A home server, a NAS, security cameras, a router, or a VPN can all be opened up for remote access over the internet. But there's a catch: on many home connections, the public IP address changes from time to time. Yesterday your device was reachable at one address; today it's at a different one.
Dynamic DNS, or DDNS, solves this problem. It ties a permanent domain name to your connection and updates it automatically whenever your ISP hands out a new IP address. Instead of a long string of digits, you just use a friendly address like myhome.example.net.
Let's break down how dynamic DNS works, how it differs from regular DNS, and when you really can't do without it.
What is DNS
DNS stands for Domain Name System. It translates the friendly website addresses we type into the IP addresses that devices on a network actually understand.
For example, you type this into your browser:
example.comDNS looks up which IP address that domain maps to, and your browser connects to the right server.
example.com → 203.0.113.10Without DNS, you'd have to memorize and type in IP addresses every single time. That's inconvenient — and unreliable too, since addresses can change.
Normally, a DNS record is changed by hand — for example, when a website moves to a new server. But on a home connection, the IP can change on its own, without any warning. That's exactly where dynamic DNS comes in.
What is dynamic DNS
Dynamic DNS (DDNS) is a technology that automatically updates a DNS record whenever your public IP address changes.
It links a permanent domain name to an ever-changing address. As long as your IP stays the same, nothing happens. When your ISP hands out a new IP, the DDNS client notices the change and pushes it to the DNS service.
In simplified terms, it works like this:
myhome.example.net → your router's current public IPToday the record might point to one IP:
myhome.example.net → 198.51.100.24And after your internet reconnects, it updates automatically:
myhome.example.net → 198.51.100.77For you and everyone else, the domain name stays the same. Only the technical record under the hood changes.
DDNS doesn't create internet access on its own. All it does is keep the link between your domain name and your public IP address up to date. To reach a device from outside, you also need a public IP, a properly configured router, and only the necessary ports open.
Why your IP address can change
Internet providers hand out addresses in two main ways.
Static IP
A static IP address is assigned to a specific subscriber and doesn't change when you reboot your router or reconnect to the network. It's handy for servers, remote access, and corporate services.
But a static address is often offered as a separate paid add-on.
Dynamic IP
A dynamic IP address is assigned by your ISP from a shared pool. It can change after you restart your router, when a session ends, during maintenance, or simply because of the provider's own internal rules.
For everyday web browsing, this doesn't matter. But when you want to reach your own device from outside, it becomes a problem: the old IP no longer leads to your router.
DDNS exists precisely for dynamic addresses: it quickly ties a permanent domain name to the new IP.
How DDNS works
A dynamic DNS setup usually involves four pieces:
- A device or router — it knows the current public IP address.
- A DDNS client — built into a router or NAS, or a script installed on a server.
- A DDNS provider — the service that manages the DNS record.
- A domain name or subdomain — the address you'll use to connect.
The process looks like this:
1. The router gets a public IP from the ISP
2. The DDNS client checks the current IP
3. The IP changed — the client sends an update to the DNS service
4. The DNS record gets the new address
5. You connect using the same domain nameA real-world example
Say you have a NAS full of files at home, and you want to reach it while you're traveling.
Without DDNS, you'd have to look up the new IP in your router's admin panel every time and then type it in by hand. With DDNS, you create an address like files.example.net, set up updates on your router — and always connect using the same name.
The same principle applies to a home server, security cameras, a remote desktop, and a personal VPN.
The DDNS client: what updates the address
The DNS record is updated by the DDNS client. It's a small program or a built-in feature that periodically checks your public IP address.
Most often, the client runs in one of three places.
On the router
Many modern routers support DDNS right in the admin panel. You pick a service, enter the hostname and an access key — and from then on the router sends the updates itself.
This is the most convenient option for a home network: the router is the first to know when the ISP changes the public IP.
On a NAS or home server
If your router doesn't support the service you need, you can run a DDNS client on a NAS, a mini-PC, or a Linux server. It will periodically detect your public IP over the internet and update the record through the DNS provider's API.
