DNS Records & Concepts
What is dynamic DNS?
Dynamic DNS, commonly abbreviated as DDNS, is a service that automatically updates DNS records when the IP address associated with a hostname changes. Where standard DNS configuration involves setting a fixed IP address in an A record that remains static until manually changed, dynamic DNS continuously monitors the current IP address and updates the DNS record automatically whenever the address changes, keeping the domain name pointed at the correct destination at all times.
The problem dynamic DNS solves is specific to scenarios where IP addresses change frequently and unpredictably. Home internet connections, small business broadband, mobile hotspots, and many cloud instances are assigned IP addresses dynamically, the ISP or cloud provider assigns a different IP address each time the connection is established or periodically reassigns addresses to manage their address pool. Standard static DNS records cannot track these changes, the record points to the old IP address while the actual server has moved to a new one.
Dynamic DNS bridges this gap by automating the update process. A client running on the device with the changing IP address detects when the address changes and immediately notifies the dynamic DNS service which updates the DNS record to reflect the new address. The domain name continues to reach the correct destination despite the underlying IP address changing.
How dynamic DNS works
Dynamic DNS requires a client component, software running on the device or network that detects IP address changes, and a service component, the dynamic DNS provider that manages the DNS records and processes update requests.
IP address monitoring: the dynamic DNS client continuously monitors the current public IP address of the device or network. Monitoring approaches vary by implementation. The client may query an external service, a URL that returns the requestor’s public IP address, and compare the result to the last known address. The client may listen for network interface change events from the operating system. Some router firmware implementations monitor the WAN interface IP address directly.
Change detection: when the client detects that the public IP address has changed, comparing the current address to the last recorded address, it triggers an update request to the dynamic DNS service. The detection can be near-instantaneous when the client monitors interface change events or delayed by the polling interval when the client checks periodically.
Update request: the client sends an update request to the dynamic DNS service, typically through an HTTP API, specifying the hostname to update and the new IP address. The request is authenticated, usually with credentials configured when the dynamic DNS service was set up, preventing unauthorised updates.
DNS record update: the dynamic DNS service receives the update request, verifies the credentials, and updates the DNS A record for the hostname to the new IP address. The update is applied immediately to the authoritative nameserver. DNS propagation begins, resolvers worldwide gradually update their cached records as the old TTL expires.
TTL considerations: dynamic DNS services use very low TTL values, typically 60 seconds to five minutes, on dynamically managed records. Low TTLs ensure that when an IP address changes the old cached record expires quickly and resolvers fetch the updated address promptly. The trade-off, increased query volume on the authoritative nameserver, is accepted because accurate resolution is more important than query efficiency for dynamic DNS use cases.
Who uses dynamic DNS
Dynamic DNS serves a specific set of use cases where IP addresses change and static DNS configuration is insufficient.
Home servers and self-hosting: individuals running web servers mail servers game servers or other services from home internet connections use dynamic DNS to maintain a consistent hostname even as their ISP reassigns IP addresses. Home broadband connections typically use dynamic IP addressing, the ISP assigns a new IP address when the connection is renewed or the router reboots. Without dynamic DNS the server becomes unreachable from the old hostname whenever the IP changes.
Remote access to home networks: accessing home devices remotely, network attached storage, security cameras, home automation systems, requires knowing the home network’s current IP address. Dynamic DNS provides a stable hostname that always resolves to the current home IP address regardless of how many times it has changed since the last access.
Small business internet connections: small businesses that cannot afford or justify dedicated static IP addresses use dynamic DNS to maintain consistent access to on-premises servers, VPN endpoints, and other network services that external parties need to reach reliably.
Development and testing environments: developers running services on laptops or development machines that change networks frequently, moving between home office and corporate network and coffee shops, use dynamic DNS to maintain stable hostnames for services they are developing and sharing with collaborators.
IoT devices and embedded systems: internet of things devices that connect through consumer internet connections and need to be reachable from external management systems use dynamic DNS to maintain consistent hostnames despite changing IP addresses.
Cloud instances without static IPs: some cloud computing scenarios involve instances that are frequently stopped and started, acquiring new IP addresses each time. Dynamic DNS provides consistent hostnames for these instances without paying for static IP address allocation.
Dynamic DNS providers
Several categories of dynamic DNS providers serve different needs and price points.
Free dynamic DNS services: several providers offer free dynamic DNS for basic use cases. No-IP, DynDNS, and Duck DNS provide free tiers with limited hostname options, typically using the provider’s own domain rather than a custom domain, and update client software for common platforms. Free tiers typically have usage restrictions, login requirements to keep free hostnames active, limited update frequency, or limited hostname counts.
Paid dynamic DNS services: paid tiers from the same providers offer custom domain support, higher update frequencies, more hostnames, better reliability, and customer support. Suitable for business use cases where reliability matters more than cost.
Router-integrated dynamic DNS: many home and business routers include built-in dynamic DNS client support. Popular router firmware, both manufacturer firmware and open-source alternatives like OpenWRT and DD-WRT, includes clients for major dynamic DNS providers. Configuring dynamic DNS in the router rather than on individual devices means all devices on the network benefit from the dynamic DNS update without requiring software on each device.
DNS provider dynamic DNS APIs: managed DNS providers including Cloudflare, Route 53, and others offer APIs that allow automated DNS record updates. While not marketed specifically as dynamic DNS services they can serve the same purpose, a script running on a device checks the current IP address and updates a DNS record through the provider’s API when it changes. This approach uses a custom domain rather than the provider’s subdomain and integrates with existing DNS management.
