Lesson 12.09 — How Domain, DNS, HTTPS & Reverse Proxy Work

What is a Domain Name? The Human Identity of the Internet

Imagine you have built a powerful web application and deployed it to a cloud server. The server has a public IP address, such as 203.0.113.10. You can access the site from anywhere on the internet by typing that IP into your browser. But if your users had to memorize 203.0.113.10 or an IPv6 address like 2001:db8::1 every time they wanted to read an article or buy a product, the web would be unusable.

In simple terms, a Domain Name is a human-friendly alphanumeric identifier used to reference websites and servers across the internet (e.g., byteion.com or example.com).

Domain Name vs. IP Address & Registrar vs. DNS Provider

Internet routing is fundamentally governed by IP addresses. Routers do not recognize domain strings; they route packets strictly according to IP destinations.

Are Domain Registrars and DNS Providers the Same?

These two roles are frequently confused by newcomers:

• Domain Registrar (The Seller): An accredited organization (e.g., Namecheap, GoDaddy, Porkbun) where you purchase and reserve legal domain ownership for an annual renewal fee.
• DNS Provider (The Address Book Host): A global edge network (e.g., Cloudflare, AWS Route 53) that hosts your authoritative DNS zone records and answers queries from worldwide resolvers in single-digit milliseconds.

You can buy a domain from Namecheap, but point its Nameserver (NS) records to Cloudflare or Route 53. This separates billing ownership from high-performance global DNS resolution and DDoS protection.

What is DNS and How Does Recursive Resolution Work?

The Domain Name System (DNS) is a globally distributed, hierarchical database that translates human-friendly domain names into machine-routable IP addresses.

When you open a browser and type www.example.com, an orchestrated query chain executes behind the scenes in tens of milliseconds:

Essential DNS Record Types Explained

A DNS zone file contains specific instructions called DNS Records. Each record type fulfills a distinct operational objective:

What is TTL and Why Does DNS Propagation Take Time?

When you update an A record with a new server IP, some users will still be directed to your old server for a period of time. This phenomenon is commonly called DNS Propagation Delay.

In reality, DNS records are not pushed across all global servers simultaneously. Propagation delay is governed by TTL (Time to Live).

Verify your DNS propagation and live records directly from your command line using dig:

# Inspect short IPv4 resolution
dig example.com A +short

# Query a specific public resolver directly (e.g., Cloudflare 1.1.1.1)
dig @1.1.1.1 example.com A

# Verify www subdomain alias
dig www.example.com CNAME +short

HTTP vs. HTTPS: The Critical Dangers of Plaintext

HTTP (Hypertext Transfer Protocol) defines how clients and servers exchange messages. A browser sends a plaintext request (e.g., GET /products HTTP/1.1), and the server returns a plaintext response with headers and HTML (e.g., HTTP/1.1 200 OK).

The fatal vulnerability of standard HTTP is that it is completely unencrypted. Anyone situated between the client and server—such as a rogue Wi-Fi access point, an eavesdropping ISP, or an attacker on public networks—can intercept passwords, session cookies, and credit cards in clear text (Man-in-the-Middle Attack).

How TLS Works: The Modern 1-RTT TLS 1.3 Handshake

HTTPS is powered by TLS (Transport Layer Security). While historically referred to as SSL, SSL has been obsolete since 1999. Today, TLS 1.3 represents the gold standard for performance and security.

Before application data is transmitted, the client and server execute a rapid cryptographic negotiation known as the TLS Handshake:

Let’s Encrypt & Certbot: Free, Automated SSL for Everyone

In the early web, obtaining an SSL certificate required hundreds of dollars annually and painstaking manual CSR generation. Let's Encrypt transformed the entire internet landscape.

Let's Encrypt is a free, automated, and open Certificate Authority (CA) operated by the Internet Security Research Group (ISRG). Using the ACME protocol, it issues Domain-Validated (DV) certificates automatically. Certbot is the official command-line utility used to manage these certificates.

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

sudo certbot --nginx -d example.com -d www.example.com

sudo certbot renew --dry-run

Comprehensive HTTP vs. HTTPS Comparison

Forward Proxy vs. Reverse Proxy: Core Distinctions

In networking, a "Proxy" acts on behalf of another entity. Whether a proxy is Forward or Reverse depends entirely on which side of the connection it represents:

Why Every Production Environment Demands a Reverse Proxy

In professional cloud environments, application runtimes (such as Node.js Express, Python Gunicorn, or Laravel Octane) are never directly exposed to the public internet. Here are the five reasons why a reverse proxy is indispensable:

Configuring Nginx as a Production Reverse Proxy

On Ubuntu, Nginx server blocks are defined in /etc/nginx/sites-available/. Below is a production-grade reverse proxy configuration with line-by-line annotations:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # Forward all traffic to the local Docker container
    location / {
        proxy_pass http://127.0.0.1:8080;

        # Preserve the original Host requested by the client
        proxy_set_header Host $host;

        # Pass the real client IP to the backend application
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Notify backend whether the client used HTTP or HTTPS
        proxy_set_header X-Forwarded-Proto $scheme;

        # Enable WebSocket upgrades if required
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Real-World Implementation: 6 Steps from Domain to HTTPS

Let's integrate our Dockerized application from Lesson 08 into a complete, hardened production architecture across 6 clear steps:

Type: A      | Name: @   | Value: 203.0.113.10 | TTL: 300
Type: CNAME  | Name: www | Value: example.com  | TTL: 300

sudo docker run -d   --name my-website   --restart unless-stopped   -p 127.0.0.1:8080:80   byteion/my-website:1.0

sudo apt update && sudo apt install nginx -y
sudo systemctl enable --now nginx

# 1. Create server configuration
sudo nano /etc/nginx/sites-available/example.com

# 2. Enable site via symbolic link
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

# 3. Test configuration syntax and reload service
sudo nginx -t && sudo systemctl reload nginx

sudo certbot --nginx -d example.com -d www.example.com

The Complete End-to-End Request Lifecycle

When a user visits https://example.com/products, every component coordinates seamlessly in milliseconds to serve the page:

Is a Reverse Proxy an Alternative to a Load Balancer?

Short answer: They are not rivals; they are complementary partners!

A reverse proxy stands at the ingress of a server to provide routing, SSL termination, and caching. However, modern reverse proxies like Nginx and HAProxy also provide Layer 7 (HTTP) load balancing.