What is dynamic DNS (DDNS) and when do you need it?

Dynamic DNS (DDNS) is a way of keeping a DNS record pointed at a device whose IP address changes. A small client, running on your router, a server or another always-on device, checks your current public IP address and, whenever it changes, tells a DNS provider to update a hostname such as home.example.com. You need it when you want to reach something at home or in a small office by name, such as a NAS, a security camera system, a VPN server or a self-hosted app, but your internet provider gives you a dynamic IP address that changes from time to time.

The term also has a second, related meaning inside company networks, where computers automatically register their own hostnames in internal DNS when they get an address from DHCP. In this article you'll learn how both kinds of dynamic DNS work, when you actually need it and when you don't, how to set it up with a router, ddclient, a provider API and the standard nsupdate protocol, and how to do it securely.

Why IP Addresses Change

Most home and many small business broadband connections get their public IPv4 address from the ISP's DHCP or PPP servers. That address is dynamic: it's leased for a period and can change when:

• Your router restarts or reconnects.
• The lease expires and the ISP assigns a different address.
• The ISP does maintenance or renumbers its network.

Some connections keep the same address for months, others change every day. A static IP address never changes, but ISPs often charge extra for one, and many consumer plans don't offer it at all.

DNS records are normally static. If home.example.com points at 203.0.113.45 and your ISP moves you to 203.0.113.88, the name now points at someone else's connection, or at nothing. Dynamic DNS closes that gap by updating the record automatically.

How Dynamic DNS Works

The process is simple:

1. A DDNS client runs on your network. It might be built into your router, or it might be software like ddclient on a Raspberry Pi or server.
2. It finds out your current public IP address. Routers read it from their WAN interface. Clients behind a router usually ask an external "what is my IP" service.
3. It compares that address with the last one it reported, or with the current DNS record.
4. If it has changed, it sends an authenticated update to the DNS provider, usually an HTTPS request to an API, or a standard DNS UPDATE message.
5. The provider changes the record, and anyone who looks up the hostname after the TTL expires gets the new address.

Because the address can change at any time, DDNS records use short TTLs, typically 60 to 300 seconds, so the new address takes effect quickly.

Checking Your Public IP

You can see your current public address, and compare it with what DNS says, from a terminal:

# Your current public IPv4 address
curl -4 -s https://api.ipify.org; echo

# What DNS currently says
dig home.example.com A +short

If the two differ, your DDNS client hasn't updated yet, or isn't running.

When You Need Dynamic DNS

DDNS is useful whenever something on a dynamic connection needs a stable name:

• Remote access to a home network: Reaching a WireGuard or OpenVPN server, a home lab, or a remote desktop.
• Self-hosting: Running Home Assistant, Nextcloud, Plex, a game server or a small website from home.
• Security cameras and NAS devices: Many come with their own DDNS service for exactly this reason.
• Small offices without a static IP: Connecting branch offices with site-to-site VPNs.
• Allow-listing: Giving a firewall or service a hostname to resolve when you can't give it a fixed IP.

When You Don't Need It

You may not need DDNS if:

• Your ISP gives you a static IP address. A normal A record does the job.
• You use a tunnel or overlay network. Services such as Cloudflare Tunnel, Tailscale and ZeroTier make an outbound connection from your network, so your public IP doesn't matter and you don't need to open ports.
• You only need access from inside your network. Local DNS on your router or a local resolver is enough.

The CGNAT Problem

Many ISPs, especially mobile and some fibre providers, use carrier-grade NAT (CGNAT). Your router doesn't have a public IPv4 address at all; it shares one with many other customers. DDNS can still publish an address, but incoming connections to it won't reach you.

A quick way to check: if the WAN address shown in your router is in the 100.64.0.0/10 range, or doesn't match what api.ipify.org reports, you're probably behind CGNAT. Your options are to ask your ISP for a public IP, use IPv6 if your ISP provides it, or use a tunnel service instead of DDNS.