Self-hosted dynamic DNS: technically sophisticated users run their own dynamic DNS infrastructure, using open-source dynamic DNS server software alongside their own DNS infrastructure. Provides complete control but requires more operational effort than using a managed service.
Dynamic DNS update protocols
Dynamic DNS services use standardised and proprietary protocols for the update process. Understanding the protocols helps when configuring clients and integrating dynamic DNS into custom systems.
DynDNS protocol: the most widely supported dynamic DNS update protocol, originally developed by Dyn and now implemented by many providers for compatibility. Uses HTTP requests to a specific endpoint with credentials and the new IP address. Router firmware and dynamic DNS client software typically support this protocol across multiple providers because of its widespread adoption. A DynDNS protocol update request looks like:
The server responds with status codes indicating success or failure, good for a successful update nochg for no change needed and various error codes.
No-IP protocol: similar to the DynDNS protocol with minor differences in endpoint and response format. Widely supported by router firmware and clients alongside DynDNS protocol.
Cloudflare API: Cloudflare’s DNS API allows automated record updates using API tokens. Scripts and clients that use the Cloudflare API directly, rather than a standardised dynamic DNS protocol, can update DNS records for any domain managed on Cloudflare. More flexible than protocol-based approaches but requires Cloudflare-specific client implementation.
Custom webhooks and APIs: modern dynamic DNS implementations often use custom API endpoints provided by the DNS service, authenticated with API keys and using JSON payloads. More flexible than legacy protocols but requires provider-specific client configuration.
Dynamic DNS and redirect management
Dynamic DNS and redirect management serve different but occasionally overlapping needs. Understanding the intersection helps identify when each, or both, is appropriate.
Redirect management assumes stable DNS: standard redirect management: configuring 301 redirects, 302 redirects, and other HTTP redirects, assumes that DNS records are stable and point consistently to the redirect infrastructure. The redirect rules handle URL routing. DNS handles routing to the correct server. The two layers are independent, redirect rules work regardless of whether the DNS records pointing to the redirect infrastructure are static or dynamic.
Dynamic DNS for redirect infrastructure: a redirect management service running on infrastructure with a dynamic IP address can use dynamic DNS to maintain a stable hostname for the service. The redirect rules themselves remain constant, only the DNS record pointing to the redirect server needs to be updated dynamically. This is relevant for self-hosted redirect management on dynamic IP connections rather than for managed redirect services which use stable infrastructure.
Combining dynamic DNS with redirect rules: a home server running redirect management software can use dynamic DNS to maintain a stable hostname, redirects.myhome.com: while also serving redirect rules for other domains. The dynamic DNS handles the home server’s changing IP address. The redirect rules handle URL routing for the domains configured on the server.
Domain parking with dynamic DNS: parked domains intended for simple redirects can use dynamic DNS if the redirect destination is served from infrastructure with a dynamic IP address. More commonly parked domains use managed redirect services with stable infrastructure, making dynamic DNS unnecessary.
Security considerations for dynamic DNS
Dynamic DNS introduces specific security considerations that standard static DNS does not face.
Credential security: dynamic DNS accounts require credentials, username and password or API tokens, that authorise DNS record updates. Compromised credentials allow an attacker to update DNS records to point to their own servers, a form of DNS hijacking. Credentials should be treated with the same care as any authentication credentials, strong unique passwords, multi-factor authentication where supported, and API tokens with minimal permissions.
Update client security: dynamic DNS client software running on devices or routers must be kept up to date. Vulnerabilities in update clients could be exploited to manipulate DNS records or compromise the device. Use reputable clients from established providers and keep them updated.
Hostname enumeration: dynamic DNS services that use predictable subdomain patterns, username.provider.com: make it easier for attackers to identify and target dynamic DNS hostnames. Services that allow custom domains provide better obscurity, though security through obscurity is not a substitute for proper authentication.
Update verification: some dynamic DNS attacks involve sending fraudulent update requests with incorrect IP addresses to disrupt service. Services that provide update authentication, verifying that update requests come from authorised sources, mitigate this risk. IP address restrictions on which sources can send update requests add another layer of protection.
SSL certificates for dynamic DNS hostnames: dynamic DNS hostnames used to serve HTTPS content require SSL certificates. Let’s Encrypt and other certificate authorities can issue certificates for dynamic DNS hostnames, the domain must pass domain validation which works normally for dynamic DNS domains. Certificates must be renewed before expiry, automated renewal through ACME clients handles this for most use cases.
Checking and troubleshooting dynamic DNS
Verifying that dynamic DNS is working correctly requires checking that the DNS record reflects the current IP address and that updates are being processed correctly.
Checking current public IP address: services like ifconfig.me ipinfo.io and api.ipify.org return the requestor’s public IP address, useful for verifying what IP address the dynamic DNS client should be updating to:
Checking current DNS record value: comparing the DNS record value to the current public IP address confirms whether the dynamic DNS update is working:
If the DNS record value matches the current public IP address the dynamic DNS is working correctly. If they differ an update may be in progress or the update client may not be running correctly.
Querying authoritative nameserver directly: checking the authoritative nameserver directly bypasses resolver caches and shows the current authoritative value, useful when the update has been made but propagation is still in progress:
Checking update client logs: most dynamic DNS clients maintain logs of update attempts and results. Reviewing these logs shows whether updates are being triggered when IP addresses change and whether the updates are succeeding or returning errors.
Testing update manually: sending a manual update request to the dynamic DNS API, with the current IP address, verifies that the credentials and endpoint are correctly configured without waiting for an IP address change to trigger an automatic update.