undefined | Better HN

0 pointsdynip10h ago0 comments

I'm Daniel, network engineer in Sweden. Built DynIP because every DDNS service I tried was designed around 2010-era networks: proprietary HTTP-only update protocols, poor IPv6, no DNSSEC, little support for actuallymodern devices.

What's in it:

- RFC 2136 / TSIG updates as a first-class path. FortiGate genericDDNS and MikroTik's /tool dns-update work natively — no custom client needed. HTTP API is also available for everything else.

- IPv6 end-to-end. Authoritative nameservers reachable over IPv6 (with AAAA glue published at the parent .dev zone), customer zones publish A and AAAA, and the platform works for IPv6-only clients.

- DNSSEC available on selected zones. With a single toggle.

- Bring your own domain via subdomain delegation. Point subdomain.yourcompany.com at our nameservers, manage normally.

- Hidden primary architecture: two geographically distributed secondaries (Sweden + Switzerland) verify TSIG locally and forward updates to a primary that doesn't take public traffic.

- Private-APN-friendly: we accept RFC 1918 and CGNAT addresses in records, which means cellular fleets on private APNs can use public DNS for stable hostnames pointing at internal IPs. Described in the fleet ops guide.

- A small Docker container (ghcr.io/33k-org/dynip-updater) for any docker-compose / Kubernetes / Coolify / Dokploy setup.

Background: 25 years of managed networking. DDNS was the part that broke or required tricks. Wanted one that didn't.

Stack: PowerDNS 4.8 authoritative, FastAPI backend, Postgres, Postfix for transactional mail, Cloudflare for the external surface and as a tunnel for the API. Live on dynip.dev. Paddle for billing. Free tier exists.

Happy to dig into architecture, the TSIG sync mechanism, per-zone DNSSEC handling, the hidden primary approach, or anything else.

0 comments

schanz3h ago

> because every DDNS service I tried was designed around 2010-era networks

I am not an expert in the domain of DDNS. Wanted to bring your attention to desec.io, in case you didn't knew about them. They offer a similar feature set like you mentioned (IPv6, DNSSEC, BYOD, ...). It is an open source project and they offer a very reliable free hosted service. As you said, they originated from the 2010-era (2014). I've used them for several years now and they bring everything to the table that I need.

For inspiration: They even have a feature that I use which I haven't spotted in your documentation (but maybe I just didn't looked close enough): Support for IPv6 prefix delegation. Routers that get assigned an IPv6 prefix from the ISP, can update the IPv6 prefix of arbitrary domains. In Europe this prefix is not static and rotated each time a new connection to the ISP is established. This feature allows the router to automatically update the IPv6 _prefix_ of selected domains. The host part of the IP is left untouched, but the network part is updated.

e.g.: /update?myipv6:nas.home.mydomain.tld=2003:e6:bee:affe::/56

dynipOP1h ago

Hi, doing on mobile so short answer. To my knowledge they don't do RFC 2146 but rather base everything around a good api that they have. Like you say different types of records etc.

And really, dynip came to be from fortinet/fortigate that have excellent support via their genericDDNS setup and things keep of of grew from there to what you see today.

And the subnet ipv6 sounds really interesting. Will need to check that out, sounds like that could be a feature request

aruametello2h ago

i can vouch for desec.io for having the option to have TXT, NS, CNAME, etc dns entries on their free tier! (limited to 1 domain, up to 50 entries)

i really had a bad time trying to get a letsencrypt certificate through the regular auth because it does require ports 80 and 443 tcp that by ISP blocks.

(you can get a letsencrypt cert through a TXT entry too, but most free DDNS´s providers dont seem to offer that)

dynipOP1h ago

Dynip.dev solves with dns challenge and you can download the full chain and key either via api or the dashboard. Check /docs

tjoff6h ago

FYI: Site does not work in firefox focus (android) unless i turn off tracking protection (which is default on).

Which was a bit confusing when I clicked the confirm-your-email link. No confirmation or status or anything.

dynipOP5h ago

Thanks, I will put it on my issues list to look into.

siwatanejo1h ago

Do you mind supporting L402 so that agents can potentially purchase the service?

dynipOP1h ago

Wow, that sounds like a great idea. I wanted it to be easy with the paddle integration but even that was a pain. Will look into it for sure, thanks!

