To make NGINX accept a domain name, point the domain’s DNS records at the server running NGINX, then create a matching server block. The listen directive chooses the address and port; server_name chooses the hostname for that request. If the site is an application, proxy the matching location to its local port. For HTTPS, add a port-443 listener and a certificate covering every hostname visitors use.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What NGINX must match
A browser request reaches NGINX only after two separate decisions succeed. DNS must resolve the requested hostname to the machine where NGINX is listening. Once the connection arrives, NGINX selects a server block by comparing the request’s address and port with listen, then comparing the hostname with server_name.
As an Amazon Associate I earn from qualifying purchases.
That separation explains most domain-related failures. A correct server block cannot help if DNS sends visitors to another address. Conversely, correct DNS does not select your site unless a matching server block exists. When no name matches, NGINX uses the default server for that address and port, which is why visitors often see a generic welcome page instead of their site.
Before you change NGINX
- Confirm the exact hostnames you intend to serve, such as
example.com,www.example.com, or a wildcard such as*.example.com. - Identify the public IPv4 address of the NGINX server and, if you publish IPv6, its IPv6 address.
- Ensure the firewall and cloud security rules allow the listener ports you will use, normally 80 for HTTP and 443 for HTTPS.
- Know whether NGINX will serve files directly or forward requests to an application running on another local port.
- Have a certificate and private-key file ready before enabling the HTTPS listener.
DNS record labels and propagation behavior differ between registrars and DNS hosts. Use the labels and record names documented by the provider that is authoritative for your domain; do not assume that every control panel names the root domain, subdomains, or aliases in the same way.
#1 Best Overall
Step 1: Point the domain at the NGINX server
Choose records for the hostnames you publish
Create an address record for the apex domain and any subdomain you want to serve. An A record maps a hostname to an IPv4 address. An AAAA record maps it to an IPv6 address. A CNAME can point a subdomain at another hostname when your DNS provider supports that arrangement. The exact way to represent the apex name and the www alias varies by provider.
For a site serving both names, the resulting DNS design might be conceptually:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches| Hostname | Typical record | Destination |
|---|---|---|
example.com |
A (and optionally AAAA) |
The NGINX server’s public address |
www.example.com |
A, AAAA, or provider-supported CNAME |
The same service or an alias that ultimately reaches NGINX |
Do not add an IPv6 record unless the server actually accepts traffic on that IPv6 address. An incorrect AAAA record can send some visitors to a different machine even when the IPv4 configuration is perfect.
Verify resolution before debugging NGINX
From a machine with DNS utilities installed, query each hostname:
dig +short example.com
dig +short www.example.com
dig AAAA example.comThe returned address should be the server that runs NGINX. If your provider uses a different authoritative DNS service, check the record there and allow for its stated propagation behavior. A resolver may temporarily cache an older answer according to the record’s TTL, so changing NGINX immediately after a DNS edit can produce misleading results.
Step 2: Create a server block for a static site
For files served directly by NGINX, create a server block that names every hostname it should accept:
Free tools Windows power users keep installed
One-click scans. No signup required.
server {
listen 80;
server_name example.com www.example.com;
location / {
root /var/www/example;
index index.html;
}
}listen 80; makes this block eligible for HTTP connections on port 80. server_name supplies the hostname match. The root directive points to the directory containing the site, and index identifies the default file for a directory request.
Put the file where your distribution expects it
On systems that split configuration into sites-available and sites-enabled, save the block in the available directory and enable it with the distribution’s normal symlink or include mechanism. Other installations include files from a single conf.d directory. The important requirement is that the file is actually included by the running NGINX process; a correctly written file that is never included cannot match a request.
Check ownership and paths
Verify that the configured document root exists, contains the expected index file, and is readable by the account used by NGINX. A hostname can match correctly while the response is still a 403 or 404 because the path is wrong or permissions prevent access. Keep the configured root consistent with the URL layout you intend to publish.
Step 3: Validate and load the configuration
- Run the configuration test command as an account permitted to read the NGINX configuration, commonly
nginx -t. - Fix every syntax error, missing include, certificate path error, or duplicate-listener warning reported by the test.