Types of Dynamic DNS Service

Type	Example	Pros	Cons
Free DDNS hostname	yourname.duckdns.org, No-IP, Dynu	Free, quick, widely supported by routers	You don't own the domain; some require periodic confirmation
Vendor DDNS	Hostnames from NAS or router manufacturers	Built in, no setup	Tied to that vendor's device and service
Your own domain via API	home.example.com on Cloudflare, deSEC, Porkbun and others	Your domain, full control	You need a client that supports the provider
Your own nameserver with RFC 2136	BIND or Knot with nsupdate	Standard protocol, no third party	You must run and secure the nameserver

How to Set Up Dynamic DNS

Option 1: Your Router's Built-In Client

Most routers have a DDNS or Dynamic DNS page. You choose a provider from a list, enter your hostname and credentials, and the router updates the record whenever its WAN address changes. This is the easiest option, because the router knows the moment its address changes. The downside is that the list of supported providers is often short.

Option 2: DuckDNS with a Cron Job

DuckDNS is a free service with a very simple update API. After signing in and creating a subdomain, you update it with a single HTTPS request. Leaving ip= empty tells DuckDNS to use the address the request came from:

curl -s "https://www.duckdns.org/update?domains=myhome&token=YOUR-TOKEN&ip="

It replies with OK or KO. Run it every five minutes from cron:

*/5 * * * * curl -s "https://www.duckdns.org/update?domains=myhome&token=YOUR-TOKEN&ip=" > /dev/null 2>&1

Option 3: ddclient

ddclient is a long-standing open-source DDNS client that supports many providers. On Debian or Ubuntu:

sudo apt install ddclient

Here's an example /etc/ddclient.conf for a record on Cloudflare, using an API token restricted to editing DNS in that zone:

daemon=300
ssl=yes
usev4=webv4
webv4=ipify-ipv4

protocol=cloudflare
zone=example.com
login=token
password=YOUR-CLOUDFLARE-API-TOKEN
home.example.com

Restart the service and check the logs:

sudo systemctl restart ddclient
sudo journalctl -u ddclient --since "10 minutes ago"

ddclient's configuration options have changed between versions, particularly the use, usev4 and usev6 settings, so check the documentation for the version your distribution ships. Older releases use use=web instead of usev4=webv4.

Option 4: A Small Script Using a Provider API

If you'd rather not install anything, a short script can do the same job. This Python script updates a Cloudflare A record only when the address has changed. It uses only the standard library:

#!/usr/bin/env python3
import json
import urllib.request

API_TOKEN = "YOUR-CLOUDFLARE-API-TOKEN"
ZONE_ID = "YOUR-ZONE-ID"
RECORD_NAME = "home.example.com"
API = "https://api.cloudflare.com/client/v4"


def call(method, path, body=None):
    req = urllib.request.Request(
        API + path,
        method=method,
        data=json.dumps(body).encode() if body else None,
        headers={
            "Authorization": f"Bearer {API_TOKEN}",
            "Content-Type": "application/json",
        },
    )
    with urllib.request.urlopen(req, timeout=10) as resp:
        return json.load(resp)


def public_ip():
    with urllib.request.urlopen("https://api.ipify.org", timeout=10) as resp:
        return resp.read().decode().strip()


ip = public_ip()
records = call("GET", f"/zones/{ZONE_ID}/dns_records?type=A&name={RECORD_NAME}")
record = records["result"][0]

if record["content"] != ip:
    call(
        "PATCH",
        f"/zones/{ZONE_ID}/dns_records/{record['id']}",
        {"content": ip, "ttl": 120},
    )
    print(f"Updated {RECORD_NAME}: {record['content']} -> {ip}")
else:
    print(f"{RECORD_NAME} already points to {ip}")

Create the A record once in the dashboard, then schedule the script:

*/5 * * * * /usr/local/bin/update-ddns.py >> /var/log/ddns.log 2>&1

Other providers with DNS APIs work the same way: fetch the current record, compare, and update only when needed. Only calling the API on a change keeps you well within rate limits.