BorisMelnik37m ago

you can scan your site with cloudflares tool https://isitagentready.com/ for all that new agent / web mcp type of goodness. love your service btw. I think im going to make the swap. there is one domain that I rely on for ddns and the service I use, while reliable, just really sucks for reasons you have already outlined

RyJones1h ago

Trying to set it up with HOVER as a registrar - I get:

Nameserver [ns1.dynip.dev] doesn't exist at the registry (Code 480)

dynipOP1h ago

Interesting, will do some digging on what sets them apart from the x amount of byod already precent. Thanks for letting me know!

dynipOP36m ago

It has to do with the .dev root zone that needs to have these as records, I am on it but it might take a few days to get those records up. Or it could be fast. Glad that you reported and I will report back when we expect it to work

1 more reply

ghoshbishakh7h ago

How do the geo distributed secondaries work? How do they sync?

Also, is there anycasting?

dynipOP7h ago

The geo sync updates are handled with distributed keys over internal api, here is the documentation for powerdns around it: https://doc.powerdns.com/authoritative/dnsupdate.html#dnsupd... so the updates are pushed and updated to primaries if the update is done over DNS and if done via API there is a normal replication function.

right now there is no anycast available, possible in the future

ghoshbishakh7h ago

Thanks for the answer. I use DB replicas (so all dns servers have a common backend), but only one accepts writes.

I still can not figure out any economical way to roll out anycast.

hfristedt8h ago

Thanks for sharing!

How did you set up PowerDNS? Single/multiple instances? One DB shared by many or multiple authoritative with one hidden primary?

dynipOP7h ago

There are multiple multiples :) both (hidden) primary and secondaries are multiple, snapshots every 20 minutes and forward-update functionality from the secondaries with replicated tsig over powerdns api every 120 seconds. since they are static they only need to replicate once.

if you register a zone and open the snippets quickly, there is a green notification saying tsig replication underway for x amount of seconds and until that happens RFC 2136 updates are not possible but the ones that use api are available right off the bat.

ericpauley4h ago

Really cool stuff. Out of curiosity what made you select PowerDNS (and in general a commodity DNS server) vs. developing a custom DNS server integrating your logic (using https://github.com/miekg/dns for instance).

hfristedt7h ago

Cool! How did you scale-out the hidden primary? Multiple instances communicating with a single postgres?

1 more reply

bflesch7h ago

Well done. Would be nice to remove a bit more five eyes tracking from your stack, e.g. remove includes from 3rd party domains such as unpkg / tailwindcss.com and of course get rid of cloudflare.

dynipOP7h ago

Yes, I have been thinking about that as well and have unpkg / tailwindcss.com in the backlog. good point, appreciated. Cloudflare is a bigger backlog item because of the current infrastructure build.

sparkling5h ago

Its unfortunate you didn't go for a EU-native stack right away. Bunny.net offers similar compute/serverless on the edge, close to Cloudflares offerings.

1 more reply

lmm9h ago

> we accept RFC 1918 and CGNAT addresses in records

Doesn't that cause security issues by making it possible to put other people's private servers (that you want to do XSS-type attacks against) into your domains or something? I have a vague memory of it being a security no-no somehow.

dynipOP9h ago

There are a few things to think about yes, I actually post in the fleet guide parts of it that it should be considered before posting. the dns rebind issue but that should be controlled by host header validation, CSRF, same-site cookies etc. Internal topology disclosure — real. but we dont post it. You can do the same in Cloudflare for example.

akerl_5h ago

Basically any DNS provider allows this (plus anybody can buy a domain and run their own DNS server).

The defense against this has to happen either on the resource you want to protect or in the browser.

tapland8h ago

Skål! Looks like a huge effort-reliever, excited to try it out.

dynipOP8h ago

Skål!

100ms7h ago

Even if you've otherwise put in a lot of effort, presenting it with slop on the home page really sends a bad signal. My eye caught "No proprietary clients. No vendor lock-in." as an AI pattern and I'm immediately drawn to wonder whether the service will still be around even just a few weeks from now.

dynipOP7h ago

Thanks for that, My intentions are to stick around for sure. It is genuinely difficult to get a point across in a very short amount of time that people that people will actually recognize. its like doom scrolling where you just get boored of it. Happy to take suggestions.

< is there anything else you would like me to answer or is that good enough - GenericAI answer>

But jokes aside, words are difficult and also not my first language

100ms6h ago

I don't think any value would be lost in that case by simply deleting the text and not replacing it with anything. AI is particularly bad at inserting this kind of filler, it can sometimes be really hard to spot even though it's right in front of your eyes.

Just more hidden cost of AI.. it's sufficiently hard to avoid these kinds of structural smells that I've gone back to just writing my own copy everywhere.

1 more reply

sparkling5h ago

My first impression was "oh no, not another generic, vibe-coded service clone". But this is actually really good stuff under hood, and it's clearly coming from someone who has a deep understanding of networking.

Nice work, good luck.

Aransentin4h ago

I mean, the comment you are replying to is absolutely AI-generated; I wouldn't say being able to prompt that is any direct evidence of deep understanding of networking.