- Reload NGINX without stopping active connections, using the service manager on your operating system, commonly
systemctl reload nginx. - Request the hostname explicitly and inspect the status code and response body. Testing by IP alone is not equivalent because it may send a different
Hostvalue and therefore select another server block.
If the test command succeeds but the old page remains, confirm that the reload reached the same NGINX instance whose address DNS publishes. Multiple installations, containers, or a load balancer can make a successful local reload appear ineffective from the public internet.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Step 4: Route a domain to an application on another port
When your application listens on a local port such as 3000, keep that port private and let NGINX receive the public request. Put proxy_pass inside a matching location:
server {
listen 80;
server_name example.com www.example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://127.0.0.1:3000;
}
}The official reverse-proxy guidance places proxy_pass inside location. The example preserves the original hostname in the Host header and passes the client’s address in X-Real-IP. Applications that generate absolute URLs, enforce host-based routing, or log the public hostname often need that original Host value.
Confirm the upstream independently
Before troubleshooting NGINX proxying, make sure the application is listening on the address and port you configured. A service bound only to a different interface, stopped process, or mismatched port produces gateway errors even though the domain and server block match. Test the application locally, then test through NGINX with the public hostname.
Understand the boundary
NGINX accepts the public connection; the application accepts the private upstream connection. Opening the application port to the internet is normally unnecessary when NGINX and the application share a host. If they run on separate machines, replace the loopback address with the reachable upstream address and protect that network path appropriately.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Step 5: Add HTTPS for the domain
HTTPS requires a separate SSL listener and certificate configuration. A minimal file-serving HTTPS block is:
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
location / {
root /var/www/example;
index index.html;
}
}The ssl parameter on listen enables TLS on port 443. ssl_certificate identifies the certificate chain file, while ssl_certificate_key identifies the corresponding private key. Both paths must exist, be readable by NGINX at startup or reload, and belong to the same certificate/key pair.
Cover every requested hostname
The certificate must cover the hostname the browser requests. If visitors use both the apex name and www, the certificate needs both names or a wildcard that legitimately covers the subdomain. Otherwise the browser can receive a certificate that does not match, even when the NGINX server block itself is correct.
Serve the same application over TLS
For an upstream application, retain the same proxy location in the port-443 block and change only the listener and certificate settings:
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/ssl/example/fullchain.pem;
ssl_certificate_key /etc/ssl/example/privkey.pem;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_pass http://127.0.0.1:3000;
}
}After installing the certificate, run the configuration test and reload NGINX. Test the HTTPS hostname, not merely the numerical address, so certificate selection and hostname matching are both exercised.
Optionally redirect HTTP to HTTPS
Once the HTTPS block works, the port-80 block can be dedicated to redirecting visitors. A common pattern is:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}Keep the redirect block’s hostname list accurate. If a name is omitted, it may fall through to another port-80 server and show the wrong content instead of redirecting.
Why NGINX shows the default site
When several server blocks share an address and port, NGINX first considers the listener, then compares the request’s Host header with each block’s server_name. An unmatched request goes to the default server for that listener. The default may be the distribution’s welcome site or another project’s configuration.
Recommended Free Tools
Check the hostname spelling
Compare the browser’s hostname with the exact names in server_name. A block listing only example.com does not automatically cover www.example.com. Likewise, a typo, an unexpected trailing label, or testing an alias that DNS points elsewhere can produce a valid response from the wrong block.
Check which block is default
Use listen 80 default_server; only on the intended catch-all block. There should not be competing default declarations for the same address and port. If you do not need a catch-all site, remove or disable the distribution’s default configuration so an accidental hostname cannot expose it.
