How to point a domain to a VPS: IRNIC nameservers, A records and the CDN switch, step by step

In practice you point a domain to a VPS in three steps: you set the domain's nameservers to two free nameservers, either at IRNIC (the registry for .ir domains) or at an international registrar; you create two A records, one for the root and one for www; and you check the result with a few commands. By the end of this guide you will be able to prove with dig that your .ir or .com domain really reaches your server. What this guide adds to the usual instructions: the path through the IRNIC panel, the referral TTL of the .ir registry that explains the "few hours' wait", the order of steps that keeps you out of the negative-caching trap, and the CDN switch next to the A record.

What exactly do you need to point a domain to a VPS?

Pointing a domain to a VPS means creating an A record in the domain's DNS service that maps the domain name to the server's public IP address. So you need three things: a domain at any registrar (IRNIC for .ir, any registrar for .com), a static public IP, which your server's panel shows you, and somewhere to host the DNS records. For the third, Mehran Host offers two free nameservers, ns1.mehranhost.cloud and ns2.mehranhost.cloud, with a default TTL of 3600 seconds and a floor of 60 seconds on every record.

Connecting a domain to a server happens at the DNS layer, not inside the operating system, so it makes no difference whether your Linux VPS runs Ubuntu, Debian or Rocky, or whether you are pointing a domain to an hourly cloud server. None of it depends on shared hosting, on cPanel, or on buying the domain from the same company; all you need is access to your registrar's panel. Throughout this article we use example.ir as the domain and 203.0.113.10 as the server's IP.

If you do not have a server yet, create one first so that you have an IP. Mehran Host's cloud servers are billed by the hour; the cost logic is explained in our guide to hourly cloud servers, and the technical specs are on our Linux VPS in Iran page for developers. Note that a powered-off server is still billed at 50% of its hourly rate; only deleting it stops the charge.

Where should the domain's DNS live: your registrar, Cloudflare or free nameservers?

The A record can live in one of three places. All three reach your VPS; the difference lies in control and dependency:

All three options are independent of your hosting: records are only lost when you switch providers if the DNS lived inside the old host's panel. If you also run a second server outside Iran — say a Hetzner machine ordered from the same panel and paid in Iranian currency, as described in our guide to buying a VPS outside Iran — this one DNS panel covers both: one A record per name, each pointing to its own server's IP. The locations are listed in the international servers section.

Pointing a .ir domain to your server: how do I set its nameservers at IRNIC?

For a national .ir domain, the nameservers are changed in the IRNIC panel (nic.ir), not in the panel of the reseller you bought the domain from — unless that reseller offers its own tool for changing nameservers. Before this step, make sure the domain and its A records already exist in the Mehran Host panel. The path is as follows (the labels below are translated from the panel and change as IRNIC updates it):

1. Sign in to the IRNIC panel at www.nic.ir/panel with the IRNIC handle of the domain holder or of its technical contact, and go to "My domains".
2. Click the domain and open "Edit the domain's name server and hosting rows".
3. In the "Domain name server (NS Record)" table, set row 1 to ns1.mehranhost.cloud and row 2 to ns2.mehranhost.cloud. Leave the "Name server IP" column blank for both.
4. If rows 3 and 4 still hold your previous host's nameservers, clear them; an old nameserver left next to the new ones sends part of the queries to the old host.
5. Answer the account's security question and press the button at the bottom of the form; depending on the panel version it reads "Submit changes" or "Apply".

The "Name server IP" column is only filled in for a nameserver that sits under a .ir domain, such as ns1.example.ir, because the .ir registry is authoritative for that name and has to publish its address as a glue record. Since mehranhost.cloud is not a .ir domain, the column stays empty and the registry looks the IP up in DNS; custom nameservers under your own domain are not part of this service.

Where do I change the nameservers of .com and other international domains?

For .com, .net, .org and the other international extensions, the nameservers are changed in the panel of the registrar you bought the domain from: the domain's page → Nameservers or DNS → Custom instead of Default → enter ns1.mehranhost.cloud and ns2.mehranhost.cloud → save. In the panels of Iranian resellers, the option is usually called "Manage nameservers" or "Change DNS".