The website is also vibecoded; at least partially - it has the exact same design choices like that purpleish blue colour scheme that Claude likes to spit out by default.

dynipOP5h ago

Thanks, appreciate it!

j / k navigate · click thread line to collapse

0 comments

schanz3h ago

> because every DDNS service I tried was designed around 2010-era networks

e.g.: /update?myipv6:nas.home.mydomain.tld=2003:e6:bee:affe::/56

dynipOP1h ago

Hi, doing on mobile so short answer. To my knowledge they don't do RFC 2146 but rather base everything around a good api that they have. Like you say different types of records etc.

And really, dynip came to be from fortinet/fortigate that have excellent support via their genericDDNS setup and things keep of of grew from there to what you see today.

And the subnet ipv6 sounds really interesting. Will need to check that out, sounds like that could be a feature request

aruametello2h ago

i can vouch for desec.io for having the option to have TXT, NS, CNAME, etc dns entries on their free tier! (limited to 1 domain, up to 50 entries)

i really had a bad time trying to get a letsencrypt certificate through the regular auth because it does require ports 80 and 443 tcp that by ISP blocks.

(you can get a letsencrypt cert through a TXT entry too, but most free DDNS´s providers dont seem to offer that)

dynipOP1h ago

Dynip.dev solves with dns challenge and you can download the full chain and key either via api or the dashboard. Check /docs

tjoff6h ago

FYI: Site does not work in firefox focus (android) unless i turn off tracking protection (which is default on).

Which was a bit confusing when I clicked the confirm-your-email link. No confirmation or status or anything.

dynipOP5h ago

Thanks, I will put it on my issues list to look into.

siwatanejo1h ago

Do you mind supporting L402 so that agents can potentially purchase the service?

dynipOP1h ago

Wow, that sounds like a great idea. I wanted it to be easy with the paddle integration but even that was a pain. Will look into it for sure, thanks!

BorisMelnik37m ago

RyJones1h ago

Trying to set it up with HOVER as a registrar - I get:

Nameserver [ns1.dynip.dev] doesn't exist at the registry (Code 480)

dynipOP1h ago

Interesting, will do some digging on what sets them apart from the x amount of byod already precent. Thanks for letting me know!

dynipOP36m ago

1 more reply

ghoshbishakh7h ago

How do the geo distributed secondaries work? How do they sync?

Also, is there anycasting?

dynipOP7h ago

right now there is no anycast available, possible in the future

ghoshbishakh7h ago

Thanks for the answer. I use DB replicas (so all dns servers have a common backend), but only one accepts writes.

I still can not figure out any economical way to roll out anycast.

hfristedt8h ago

Thanks for sharing!

How did you set up PowerDNS? Single/multiple instances? One DB shared by many or multiple authoritative with one hidden primary?

dynipOP7h ago

ericpauley4h ago

hfristedt7h ago

Cool! How did you scale-out the hidden primary? Multiple instances communicating with a single postgres?

1 more reply

bflesch7h ago

Well done. Would be nice to remove a bit more five eyes tracking from your stack, e.g. remove includes from 3rd party domains such as unpkg / tailwindcss.com and of course get rid of cloudflare.

dynipOP7h ago

Yes, I have been thinking about that as well and have unpkg / tailwindcss.com in the backlog. good point, appreciated. Cloudflare is a bigger backlog item because of the current infrastructure build.

sparkling5h ago

Its unfortunate you didn't go for a EU-native stack right away. Bunny.net offers similar compute/serverless on the edge, close to Cloudflares offerings.

1 more reply

lmm9h ago

> we accept RFC 1918 and CGNAT addresses in records

dynipOP9h ago

akerl_5h ago

Basically any DNS provider allows this (plus anybody can buy a domain and run their own DNS server).

The defense against this has to happen either on the resource you want to protect or in the browser.

tapland8h ago

Skål! Looks like a huge effort-reliever, excited to try it out.

dynipOP8h ago

Skål!

100ms7h ago

dynipOP7h ago

< is there anything else you would like me to answer or is that good enough - GenericAI answer>

But jokes aside, words are difficult and also not my first language

100ms6h ago

Just more hidden cost of AI.. it's sufficiently hard to avoid these kinds of structural smells that I've gone back to just writing my own copy everywhere.

1 more reply

sparkling5h ago

Nice work, good luck.

Aransentin4h ago

I mean, the comment you are replying to is absolutely AI-generated; I wouldn't say being able to prompt that is any direct evidence of deep understanding of networking.

The website is also vibecoded; at least partially - it has the exact same design choices like that purpleish blue colour scheme that Claude likes to spit out by default.

dynipOP5h ago

Thanks, appreciate it!

j / k navigate · click thread line to collapse