PyQdeck LogoPyQdeckSubjectsSyllabusBlog

Application Layer · Computer Networks

Dynamic DNS (DDNS)

Watch lectures
SVGVector Architecture Diagram (SVG)
COMPUTER NETWORKS · Module 5 · Application Layer★ High PriorityIT Sem 6 · Code 100602Dynamic DNS (DDNS)MNEMONICDDNS = DNS that updates itself when your IP changes (DHCP gives a new IP → record updated).Short TTL + authenticated update = fresh and safe.Core BreakdownProblemClassic DNS maps names to STATIC IP addresses; records were edited by hand in zone files.Home / small-office links get dynamic IPs from the ISP via DHCP, so the old record goes stale.IdeaDDNS (RFC 2136) lets a host or DHCP server update its own DNS record automatically.The update goes to the primary master server, which changes the A / AAAA record at once.Workflow1. A DDNS client agent on the router / NAS / server watches the public IP address.2. On a change it sends an authenticated update; the server rewrites the record in seconds.Low TTLDDNS records use a very short TTL (about 60 s to 5 min) instead of hours or days.Resolvers drop the old IP quickly, so users reach the new address within minutes.Zone SyncAfter the primary is updated it sends NOTIFY; the secondary servers pull the change (zone transfer).The zone serial number is incremented on every update.DHCP LinkDHCP + DDNS: when a server hands out a lease it can register the host name and IP in DNS.Common in Microsoft Active Directory: clients update the internal DNS server dynamically.Use CasesRemote access to home servers (Plex, NAS), CCTV cameras and VPN end-points on consumer links.Avoids paying the ISP for a static IP address.SecurityRemote updates invite domain hijacking, so every update must be authenticated.TSIG (shared-secret HMAC signatures, RFC 2845) or HTTPS with a username / token.Diagram: DDNS Update FlowHome Router / Host(DDNS client)DDNS Server(primary master)SecondaryDNS Servers1-23-4Internet User5① Host detects a new public IP (checks every few minutes)② Sends an authenticated update (TSIG / HTTPS) to the primary③ Primary rewrites the A record, bumps the serial, sends NOTIFY④ Secondaries copy the change; the old IP expires after the short TTL⑤ Users resolve the name and reach the NEW addressStatic DNS: TTL 24-48 h → stale IP after a changeDDNS: TTL 60 s - 5 min → fresh within minutesStandard: RFC 2136 · Security: TSIG (RFC 2845) / HTTPS⚠️ Exam Traps & Viva Favorites① Why a very low TTL?Resolvers must drop the old IP fast.DDNS TTL = 60 s to 5 min, while normalDNS uses hours or even days.② Which RFC and mechanism?RFC 2136 = Dynamic Updates in DNS.Updates go to the primary server; thesecondaries are NOTIFYed and copy it.③ How is DDNS protected?Updates are authenticated: TSIG (sharedsecret HMAC, RFC 2845) or HTTPS with ausername / token. Else: hijacking risk.Tip: DDNS = auto-update + low TTLMaster Revision Table(learn it row by row!)ParameterStatic DNSDynamic DNS (DDNS)Why it mattersIP addressFixed, manually assignedChanges (DHCP lease)Home hosts rarely have a static IPRecord updateEdit the zone file by handAutomatic, within secondsNo administrator neededTTL24-48 hours typical60 s to 5 minOld IP is forgotten quicklySecurityAdmin access onlyTSIG / HTTPS authenticationPrevents domain hijackingTypical useData-centre serversHome servers, CCTV, VPNCheap remote accessStandardRFC 1034 / 1035RFC 2136 (+ RFC 2845)Know the numbers for vivaQUICK FACTSUpdate protocol: RFC 2136 · Authentication: TSIG (RFC 2845) or HTTPS tokenTTL: static DNS = hours to days · DDNS = 60 s to 5 minUpdate goes to the PRIMARY server → NOTIFY → secondaries pull (zone transfer)VERIFIED★ Golden rule: DDNS = automatic, authenticated DNS update with a very short TTL.

