visitors should use.
01 Choose an address that public DNS users can actually reach
- For A records, check whether the proposed value is an internal IPv4 address in 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. These are commonly used inside private networks, not as a direct public internet destination.
- For AAAA, use a provider-allocated public IPv6 address with working routing. A unique-local or link-local address is not a substitute for the public service endpoint.
- If the service uses NAT, publish its supported public endpoint and verify the required forwarding and firewall configuration. Do not expose an internal administration interface by adding broad forwarding rules.
- If the provider instructs you to use a CNAME or CDN hostname, follow that supported method instead of guessing an IP from a temporary lookup.
- Save the intended records at the authoritative DNS provider and test from outside the hosting network. Check the actual application and TLS hostname, not only whether an address answers ping.
Confirm the expected result
A public visitor should reach the intended service without your private VPN or local hosts-file override. Test both IPv4 and IPv6 where published and verify the correct site and certificate.
Troubleshoot unexpected results
If the address works only from the server or office network, investigate the public allocation, NAT, routing and access policy. DNS cannot make an unroutable private address reachable by itself.
A common question
Can I use 192.0.2.10 or 2001:db8::10 exactly as shown in a tutorial?
No. Those ranges are reserved for documentation and are examples in these guides. Replace them with the actual address assigned to your authorised service. The fact that an editor accepts a value does not make it a working production destination.