Two traps loom larger in these panels. The first is DNSSEC: if a DS record from your previous DNS provider is still registered with the registrar and you only change the nameservers, validating resolvers treat the new answers as forged, and the domain returns SERVFAIL for part of your users. Before the change, turn DNSSEC off and remove the DS record. The .ir zone is signed too, and IRNIC accepts a domain's public key, so the same rule applies to .ir domains; it just comes up less often. The second is the transfer lock: it concerns moving the domain to another registrar, and you do not need to unlock it to change nameservers.

The numbers differ from .ir: the .com registry publishes the referral record with a TTL of 172800 seconds (two full days), while the .ir registry uses 900. For .com, allow for up to 48 hours.

What are Mehran Host's free nameservers, and how do I add a domain to them?

Mehran Host's free nameservers are two authoritative DNS servers that host your domain's records at no extra cost: ns1.mehranhost.cloud inside Iran, and ns2.mehranhost.cloud outside Iran, a genuine PowerDNS secondary that receives every zone change through a NOTIFY message. On a day when the international route is cut, resolvers inside Iran still reach ns1 and resolvers abroad reach ns2. One honest caveat: if that NOTIFY gets lost, ns2 keeps serving the previous version until the zone's refresh interval comes around; and a domain you have just added is only created on ns2 once ns2 can reach ns1 over the international route. So after adding a domain, query both servers separately — dig @ns1.mehranhost.cloud example.ir SOA +short, then the same command against ns2 — and make sure both return the same serial number. If ns2 answers REFUSED, open a ticket before you change the nameservers at your registrar.

You add the domain in the customer panel under "Domain DNS management": enter the domain name without www and without http://, and the same page gives you the two nameservers with a "Copy" button. By default each account can hold up to 10 domains, and there is no set limit on the number of records. Supported record types: A, AAAA, CNAME, MX, TXT, NS, SRV and CAA. Adding a domain requires no purchase: sign up and add your domain, and have the records ready before you make the change at your registrar.

Why the order matters: if you change the nameservers before the domain exists in the panel, ns1 and ns2 have no zone for it and answer every query with REFUSED. Here is real output from September 16, 2026 for example.ir, which has not been added to the service (query ID removed):

dig @ns1.mehranhost.cloud example.ir A | grep status

;; ->>HEADER<<- opcode: QUERY, status: REFUSED

The user's resolver reads this as a broken delegation, returns SERVFAIL, and, depending on the resolver, caches the failure itself for anywhere from a few seconds to a few minutes. The second case is worse: the domain has been added but the A record has not. The nameserver says "no such record", and under RFC 2308 resolvers cache this negative answer for the smaller of two numbers, the last field of the SOA record and the TTL of the SOA itself, both of which are 3600 seconds here:

dig @ns1.mehranhost.cloud example.ir SOA +norecurse

;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
example.ir.   3600  IN  SOA  ns1.mehranhost.cloud. hostmaster.example.ir. 2026091301 10800 3600 604800 3600

In other words, a resolver that asked before the A record was created keeps repeating "does not exist" for up to an hour. The safe order: first the domain and both A records in the panel, then the nameserver change at the registrar.

How do I create the A record for my VPS?

On the domain's page, click "Add record" and create two A records: one named @ (the root) and one named www, both with the value 203.0.113.10. www is a separate name and will not resolve without its own record; you can make it a CNAME to the root instead, but the root itself cannot be a CNAME (RFC 1034, section 3.6.2). The reason, and what the other record types mean, are covered in our guide to DNS records.

The default TTL is 3600, and the 60-second floor is enforced both in the form and on the server side. Use 60 during setup and go back to 3600 once things are stable, because how quickly a change becomes visible depends on the TTL the record had before the change, not on the new value: a record that was at 60 updates within about a minute, while one at 3600 can take up to an hour. The AAAA record is optional; add it only if your web server really listens on an IPv6 address.

You will also see an apex NS record in the list that cannot be deleted; the panel blocks the attempt with the message "The domain’s apex NS record cannot be deleted; it is the delegation of your domain to our nameservers."

How do I know the nameservers are set, and how long does it take?

