DNS and reverse DNS (rDNS) for your server

Forward DNS: your domain → your IP

Every Joy server has a static IPv4 that survives reinstalls, so you can point DNS at it once. At your DNS provider create:

Use a low TTL (300 s) while you are setting things up, then raise it. Check with dig +short example.com or nslookup example.com.

Reverse DNS: your IP → a name

A PTR record maps the IP back to a hostname. Mail servers reject or spam-flag senders without one, some game launchers and APIs check it, and it makes traceroutes readable. Joy controls the reverse zones for its address space, so you set the PTR from the console:

1. Open the server page → Network tab.
2. Next to the IP, enter the hostname (for example mail.example.com) in the rDNS field and save.
3. The record propagates within 15 minutes. Verify: dig -x YOUR_IP +short.

For the PTR to be "forward-confirmed" (what mail servers want), the hostname you set must also have an A record pointing back to the same IP. Extra IPv4 addresses each get their own PTR. Transit and BYOIP customers can have the whole reverse zone delegated to their own nameservers — ask by ticket.

Mail: SPF, DKIM, DMARC

If you send mail from the server, add these TXT records alongside the PTR:

example.com.              TXT  "v=spf1 ip4:YOUR_IP -all"
default._domainkey        TXT  "v=DKIM1; k=rsa; p=<public key from your MTA>"
_dmarc                    TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

Outbound port 25 is closed on new accounts; open a ticket describing your setup (PTR set, SPF/DKIM in place) and it is opened for accounts in good standing. Alternatively use an authenticated relay on port 587.

Your server's resolvers

Templates ship with 1.1.1.1 and 8.8.8.8 as resolvers, written by the guest agent at deploy time. To change them on Ubuntu edit /etc/netplan/50-joy.yaml (nameservers section) and run netplan apply; on Windows use the adapter's IPv4 properties. Do not edit /etc/resolv.conf directly on Ubuntu — systemd-resolved manages it.

Hosting DNS on your own server

You can run an authoritative server (BIND, PowerDNS, Knot) on a Joy VPS; open UDP and TCP 53 in your firewall and register the server's name and IP as a nameserver ("glue") at your registrar. For redundancy put a second nameserver in another Joy region. Managed anycast DNS from Joy is coming; join the early-access list by ticket.

Checks that commonly fail

• PTR does not match forward — the A record for the PTR hostname points elsewhere. Fix the A record.
• Generic PTR — you left the default …joy.services name; mail providers prefer your own domain.
• Blocklisted IP — check at a multi-RBL lookup. If the listing predates your assignment, we replace the IP under the Replacement policy.
• Propagation — you changed DNS but still see the old value: your resolver cached it; wait for the TTL or query the authoritative server directly with dig @ns1.yourprovider example.com.