Dynamic DNS for your own domain

Dynamic DNS keeps an existing hostname pointed at your changing IP address. It is included in Free, Nano, Pro, Pro Plus, Scale, Pay As You Go and custom plans. There is no separate DDNS subscription. Your normal zone, record and query allowances still apply.

Prepare your hostname

1. Add your own domain to DNScale and activate its primary zone.
2. Create one enabled A record for IPv4 and/or one enabled AAAA record for IPv6, for example home.example.com. Each selected type must have exactly one value.
3. In the zone dashboard, find Dynamic DNS, select Create credential, and enter the full hostname. Select only the address families your updater will use.
4. Save the credential ID and the secret shown once. The ID is the updater's username; the secret is its password. These are separate from your account password and general API keys.

DDNS preserves your existing TTL and comments. The supported minimum TTL is 300 seconds. Cached answers may continue showing the old address until their TTL expires. DDNS never adds missing records, deletes the other address family, changes MX/TXT records, or manages records below a DNS delegation.

Create credentials only for active primary zones. If a selected record becomes missing, disabled or multi-valued, fix it in the record editor before retrying. For credential rotation, revoke the old credential and create a replacement; then update your device. One active credential is allowed per hostname.

Test an HTTPS update

The production update endpoint is https://api.dnscale.eu/nic/update. This command prompts for your DDNS secret, keeping it out of shell history:

curl --user 'YOUR_CREDENTIAL_ID' --get \
  'https://api.dnscale.eu/nic/update' \
  --data-urlencode 'hostname=home.example.com' \
  --data-urlencode 'myip=192.0.2.10'

Replace the documentation address with your actual address. Use myip with a single IPv4 or IPv6 address, or a comma-separated IPv4/IPv6 pair. Alternatively, use myipv4 and myipv6. Do not mix these two parameter styles. Omit an address family to preserve it; an empty value is an error, not a deletion request.

Without any address parameters, DNScale uses the source address of the HTTPS connection. If that connection uses IPv6, only AAAA is updated. Explicit addresses are usually clearer for routers, multiple interfaces and dual stack.

Responses such as good 192.0.2.10 and nochg 192.0.2.10 both indicate success. The dashboard records both as successful check-ins. It records an address change only when a write was needed. These timestamps do not indicate device uptime.

ddclient 4.0.0

Install ddclient from your operating system's packages and check ddclient --version. Use the configuration path expected by that package; upstream 4.0.0 defaults to /etc/ddclient/ddclient.conf.

daemon=300
syslog=yes
ssl=yes
protocol=dyndns2
server=api.dnscale.eu
usev4=webv4, webv4=ipify-ipv4
login='YOUR_CREDENTIAL_ID'
password='PASTE_DDNS_SECRET'
home.example.com

For IPv6-only updates, replace the usev4 line with:

usev6=webv6, webv6=ipify-ipv6

For dual stack, include both lines and enable both families on the credential. The ipify services discover the public address of the machine running ddclient; use the appropriate interface or router discovery method if your target differs. In particular, a router's IPv6 address may not be your server's IPv6 address.

Restrict the file to the account running ddclient, for example mode 600, and restart the package's service. For a one-off test, make a protected copy of the configuration with its daemon line removed, stop the background service, then run:

sudo ddclient --file=/path/to/test-ddclient.conf --foreground --force --verbose

Restart the background service afterward. Do not enable debug logging when sharing diagnostics: it can expose credentials.

Use a five-minute check interval. Unchanged addresses may be cached locally by ddclient, so successful dashboard check-ins need not occur every five minutes. Requests arriving less than 30 seconds apart for the same credential receive HTTP 429. Do not run two updaters concurrently for one hostname.

FRITZ!Box custom provider

In the router's Dynamic DNS settings, choose a user-defined provider:

Keep the placeholders literally as written; the router substitutes its values. Use firmware that sends HTTPS Basic authentication from the username/password fields. Do not put your password into query parameters. For IPv6-only service, use only the myipv6 parameter. Avoid a dual-stack URL if your connection cannot supply both addresses: empty address values are rejected.

OpenWrt custom provider

Install ddns-scripts, LuCI DDNS support, a TLS-capable transfer client and the CA certificate bundle appropriate for your OpenWrt release. Choose a custom provider, enable HTTPS and certificate validation, and configure:

The bracket placeholders are substituted by ddns-scripts. Credentials in the URL's user-info section are used for HTTP Basic authentication; do not copy a fully substituted URL into a browser, logs or support messages. Never place the secret in the query string. Configure the service for IPv4 or IPv6 as appropriate. For dual stack, use ddclient's combined request; two OpenWrt service instances updating the same credential simultaneously can hit the 30-second rate limit.

DNScale is a custom provider, not a promised built-in entry in router menus. The request formats above are covered by automated protocol tests. Physical FRITZ!Box/OpenWrt firmware interoperability still needs verification on your particular version. ddclient 4.0.0 is exercised separately over verified TLS in the integration test.

Troubleshooting

DDNS does not create a tunnel, open firewall ports, bypass carrier-grade NAT, or provide reverse DNS. A correct DNS answer alone does not make a home server reachable. Keep remote services authenticated and use a VPN where appropriate.

See the update protocol reference, ddclient protocol documentation, and FRITZ!Box parameter examples.