Best Value
Check HTTPS separately
Port 80 and port 443 have independent listener sets. A correct HTTP block does not configure HTTPS automatically. If HTTPS has no matching block, NGINX can select a different default certificate and content on port 443, even while HTTP works as expected.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Wildcards and internationalized domain names
Wildcard names
NGINX supports documented wildcard forms in server_name. A name such as *.example.com is intended for subdomains, not automatically for the apex example.com; list the apex explicitly when it must also work. Use the narrowest name set that matches your routing plan, especially when different subdomains belong to different applications.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Internationalized domain names
Internationalized domain names are represented in DNS and NGINX using their ASCII-compatible Punycode form. Convert the intended hostname to its Punycode representation and use that representation in the relevant server_name and certificate configuration. Test with the actual browser-facing name as well as the encoded form.
Fix a server-name hash error
If NGINX reports that it cannot build the server-name hash during startup or reload, follow the error’s guidance and increase server_names_hash_bucket_size or server_names_hash_max_size in the appropriate http context. Make one change at a time, rerun the configuration test, and reload only after the test succeeds. This issue is related to the size and number of names, not to DNS propagation.
Choose the configuration pattern that matches your site
| Pattern | Hostname coverage | Listeners | Request target | Typical use |
|---|---|---|---|---|
| Static HTTP | Exact names listed in server_name |
Port 80 | Local document root | Files served directly by NGINX |
| Static HTTPS | Names listed in both block and certificate | Port 443 with SSL | Local document root | Static site protected by TLS |
| Proxied HTTP | Exact names listed in server_name |
Port 80 | Application such as 127.0.0.1:3000 |
Public entry point for a local app |
| Proxied HTTPS | Names listed in block and certificate | Port 443 with SSL | Application through proxy_pass |
TLS at NGINX, application behind it |
| Wildcard routing | Documented wildcard syntax plus any explicit apex name | One or both listeners | Depends on the matching block | Many related subdomains with common handling |
Systematic troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| DNS lookup returns the wrong address | Incorrect record, stale cache, or unintended AAAA record |
Inspect authoritative DNS records, compare A and AAAA answers, and wait for the provider’s stated propagation window. |
| NGINX welcome page appears | Hostname did not match, or another block is default | Check server_name, the request hostname, enabled configuration files, and default_server declarations. |
| HTTP works but HTTPS shows another site | No matching port-443 block or wrong default certificate | Confirm listen 443 ssl;, the HTTPS server_name, and certificate paths. |
| Certificate warning | Certificate does not cover the requested hostname | Check every apex and subdomain visitors use against the certificate’s names. |
| 502 or gateway failure from a proxied site | Application stopped, wrong port, or unreachable upstream | Verify the process is listening at the address in proxy_pass and test the upstream locally. |
| 403 from a static site | NGINX cannot read the document root or index | Check the configured root, file permissions, directory traversal permissions, and the presence of index.html. |
| 404 despite a matching block | Wrong root, location, or application route | Confirm the URL-to-file mapping or ask the upstream application for the same path. |
| Reload fails with a server-name hash message | Name set is too large for current hash settings | Increase the indicated hash bucket or maximum size in the http context, test, then reload. |
| Only some networks reach the site | Different DNS answers, usually IPv4 versus IPv6 | Compare A and AAAA responses and ensure both addresses terminate at the intended NGINX service. |
A repeatable deployment checklist
- Write down every public hostname, including whether the apex and
wwwname are both required. - Create DNS records that point those names to the NGINX server, and verify the answers from outside the server’s network.
- Choose static serving or proxying and create a server block with the exact
server_namevalues. - For static content, confirm the
rootandindexfile. For an application, confirm the upstream address and port. - Run
nginx -tbefore every reload. - Reload NGINX and test with the hostname, not only the server’s IP address.
- For HTTPS, add a port-443 SSL block, install a certificate covering every hostname, test again, and then decide whether port 80 should redirect.
- Inspect default-server behavior whenever an unexpected site or certificate appears.
Bottom line
NGINX accepts a domain when DNS delivers the request to the right server and a matching server_name exists on the correct listen port. Use a local root for files, proxy_pass inside location for an application, and a separate SSL listener with a hostname-valid certificate for HTTPS. Most apparent NGINX domain problems are mismatches in DNS, hostname coverage, listener selection, or default-server configuration rather than failures of the domain itself.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
