/nic/update) used by routers (MikroTik, OpenWrt, pfSense,
Ubiquiti), ddclient and inadyn. Each call replaces a name’s A/AAAA records with the new address.
DHCP servers, Kubernetes ExternalDNS and
nsupdate should use standard DNS UPDATE messages with a
TSIG key instead. See Dynamic updates (RFC 2136).Set it up
1
Create a token
Under Settings → API tokens, create a token with
records.write, preferably limited to the
zone that holds the hostname.2
Point your client at DNZ
The username can be anything; the token is the password.
- curl / cron
- ddclient
- MikroTik
- HTTP
How it behaves
hostnametakes one or more names, comma-separated, in zones the token can reach.myiptakes IPv4 and/or IPv6 addresses, comma-separated. When empty, the caller’s address is used. Behind a reverse proxy, setDNZ_TRUSTED_PROXIESso that is the real address.- The name’s A/AAAA records are replaced. New records get a TTL of 60.
- Names that have a CNAME are refused.
- The answer is one line per hostname:
good <ip>,nochg <ip>,nohost,notfqdn,dnserr,badauthor911. /api/ddns/updateworks as well as/nic/update.- Only a zone’s default records are changed, never view records.