> ## Documentation Index
> Fetch the complete documentation index at: https://dnzwithazee.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Dynamic DNS (DynDNS2)

> Keep a hostname pointed at a changing IP address from routers, ddclient or inadyn.

DNZ supports the **DynDNS2** protocol (`/nic/update`) used by routers (MikroTik, OpenWrt, pfSense,
Ubiquiti), `ddclient` and `inadyn`. Each call replaces a name's A/AAAA records with the new address.

> [!NOTE]
>
> DHCP servers, Kubernetes ExternalDNS and `nsupdate` should use standard DNS UPDATE messages with a
> TSIG key instead. See [Dynamic updates (RFC 2136)](/dns/dynamic-updates).

## Set it up

**1. Create a token**

Under **Settings → API tokens**, create a token with `records.write`, preferably limited to the
zone that holds the hostname.

**2. Point your client at DNZ**

The username can be anything; the token is the password.

**curl / cron**

```bash theme={null}
curl -fsS -u "dnz:$DNZ_TOKEN" "https://dns.example.com/nic/update?hostname=home.example.com"
```

**ddclient**

```ini ddclient.conf theme={null}
protocol=dyndns2
use=web
server=dns.example.com
ssl=yes
login=dnz
password=dnz_…
home.example.com
```

**MikroTik**

```text theme={null}
/tool fetch mode=https url="https://dns.example.com/nic/update?hostname=home.example.com" user=dnz password=dnz_… output=none
```

**HTTP**

```text theme={null}
GET https://dns.example.com/nic/update?hostname=home.example.com&myip=203.0.113.7
Authorization: Basic base64("dnz:dnz_…")
```

## How it behaves

* `hostname` takes one or more names, comma-separated, in zones the token can reach.
* `myip` takes IPv4 and/or IPv6 addresses, comma-separated. When empty, the caller's address is
  used. Behind a reverse proxy, set `DNZ_TRUSTED_PROXIES` so that is the real address.
* The name's A/AAAA records are replaced. New records get a TTL of 60.
* Names that have a CNAME are refused.
* The answer is one line per hostname: `good <ip>`, `nochg <ip>`, `nohost`, `notfqdn`, `dnserr`,
  `badauth` or `911`.
* `/api/ddns/update` works as well as `/nic/update`.
* Only a zone's default records are changed, never [view](/dns/views) records.

See the [endpoint reference](/api/acme-ddns#dynamic-dns-dyndns2).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.