What the A record is
Run dig +short example.com on macOS or Linux, or nslookup example.com on Windows, and read the address under the answer. That is the A record. If it belongs to a CDN, you are seeing the proxy, not the server that holds your site.
The A record maps a name to an IPv4 address. Three record types do related jobs, and mixing them up is why a lookup sometimes returns a name instead of a number.
- A holds an IPv4 address, such as 203.0.113.25.
- AAAA holds an IPv6 address for the same name.
- CNAME points at another name, so the client keeps resolving until it reaches an A or AAAA record.
Read it with dig in one line
dig is on macOS and most Linux images by default. On Debian or Ubuntu it comes from the dnsutils package.
| Command | What it prints |
|---|---|
| dig +short example.com | The IPv4 address only, one line |
| dig example.com A | The full answer section, with TTL and record type |
| dig +short example.com AAAA | The IPv6 address, if one exists |
| dig +short www.example.com | The address for the www name, which can differ |
The full output also names the server that answered the query. If that line is your router rather than a public resolver, add @1.1.1.1 to the command to ask a public resolver instead.
Read it on Windows with nslookup
nslookup is built into Windows. Open Command Prompt and run the name, then read the Address line under the Non-authoritative answer heading.
| Command | What it prints |
|---|---|
| nslookup example.com | Server, Address, then the resolved Address line |
| nslookup -q=A example.com | Forces the IPv4 query |
| nslookup -q=AAAA example.com | The IPv6 address, if published |
| nslookup example.com 1.1.1.1 | Asks a public resolver instead of the local one |
Non-authoritative is normal. It means a cache answered, not the domain's own nameserver.
What the output looks like
The address is the only value you copy. Everything else describes the query.
| Line | Meaning |
|---|---|
| example.com. 300 IN A 203.0.113.25 | Name, TTL in seconds, class, record type, address |
| 203.0.113.25 | The +short form of the same answer |
| 300 | How long a cache may keep the answer before asking again |
The address above is a documentation placeholder. Your domain returns its own, and a change at the registrar can take up to the TTL to appear everywhere.
Why the address may belong to a CDN
If the domain is proxied, the A record returns the proxy's address. Cloudflare, for example, answers with its own ranges and forwards each request to your server, so the public record cannot show the machine holding your files.
That is expected. It also means a firewall rule that allows your domain's IP will allow the proxy, not your visitors. Check the hosting panel's Server Information for the account's shared IP when you need the address your server actually answers on.
Reverse lookup from IP to hostname
The reverse direction uses a PTR record. Run dig -x 203.0.113.25 and read the name in the answer. On Windows, nslookup 203.0.113.25 does the same job.
The name returned belongs to whoever controls that address block, so on shared hosting it is often the provider's server name rather than your domain. That is not a fault, and it does not affect the site.
What a wrong IP address looks like
A wrong A record sends visitors to a different machine. The browser shows one of four things, and each points at the same cause.
- A default hosting page or a "future home" placeholder, because the address belongs to a server with no site for that name.
- The old host's site after a migration, because the record still points at the previous server.
- A certificate warning, because the new address has no certificate for the domain.
- A connection refused or timeout, because nothing answers on that address.
Mail is unaffected, because mail follows the MX record, not the A record. Changing the A record moves the website and leaves email where it is. The nameserver lookup shows which DNS service is publishing the record in the first place.
Find the address your host assigned
In cPanel, open General Information, then Server Information. The Shared IP Address row is the address the account answers on when no proxy is in front of it.
Most shared accounts use one address for many domains, which is why a reverse lookup returns a provider name. A dedicated IP is a separate purchase, usually on a VPS. If you are moving a domain, the record is edited where the DNS is managed: the domain registration desk for a registrar-hosted zone, or the cPanel hosting zone editor when the host runs DNS.
Support is by email at support@webji.services, 24/7 in Hindi and English, with an average first reply under 60 minutes. Send the domain and the output of the dig command, not a screenshot of the browser.
Frequently Asked Questions
How do I find the IP address of a website?
Run dig +short example.com on macOS or Linux, or nslookup example.com on Windows. The number that comes back is the A record. If the site sits behind a CDN, that number belongs to the proxy, not to the server holding the files.
How do I check a domain IP in Windows?
Open Command Prompt and run nslookup example.com. Read the Address line under the Non-authoritative answer. Add -q=AAAA to see the IPv6 address instead.
What is the dig command for an A record?
dig example.com A prints the full answer section, with the name, TTL and address. dig +short example.com A prints only the address.
Why does my domain show a Cloudflare IP?
Because the domain is proxied. Cloudflare answers with its own addresses and forwards requests to your server, so the public A record cannot show the origin. That is expected, not a fault.
How do I find the real origin server IP?
You cannot get it from the public A record when a proxy is in front. Check the hosting panel's Server Information for the account's shared IP, or ask the host. Bypassing a proxy is not a supported route.
Is my website on a shared IP?
Most shared hosting accounts are, and many domains can answer on the same address. A dedicated IP is a separate purchase, usually on a VPS or as an add-on.