DNS glossary

What is DDNS (Dynamic DNS)?

Dynamic DNS (DDNS) is a DNS mechanism that automatically updates a host's address records when its IP address changes. It relies on the DNS update protocol defined in RFC 2136 or on a provider's update service, so the name always resolves to the current address.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

Dynamic DNS (DDNS) is a DNS mechanism that automatically updates host address records when IP addresses change, eliminating the need for manual record edits and keeping hostnames correctly mapped to changing addresses in DHCP and provider-assigned environments. The system works by sending address changes to an authoritative DNS server through RFC 2136 updates or provider services, with authentication controls such as TSIG keys ensuring only authorized senders can modify records. Proper DDNS configuration requires coordinating DNS, DHCP, and IP address management while managing TTL values, reverse zones, and security restrictions to prevent stale records, hijacking, and name conflicts.

  • DDNS relies on RFC 2136 dynamic update messages or HTTP-based provider services, with authentication typically enforced through TSIG transaction signatures or account credentials to prevent unauthorized record modifications.
  • Operational issues including stale records, duplicate names, failed reverse lookups, and ownership conflicts arise when DHCP servers and clients fail to coordinate updates or when reverse zones lack dynamic update permissions.
  • DDNS differs from DHCP reservations by updating records when addresses change rather than keeping addresses fixed, and supports both IPv4 A records and IPv6 AAAA records with equivalent update mechanisms.

DDNS at a glance

AttributeValue
Full nameDynamic DNS
CategoryDNS update mechanism
Defined inRFC 2136 (Dynamic Updates in the Domain Name System)
OSI layerLayer 7 (application)
Primary useKeeping a hostname mapped to a changing IP address
Related termsDNS, DHCP, A record, AAAA record, TSIG, IPAM, TTL

How DDNS works

DDNS works by sending a change to an authoritative DNS server whenever a host's address changes. The change can come from the host, from a DHCP server acting for it, or from a provider's update client.

  1. Address change: A host receives a new IP address from DHCP, a router reconnects with a new address from its internet provider, or a static assignment is edited.
  2. Update request: The host, the DHCP server or a small update client sends the new address to the DNS server. Standards-based deployments use the dynamic update message from RFC 2136. Many hosted services use an HTTP-based update request instead.
  3. Authentication: The DNS server checks that the sender is allowed to change the record. Standards-based updates are commonly secured with transaction signatures (TSIG) as defined in RFC 8945, or with other keys. Hosted services typically use account credentials or tokens.
  4. Record change: The server replaces the old A or AAAA record with the new address and increments the zone serial number so secondary servers can pick up the change.
  5. Resolution: Clients that query the name receive the new address once cached copies of the old answer expire, which is controlled by the record's time to live (TTL).

Dynamic updates may also remove or adjust related records, such as PTR records for reverse lookups. A short TTL shortens the window in which clients use a stale address but raises query volume.

Why DDNS matters in enterprise networks

DDNS matters wherever addresses change but names must stay stable. Home and branch sites often have internet addresses that change on reconnect, and enterprise networks hand out leases through DHCP that change as devices come and go. Without automatic updates, administrators would edit records by hand, which does not scale and leaves names pointing to addresses that belong to someone else.

Operationally, DDNS ties DHCP, DNS and IP address management together. When the three disagree, symptoms include stale records, duplicate names, failed reverse lookups and services that connect to the wrong host. Cleaning up records for expired leases, setting sensible TTLs and keeping forward and reverse zones in step all reduce these faults. RFC 2136 defines the update mechanism, so most DNS servers and DHCP servers can interoperate.

Security is the main risk. An unauthenticated update lets any host overwrite a record and redirect traffic, so updates should be restricted with TSIG keys or similar controls, limited to specific zones and names, and logged. Allowing broad, unsigned updates in a zone is a common cause of record hijacking and name conflicts inside enterprise networks.

DDNS vs Dynamic IP address

Dynamic DNS keeps a name pointed at an address that changes, while a dynamic IP address is the changing address itself, usually assigned by DHCP or an internet provider. What is Dynamic IP Address?

AttributeDDNSDynamic IP address
What it isA mechanism that updates DNS recordsAn address that is assigned temporarily and can change
Layer of concernName resolutionAddress assignment
Typical sourceHost, DHCP server or update clientDHCP server or internet provider
RelationshipCompensates for address changesCauses the need for DDNS

DDNS vs DHCP reservation

Dynamic DNS lets a name follow a changing address, whereas a DHCP reservation prevents the address from changing by always giving the same address to a given client. What is DHCP Reservation?

AttributeDDNSDHCP reservation
ApproachUpdates the record when the address changesKeeps the address fixed for a client
Configured onDNS server, DHCP server or clientDHCP server
Name stabilityMaintained by record updatesMaintained because the address does not change
Common useChanging leases and provider-assigned addressesServers, printers and other devices needing a predictable address

Common DDNS issues

Records created for DHCP clients remain after the lease ends if the DHCP server does not remove them or lacks permission to do so. Another device later receives the same address and two names resolve to it.

The DNS server returns a REFUSED response when the sender is not authorized, the key or TSIG signature does not match, or the zone does not allow dynamic updates. The record then keeps its old address with no obvious error on the client.

When the DHCP server and the client both try to update the same record, or two hosts claim the same name, one overwrites the other or the update fails. Unclear update responsibility between client and server is the usual cause.

The forward A or AAAA record is updated but the PTR record is not, because the reverse zone is missing, not dynamic or not authorized. Reverse lookups then fail or return an old name, which breaks logging and some authentication checks.

A high TTL on a dynamically updated record lets resolvers keep the old address after the update succeeds. Users see intermittent failures until cached answers expire.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DDNS FAQ

Related terms

Article

DHCP (Dynamic Host Configuration Protocol)

DHCP (Dynamic Host Configuration Protocol) is the standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

DHCP Lease

A DHCP lease is the period during which a DHCP server assigns an IP address to a client device, allowing it to use that address before renewal or expiration.

Learn more
Article

IPAM (IP address management)

IP address management (IPAM) is a method for planning, tracking, and managing IP address space on a network.

Learn more
Article

Transaction Signature (TSIG)

TSIG (transaction signature) is a protocol that enables DNS to authenticate updates to a DNS database, most commonly for dynamic DNS or secondary DNS servers.

Learn more
Article

PTR record

A PTR record is a DNS record that resolves IPv4 or IPv6 addresses to domain names.

Learn more
Article

Time to Live (TTL)

TTL (time to live) is a setting for each DNS record that specifies how long a resolver caches the DNS query before it expires.

Learn more
Article

Dynamic IP Address

A dynamic IP address is an IP address assigned to a device that changes over time, unlike a static IP address that remains constant.

Learn more
Article

A record

An A record is a DNS record that maps domain names to IPv4 addresses.

Learn more
Browse the full glossary