DNS is where many self-hosting problems become visible: a service works on localhost, then fails behind a domain, HTTPS certificate, tunnel, VPN, or home resolver.

Use this page as a map. It does not replace the detailed guides; it points you to the right one for the problem in front of you.

Quick Choice

Goal Start Here
Block ads and trackers at home Pi-hole
Put HTTPS in front of Docker apps Nginx Proxy Manager or Traefik
Expose services without router port forwarding Pangolin or Cloudflare-style tunnels
Publish a static site on a custom domain Static-site hosting guides
Debug interface DNS after network changes Impala recovery DNS commands
Route private services across your own devices Tailscale / Headscale

Home DNS Filtering

Pi-hole is the main home-DNS guide in the archive.

Use it when you want:

  • LAN-wide ad and tracker blocking
  • a local DNS resolver dashboard
  • device-level visibility into blocked domains
  • a simple self-hosted networking win

Useful guide:

Domains, HTTPS, and Reverse Proxies

Reverse proxies are the next layer after DNS. DNS points the name to an entry point; the reverse proxy routes traffic to the right service and handles HTTPS.

Use Nginx Proxy Manager when you want a UI-first reverse proxy with Let’s Encrypt.

Use Traefik when you want labels, dynamic service discovery, and infrastructure-as-code style routing.

Useful guides:

Tunnels and No-Port-Forwarding Access

If your ISP uses CGNAT, your router cannot port-forward cleanly, or you do not want to expose your home IP, use a tunnel pattern.

Pangolin is the curated self-hosted tunnel/control-plane option in this set. Cloudflare-style tunnels appear across the hosting and external-access docs.

Useful guides:

Static Sites and Domain Setup

Static-site hosting guides often include the first practical DNS tasks: pointing a domain at a provider, verifying ownership, waiting for propagation, and configuring a custom domain.

Use these when the goal is publishing a website, not exposing a home-lab service.

Useful guides:

Interface DNS Troubleshooting

The Impala guide now includes a real recovery path after switching Wi-Fi management from NetworkManager to iwd and back.

The DNS commands are useful beyond Impala:

resolvectl dns wlan0
resolvectl dns enx00e04c361dbf

resolvectl status wlan0
resolvectl status enx00e04c361dbf

nmcli device show wlan0 | grep -E 'IP4.DNS|IP6.DNS|GENERAL.DEVICE|GENERAL.CONNECTION'
nmcli device show enx00e04c361dbf | grep -E 'IP4.DNS|IP6.DNS|GENERAL.DEVICE|GENERAL.CONNECTION'

resolvectl query google.com -i wlan0
resolvectl query google.com -i enx00e04c361dbf

Useful guide:

Domain Ops Checklist

  • Decide whether the service is private, public, or webhook-facing.
  • Pick the access pattern first: VPN, tunnel, reverse proxy, or direct port forwarding.
  • Keep admin dashboards private unless there is a strong reason to expose them.
  • Use HTTPS for public services.
  • Keep DNS records simple and documented.
  • For email domains, configure MX, SPF, DKIM, and DMARC in the email/deliverability workflow.
  • When debugging, check DNS at three layers: domain records, local resolver, and per-interface DNS.