Changing the nameservers of a .ir domain usually takes a few hours, and 24 hours at most; for .com and other international extensions, up to 48 hours. The panel itself gives you a simple indicator: at the top of each domain's page in "Domain DNS management" there is a banner that, every time the page opens, reads the NS record as the panel server's resolver sees it. It is blue while no nameservers are seen, amber when other nameservers are seen (it names them), and green when both Mehran Host nameservers are seen: "This domain’s nameservers are correctly pointed to our service." This check does not query the registry itself and does not run from inside Iran; if the panel server's resolver has the previous NS answer cached, the banner turns green late, once that TTL runs out. You do not need to open a ticket while you wait for the banner to turn green.

To ask the registry without any middleman, query one of the .ir nameservers directly. With the example domain the output looks like this; 900 is the referral TTL of the .ir registry, measured on September 16, 2026:

dig +noall +authority @a.nic.ir example.ir NS

example.ir.   900   IN   NS   ns1.mehranhost.cloud.
example.ir.   900   IN   NS   ns2.mehranhost.cloud.

If this output shows the new nameservers, IRNIC's part is done and the rest of the wait is down to resolvers. The "few hours' wait" comes from ISPs' resolvers, which keep the previous NS answer until the TTL set by your previous host expires, plus the interval at which IRNIC regenerates its zone, a figure it does not publish. For .com, run the same command against @a.gtld-servers.net. A third option is IRNIC's whois, which lists the registered nameservers on nserver lines: whois example.ir | grep -i nserver.

Propagation of the records themselves depends on each record's TTL, not on the registry. For a site that is live on a previous host, lowering the TTL in advance, testing with the hosts file and timing the switch are covered in our guide to migrating a website to a new host.

How do I test that the domain really reaches the server?

Three questions for three layers: which nameservers the world knows about, which IP the nameserver returns, and whether the web server on that IP answers for this name. On Ubuntu and Debian the tools are installed with sudo apt install -y bind9-dnsutils whois; to run them from the server itself, start with our SSH connection guide:

dig +short NS example.ir
ns1.mehranhost.cloud.
ns2.mehranhost.cloud.

dig +short A example.ir @8.8.8.8
203.0.113.10

dig @ns1.mehranhost.cloud +short A example.ir
203.0.113.10

The first command shows the delegation as your own resolver sees it. The second asks Google's public resolver, so that your own resolver's cache does not get in the way. The third matters most: it asks the authoritative nameserver directly, and since there is no cache in the path it returns the correct answer immediately. If the third is correct and the second still returns the old IP, the record is fine and you are only waiting for a cache to expire. If you do not have dig, ask the same question with nslookup example.ir 8.8.8.8; the domain's answer is under the Non-authoritative answer heading, on the Address: 203.0.113.10 line, not in the first block, which shows the address of the resolver itself.

The third layer can be tested over HTTP even before DNS has propagated:

curl -sI -H "Host: example.ir" http://203.0.113.10/ | head -1
HTTP/1.1 200 OK

curl -sI --resolve example.ir:443:203.0.113.10 https://example.ir/ | head -1
HTTP/2 200

The first command uses the Host header to request this domain's block straight from the IP; a 200 response (or a 301 to https) means the web server is ready. The second is the same test for HTTPS, but it only answers once a certificate for this name is installed on the server; before you run Certbot you will get a TLS error or Connection refused, and only the first command counts. To test from several countries, check-host.net reads the A record; for the view from inside Iran, run the same nslookup over an Iranian mobile connection.

An important distinction: if dig returns the right IP but the site does not open, the problem is not DNS. It is the web server or the firewall — port 80 closed, no Nginx block created, or a wrong server_name — and our guide to setting up Nginx on Ubuntu builds all of that from scratch. If you do not have a server yet, create an hourly Iran VPS (provisioning usually takes under 60 seconds), test your domain on it, and delete it if it does not work out; you only pay for those hours.

How do I get SSL and turn on the CDN once the domain is connected?

Once the A record has propagated, a free certificate is a single line. Let's Encrypt has to see the domain on your IP, so do not run it until the second command in the previous section returns your server's IP:

certbot --nginx -d example.ir -d www.example.ir

Installing Certbot, automatic renewal and issuance errors are covered in our guide to installing free SSL with Certbot. If you have created a CAA record, then according to Let's Encrypt's CAA documentation its value must be 0 issue "letsencrypt.org", or issuance is refused.

