FYI: Site does not work in firefox focus (android) unless i turn off tracking protection (which is default on).

Which was a bit confusing when I clicked the confirm-your-email link. No confirmation or status or anything.

How do the geo distributed secondaries work? How do they sync?

Also, is there anycasting?

> we accept RFC 1918 and CGNAT addresses in records

Doesn't that cause security issues by making it possible to put other people's private servers (that you want to do XSS-type attacks against) into your domains or something? I have a vague memory of it being a security no-no somehow.

Thanks for sharing!

How did you set up PowerDNS? Single/multiple instances? One DB shared by many or multiple authoritative with one hidden primary?

Even if you've otherwise put in a lot of effort, presenting it with slop on the home page really sends a bad signal. My eye caught "No proprietary clients. No vendor lock-in." as an AI pattern and I'm immediately drawn to wonder whether the service will still be around even just a few weeks from now.

Skål! Looks like a huge effort-reliever, excited to try it out.

Well done. Would be nice to remove a bit more five eyes tracking from your stack, e.g. remove includes from 3rd party domains such as unpkg / tailwindcss.com and of course get rid of cloudflare.

My first impression was "oh no, not another generic, vibe-coded service clone". But this is actually really good stuff under hood, and it's clearly coming from someone who has a deep understanding of networking.

Nice work, good luck.

[dead]

Thanks — external-dns + RFC 2136 is a great call. Honestly that's a guide we should write; we already have one for fleet operations and the k8s pattern is the natural extension.

Thanks! Hope there is room for something fresh and flexible!

And yes, BIND allows for a lot of different things, RFC 2136 being one of them and I have been looking at multiple options before settling down on the current structure. I built a few test cases from my Fortigate (dynip came to be initially fortigate only with simple copy paste over dns internally)

And there are a few code examples that can be used internally on various hosts, windows or linux, there is even an arduino example if you have any iOT devcices lying around in your home lab. and Writing a Go executable is a good idea, look out under /docs for updates :)

Tailscale is awesome, and Netbird is awesome, and Wireguard is awesome. It is a great time to be alive for sure. I have a guide that I wrote https://dynip.dev/guides/tailscale where I explain how and why they can exist

Agree that the OpenWrt DDNS scripts are a bit of a pain with keys secrets but the snippets function actually take the guess / how-does-it-work work out of the equation so I am pretty happy with that

I now use both. DynIP for public-facing services (yeah I still have a few), and Tailscale for what only I need to access. Drastically reduced my attack surface.

Luckily I don't have to deal with CGNAT.

"Long-lived token" means API tokens for the management API (creating/ deleting zones, listing them, automating via Terraform-style flows), not the TSIG keys for actual DNS updates. Every zone on every tier gets its TSIG key — that's what powers the updates themselves. Free tier manages zones via the dashboard; paid tiers add API tokens for programmatic management.

So no. the auth token is just for the API and can be used as a bearer for the api, the TSIG are always valid unless the domain is deleted

the free tier allows for 5 zones and all get individual tsig keys and they are always active. no need to pay unless you start handling 100s of new zones, updates, delete etc. so there is a split between the two types of tokens. hope it is clear

Yep, this is also true for dyndns curl/wget/fetch, have a look at the /docs on other special things that we can do except those. there is a larger functionality base here that I try to cover and not only (but including) curl/wget/fetch.

Best use case!

Check the snippets after you create a zone, hopefully less hacky scripts :D

It is not, the functionality is the same. I am trying to expand on the functionality to not only support a single setup. we support multiple update paths, validation, DNSSEC, Letsencrypt, byod domain etc. fleet management. It could be a battery powered esp node that you send to another country. there are multiple ways of doing the same thing and what I hope I am doing is making it accessible, easy and good looking.

Fortinet for example have a similar thing, you can within their web interface register a something.fortiddns.com or float-zone.com or others. but if you upgrade the fortigate with a newer model you need to get in touch with their support because the domain is locked to the old hardware.

syncology has their own, I mean there has never been more options, what I am doing is trying to bundle, connect and provide a platform for your own domains, that can support letsencrypt out of the box, that you can use multiple update paths with ipv6 if needed.

long reply, I am genuinely happy for the "why" questions as it allows me to speak about the platform :)

One of my things are that I am an engineer and I build functionality for engineers, this has always been the case. I am bad with visualizing this so the vue framework has helped tremendously with that.

With that said, I hope as well that it is a amazing idea, I am really happy with how it works and performs.

"Long-lived token" means API tokens for the management API (creating/ deleting zones, listing them, automating via Terraform-style flows), not the TSIG keys for actual DNS updates. Every zone on every tier gets its TSIG key — that's what powers the updates themselves. Free tier manages zones via the dashboard; paid tiers add API tokens for programmatic management.

But you do touch DNS :) and the idea here is to create as little friction or easy setup as possible with either fixed, dynamic or unknown ips.

One example I used it for just a few days ago was to set up dual ipsec tunnels for redundancy in fortigate in a remote warehouse. with the snippets I can just add a byod domain and paste the config into the cli and ship the devices. when they connect it it dials up, updates the ip in the dashboard (with notification that it has changed) and the vpn tunnels comes up automatically. it is available as road warriors as well, or dialup ipsec tunnels but I want dual initiator functionality.

Maybe this reply isnt really what the site is for but rather a subset of what can be done.

have a look at https://dynip.dev/guides/ I tried to add substantial information on what can be done

yep sounds valid, keeps the internet traffic nice and secure

lol, we can probably figure something out :)

I did the same! back when DNS was new and exciting and not a full on requirement for everyhing you touch nowadays. I have been thinking about that since then really and finally thought I would bring some of that back!

Thanks for being awwesome!

I like to believe that there are different use cases that play with different needs, I don't know your exact needs on the topic but it sounds like you have figured out what needs you have on a technical basis.

The idea is not really to never expose anything, almost the opposite or at least understand where on the internet different things live and be able to address them globally

Thanks, I am very happy with it. Reading the /guides or /docs myself actually feels good. inside the dashboard I have built a "snippets" javascript that creates the config for you. I mostly live in the cli myself so most is based on that.