Dynamic Domain Name System (DDNS)

1. Traditional DNS vs. Modern Dynamic IPs

In classic DNS architecture, domain names were assumed to map to permanent, static IP addresses assigned to high-availability data center servers. Updating a DNS record required manual administrative intervention by editing master zone files.

However, residential and small business Internet connections are assigned Dynamic IP Addresses by ISPs using DHCP. Every time a home modem restarts, the ISP's DHCP lease expires, or the connection renegotiates, the host receives a brand new, unpredictable public IP address:

MermaidDiagram
Rendering diagram…

2. Concept of Dynamic DNS (DDNS)

Dynamic DNS (DDNS) (RFC 2136 / RFC 3007) is an automated system that allows a network client to notify a DNS server in real-time to automatically update its active DNS Resource Records whenever its public IP address changes.

MermaidDiagram
Rendering diagram…

3. Operational Workflow of DDNS

  1. DDNS Client Agent:
    • A lightweight background software agent runs on the user's edge device (integrated into home Wi-Fi routers, NAS drives, or Linux servers).
  2. Periodic IP Monitoring:
    • The client queries an external public check-IP service (e.g., http://checkip.dyndns.org) at regular intervals (e.g., every 5 minutes).
  3. Automated Secure Update Request:
    • When the agent detects that its external public IP address has changed, it dispatches an authenticated HTTPS API call or RFC 2136 dynamic update message to the DDNS server provider.
  4. Immediate Zone Update:
    • The DDNS server automatically updates the master A (IPv4) or AAAA (IPv6) resource record for that domain.
  5. Low TTL (Time to Live):
    • DDNS records use an intentionally very short TTL (typically 60 seconds60\text{ seconds} to 5 minutes5\text{ minutes}, compared to 24–48 hours in standard DNS). This prevents downstream ISP recursive resolvers from caching stale IP addresses.

4. Primary Use Cases

  • Remote Access to Home Networks: Running self-hosted media servers (Plex), Nextcloud storage, or home automation (Home Assistant) on residential broadband.
  • Surveillance Systems: Remotely viewing CCTV and IP security cameras without paying the ISP for an expensive static IP subscription.
  • Site-to-Site VPN Endpoints: Establishing persistent WireGuard or OpenVPN tunnels between branch offices with dynamic consumer ISP connections.
  • Enterprise DHCP Integration: In Microsoft Active Directory, Windows clients update the internal enterprise DNS server dynamically via DHCP whenever a new lease is issued.

5. Security in Dynamic DNS

Because DDNS allows remote updates to DNS zone databases, it is heavily targeted for Domain Hijacking:

  • TSIG (Transaction Signatures - RFC 2845): Uses shared secret keys and HMAC cryptographic hashing to verify that incoming update requests originate from the authorized domain owner.
  • HTTPS Authentication: Web-based DDNS APIs enforce TLS encryption along with username/token credentials.

Frequently Asked Questions

QWhy is DDNS required for home servers on residential broadband?

Residential ISPs assign dynamic IP addresses via DHCP that change unpredictably. DDNS automatically monitors these IP changes and updates the DNS server in real-time, maintaining uninterrupted hostname reachability without a static IP.

QWhy do DDNS records use very low TTL values?

Low TTLs (e.g., 60 seconds) ensure that recursive DNS caches discard expired records quickly. When an IP changes, clients around the world resolve the new IP address within a minute rather than being stuck with a cached stale IP for hours.

QWhat standard protocol mechanism defines dynamic updates in DNS?

RFC 2136 ("Dynamic Updates in the Domain Name System").

QHow is a DDNS update request protected from hijacking?

Updates are authenticated using TSIG (shared-secret HMAC signatures, RFC 2845) for RFC 2136 updates, or HTTPS with username/token credentials for web-based DDNS APIs.

Free AppAndroid App

Coursify Android App

Generate AI courses, take quick quizzes between classes, and master complex engineering concepts on the go.

Install Coursify
Previous topicDomain Name Space (DNS)Next topicTELNET

← All Computer Networks modules