The CDN switch sits next to every A record on the domain's page, with two conditions: the record's value must be a valid public IP, and its type must be A. On an AAAA record the panel refuses with the message "Only A records are supported for now." What turning the switch on does to your traffic is explained in What is a CDN and is not repeated here. Two points are specific to this page: the panel detects the origin's location automatically and adds the Iran node only if the origin is inside Iran, and issuing the Let's Encrypt certificate on the nodes takes about one to two minutes (see our Iran CDN page).

For the way back: the proxied record is published with a TTL of 60, so switching the CDN off takes effect in under a minute, and the origin's A record returns with a TTL of 3600. The first 1 TB of CDN traffic on each account is free; after that, each gigabyte costs 1,000 Toman (the unit Iranian prices are quoted in), deducted from your wallet. Smart load balancing on a single A name — choosing the IP by location or at random, with an optional health check — is also available in the same panel, but it is beyond the scope of this article.

What are the most common mistakes when pointing a domain to a VPS, and how do you fix each one?

Almost every "my domain won't connect" case is one of these six. For each: the symptom, the cause, and one action:

• dig @ns1.mehranhost.cloud example.ir A → REFUSED. The domain has not been added in the panel. Add it and run the query again.
• dig +short NS example.ir → your previous host's nameservers. The change at the registrar was not saved. Submit it again and ask the registry directly with @a.nic.ir.
• The panel banner stays amber and only one of the two names is seen. The registrar accepted only ns1. Submit the second row again.
• dig +short A example.ir @8.8.8.8 returns nothing, but querying ns1 returns the IP. DNSSEC from the previous provider is still in place. Remove the DS record.
• The root opens, but www.example.ir gives "site not found". The www record was forgotten. Create the second A record.
• DNS is correct, but the "Welcome to nginx" page appears. The request is landing in the default block. Add server_name example.ir www.example.ir; to your block, then run nginx -t and systemctl reload nginx.

Frequently asked questions

How long does it take to change the nameservers of a .ir domain at IRNIC?

Changing the nameservers of a .ir domain usually takes a few hours and at most 24 hours. The .ir registry publishes a domain's referral record with a 900-second TTL, but ISPs' resolvers keep the previous NS answer until its own TTL runs out; for .com domains, allow up to 48 hours. Once ns1 and ns2.mehranhost.cloud are saved in the IRNIC panel, the domain's page in Domain DNS management checks the status every time it opens and shows a green message when both are seen.

What are Mehran Host's free nameservers and how do I use them?

Mehran Host's free nameservers are two DNS servers, ns1.mehranhost.cloud and ns2.mehranhost.cloud, that host your domain's records free of charge; ns1 is inside Iran and ns2 is outside Iran. Open Domain DNS management in the customer panel, add the domain, and enter these two names at your domain registrar. You then manage A, AAAA, CNAME, MX, TXT, NS, SRV and CAA records with a default TTL of 3600 and a 60-second minimum, and every A record has a CDN switch beside it (the first 1 TB of traffic is free).

Can I point a domain straight to a VPS without a hosting plan?

Yes. Pointing a domain to a VPS needs no shared hosting plan at all; all it takes is an A record that maps the domain name to the server's public IP. The VPS runs its own web server, Nginx for example, and answers the requests for the domain. The only prerequisite is that the domain's DNS is hosted somewhere: your registrar's panel or any managed DNS service that can hold the A record.

Do I need a separate record for www?

Yes. www is a separate name and will not resolve without its own record. The simplest approach is two A records, one for the domain's root (@) and one for www, both pointing to the server's IP; if the IP changes later, you only edit those two records. You can make www a CNAME to the root instead, but the root itself cannot be a CNAME and must be an A record. List both names in your web server's server_name as well.

How many domains can I manage on the free nameservers, and what are the limits?

Each account can add up to ten domains to Mehran Host's DNS management, and no set limit applies to the number of records per domain. The other limits: the minimum TTL is 60 seconds and is enforced on the server side; the domain's apex NS record cannot be deleted, because it is the very delegation of the domain to the nameservers; and the CDN switch currently works on A records only. Each domain's page also shows the nameserver status every time it opens.