Option 5: Standard DNS UPDATE with nsupdate

If you run your own authoritative nameserver, you don't need a third-party API at all. Dynamic DNS UPDATE, defined in RFC 2136, is a standard part of DNS that lets an authorised client add and remove records. BIND's nsupdate tool speaks it.

First, create a TSIG key for the client:

tsig-keygen -a hmac-sha256 home-ddns > /etc/bind/home-ddns.key

Then allow that key to update just one name in the zone, in named.conf.local:

include "/etc/bind/home-ddns.key";

zone "example.com" {
    type primary;
    file "/var/lib/bind/db.example.com";
    update-policy {
        grant home-ddns name home.example.com. A AAAA;
    };
};

The zone file lives in /var/lib/bind because BIND needs to write to it, and it keeps a journal file of dynamic changes next to it. Once a zone accepts dynamic updates, don't edit the file by hand without first running rndc freeze example.com, and rndc thaw example.com afterwards.

On the client, copy the key and send an update:

nsupdate -k /etc/bind/home-ddns.key <<EOF
server ns1.example.com
zone example.com
update delete home.example.com. A
update add home.example.com. 120 A 203.0.113.45
send
EOF

Wrap this in a script that looks up your public IP first, and you have a complete DDNS system using only open standards.

Dynamic DNS and IPv6

With IPv6, each device typically has its own global address, and there's often no NAT. That changes DDNS in two ways:

• You update an AAAA record for each device, not one record for the router. The client has to run on the device itself, or the router must update records on its behalf.
• The prefix can change too. Many ISPs assign a dynamic IPv6 prefix, so every device's address changes when the prefix does.

You can see the global IPv6 addresses on a Linux machine with:

ip -6 addr show scope global

Many DDNS clients support both A and AAAA records. Remember that IPv6 devices are often directly reachable once you know their address, so your firewall rules on the router matter even more.

Dynamic DNS Inside Company Networks

In Active Directory and other managed networks, "dynamic DNS" usually means something different. When a computer gets an IP address from DHCP, either the computer or the DHCP server registers its hostname in the internal DNS zone automatically, using the same RFC 2136 DNS UPDATE mechanism.

That's why you can reach laptop-042.corp.example.com without anyone creating a record by hand. Windows clients do this by default when joined to a domain, and Microsoft DNS servers can require secure dynamic updates, so only authenticated domain members can register or change names. You can trigger a re-registration manually on Windows with:

ipconfig /registerdns

On Linux, ISC's DHCP server and Kea can perform these updates on behalf of clients.

This kind of dynamic DNS keeps internal names accurate as devices come and go. It works alongside scavenging, which removes stale records for devices that haven't renewed in a while.

Security Tips

A DDNS hostname points straight at your home or office, so it's worth getting the details right:

• Use scoped credentials: Create an API token that can only edit DNS for one zone, rather than using your account's global key or password.
• Keep the token secret: Store it in a file only root can read, and never commit it to a public repository.
• Don't expose more than you need: A hostname makes services easier to find. Only forward the ports you need, keep software updated, and use strong authentication.
• Prefer a VPN for admin access: Expose a single VPN port rather than individual services like router admin pages or camera interfaces.
• Use TSIG for RFC 2136 updates: Never allow unauthenticated dynamic updates on a nameserver.
• Watch for stale records: If you stop using a DDNS hostname, delete it. An old record pointing at an address that's since been given to someone else is confusing at best.

---

FAQ: Dynamic DNS

---

Conclusion

Dynamic DNS keeps a hostname pointed at a connection whose IP address changes. A client on your network spots the change and updates the record through a provider's API or a standard DNS UPDATE, so you can keep reaching your VPN, NAS or self-hosted apps by name. Inside company networks, the same idea lets devices register their own names in internal DNS automatically.

Before setting it up, check whether you really have a public IP and whether a tunnel service might suit you better. If DDNS is the right fit, use your router's client or ddclient for convenience, a short script or nsupdate for control, scoped credentials for safety, and short TTLs so changes take effect quickly.