{"record":{"id":"277b7384c5a21358","repo":"nextcloud/all-in-one","slug":"it-seems-like-the-ip-address-of-the-domain-is-set","errorCode":null,"errorMessage":"It seems like the ip-address of the domain is set to an internal or reserved ip-address. This is not supported by the domain validation. (It was found to be set to '${dnsRecordIP}'). Please set it to a public ip-address so that the domain validation can work or skip the domain validation!","messagePattern":"It seems like the ip-address of the domain is set to an internal or reserved ip-address\\. This is not supported by the domain validation\\. \\(It was found to be set to '(.+?)'\\)\\. Please set it to a public ip-address so that the domain validation can work or skip the domain validation!","errorType":"validation","errorClass":"InvalidSettingConfigurationException","httpStatus":422,"severity":"error","filePath":"php/src/Data/ConfigurationManager.php","lineNumber":648,"sourceCode":"\n            if (empty($dnsRecordIP)) {\n                $record = dns_get_record($domain, DNS_AAAA);\n                if (isset($record[0]['ipv6']) && !empty($record[0]['ipv6'])) {\n                    $dnsRecordIP = $record[0]['ipv6'];\n                }\n            }\n\n            // Validate IP\n            if (!filter_var($dnsRecordIP, FILTER_VALIDATE_IP)) {\n                throw new InvalidSettingConfigurationException(\"DNS config is not set for this domain or the domain is not a valid domain! (It was found to be set to '\" . $dnsRecordIP . \"')\");\n            }\n\n            // Get the apache port\n            $port = $this->apachePort;\n\n            if (!filter_var($dnsRecordIP, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {\n                if ($port === '443') {\n                    throw new InvalidSettingConfigurationException(\"It seems like the ip-address of the domain is set to an internal or reserved ip-address. This is not supported by the domain validation. (It was found to be set to '\" . $dnsRecordIP . \"'). Please set it to a public ip-address so that the domain validation can work or skip the domain validation!\");\n                } else {\n                    error_log(\"Info: It seems like the ip-address of \" . $domain . \" is set to an internal or reserved ip-address. (It was found to be set to '\" . $dnsRecordIP . \"')\");\n                }\n            }\n\n            // Check if port 443 is open\n            $connection = @fsockopen($domain, 443, $errno, $errstr, 10);\n            if ($connection) {\n                fclose($connection);\n            } else {\n                throw new InvalidSettingConfigurationException(\"The domain is not reachable on Port 443 from within this container. Have you opened port 443/tcp in your router/firewall? If yes is the problem most likely that the router or firewall forbids local access to your domain. Or in other words: NAT loopback (Hairpinning) does not seem to work in your network. You can work around that by setting up a local DNS server and utilizing Split-Brain-DNS and configuring the daemon.json file of your docker daemon to use the local DNS server.\");\n            }\n\n            // Get Instance ID\n            $instanceID = $this->getAndGenerateSecret('INSTANCE_ID');\n\n            // set protocol\n            if ($port !== '443') {","sourceCodeStart":630,"sourceCodeEnd":666,"githubUrl":"https://github.com/nextcloud/all-in-one/blob/6b788eec5e61733cf03ed380a3572e43ae3f11ce/php/src/Data/ConfigurationManager.php#L630-L666","documentation":"In ConfigurationManager::setDomain() (when validation is not skipped): after DNS resolution succeeds, the resolved IP is checked with FILTER_VALIDATE_IP plus FILTER_FLAG_NO_PRIV_RANGE|FILTER_FLAG_NO_RES_RANGE; a private (RFC1918), loopback, link-local or otherwise reserved IP is rejected whenever the apache port is the default 443. AIO's domain validation connects to the domain from the internet's perspective, which cannot work for internal addresses. Throws InvalidSettingConfigurationException → HTTP 422 in the AIO UI. On installs where APACHE_PORT is not 443, the same condition is only an info log.","triggerScenarios":"Split-horizon DNS returning 192.168.x.x or 10.x.x.x for the domain; the A record deliberately set to the LAN IP for an internal-only install; the record accidentally pointing at the router's management IP or 127.0.0.1; CGNAT ranges like 100.64.0.0/10.","commonSituations":"Home labs with split-DNS; users wanting a fully LAN-only AIO without public exposure; corporate networks overriding public records with internal IPs.","solutions":["Point the domain's A record at the server's public IP (with port 443 forwarded) so the validation can connect","If the internal-only setup is intentional, tick 'skip domain validation' in the AIO domain dialog or set SKIP_DOMAIN_VALIDATION=true for the mastercontainer","Run AIO behind a reverse proxy with APACHE_PORT set to a non-443 value — the private-IP case then only logs an info line instead of throwing"],"exampleFix":"# before (split DNS answers with the LAN address)\ncloud.example.com -> 192.168.1.10\n# after\ncloud.example.com -> 203.0.113.10  (public IP, 443/tcp forwarded to the server)","handlingStrategy":"try-catch","validationCode":"// Reproduce the check before calling setDomain on a port-443 install\n$ip = gethostbyname($domain);\nif ($ip !== $domain\n    && !filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {\n    $errors[] = 'Domain resolves to a private/reserved IP — validation will fail';\n}","typeGuard":"function isInvalidSettingConfigurationException(\\Throwable $e): bool {\n    return $e instanceof \\AIO\\Data\\InvalidSettingConfigurationException;\n}","tryCatchPattern":"use AIO\\Data\\InvalidSettingConfigurationException;\n\ntry {\n    $configurationManager->setDomain($domain, $skipDomainValidation);\n} catch (InvalidSettingConfigurationException $e) {\n    // private-IP resolution: offer the user the documented options\n    // (public A record, skip validation, or non-443 APACHE_PORT)\n    $formErrors[] = $e->getMessage();\n}","preventionTips":["On default port-443 installs, point the A record at the public IP","For internal-only installs, plan for SKIP_DOMAIN_VALIDATION=true up front","With a reverse proxy, set APACHE_PORT to a non-443 value so private IPs only log an info line"],"tags":["php","nextcloud-aio","dns","private-ip","domain-validation","configuration"],"backgroundTag":"dns-points-to-private-ip","analyzedSha":"6b788eec5e61733cf03ed380a3572e43ae3f11ce","analyzedAt":"2026-08-21T05:47:24.382Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}