On a cloud server or via a script
For your own domain, people often use the DNS provider's API. A script fetches the current IP and changes the A-record. This approach is flexible, but it does require storing the access token carefully and setting up the automatic run correctly.
For home use, the simplest choice is the DDNS client built into your router. For your own domain and server infrastructure, it's better to automate updates through the DNS provider's API and restrict the token to just the permissions it needs for that one DNS record.
DDNS vs. regular DNS: what's the difference
Regular DNS and DDNS do the same job — they link a name to an IP address. The difference is in how the record gets updated.
| Aspect | Regular DNS | Dynamic DNS |
|---|---|---|
| Who changes the IP in the record | An administrator, by hand | The client or router, automatically |
| Which IP it suits | Usually static | Primarily dynamic |
| How often the record changes | Rarely | Whenever the ISP hands out a new address |
| Where it's used | Websites, email, servers | Home, NAS, cameras, VPN, remote access |
| Does it need a DDNS client | No | Yes |
DDNS isn't a separate "internet" or a new kind of domain. It's just automation for managing a regular DNS record.
What dynamic DNS is used for
Home server and NAS
DDNS lets you open up access to files, backups, or home services at a permanent address — for example, Nextcloud, Jellyfin, Home Assistant, or your NAS panel.
Video surveillance
Cameras and DVRs often support DDNS. It lets you connect to your video feed using a single name, even when the IP changes.
Remote access to a computer
With DDNS, you can connect to a home PC over SSH, RDP, or another securely configured channel. That said, exposing RDP directly to the internet isn't recommended — it's better to use a VPN or a secure gateway.
Personal VPN
If your VPN server lives at home, DDNS helps client devices always find it at the same address. That's handy for WireGuard, OpenVPN, and other solutions where the server's endpoint is written into the config.
Smart home
Some smart-home owners use DDNS for external access to Home Assistant, controllers, sensors, and local control panels.
A convenient address doesn't make a service secure. Don't expose router panels, cameras, NAS devices, or admin interfaces to the internet unprotected. Use HTTPS, strong and unique passwords, two-factor authentication, regular updates, and a VPN for administrative access.
Do you need a public IP address
Yes — in most cases, direct inbound connections require a public IP address.
Sometimes an ISP uses CGNAT — a technology where a single public IP is shared among several subscribers. In that case, your router gets an internal address, and inbound connections from the internet never reach it.
Under CGNAT, DDNS can still update your domain name correctly, but that doesn't solve the reachability problem: the domain will point to the provider's shared IP rather than directly to your router.
| Situation | Does DDNS help? | What else you need |
|---|---|---|
| You have a public dynamic IP | Yes | Set up DDNS and port forwarding if needed |
| You have a static public IP | Usually not needed | You can just use regular DNS |
| Your ISP uses CGNAT | No, not for direct inbound access | A public IP, IPv6, a reverse proxy, a tunnel, or a VPS |
| You only need access inside your local network | Not needed | A local IP or local DNS is enough |
How to tell if you're behind CGNAT
Compare the WAN IP in your router's admin panel with the IP that external IP-check services report. If they differ, you may be behind CGNAT.
Addresses from these ranges can also be a sign of CGNAT:
10.0.0.0/8
100.64.0.0/10
172.16.0.0/12
192.168.0.0/16These are private ranges that aren't routed directly from the internet.
How to set up DDNS
The exact menu names depend on your router and DNS service, but the overall sequence is almost always the same.
Step 1 — Check your connection type
Make sure you have a public IP, or the option to get one from your ISP. If CGNAT is in play, sort that out first or choose an alternative way in.
Step 2 — Choose a domain name
You can use:
- a free subdomain provided by a DDNS service;
- your own domain;
- a dedicated subdomain, such as
home.example.comorvpn.example.com.
For anything important, your own domain is usually the better choice: you're not tied to the name or the terms of a free DDNS subdomain.
Step 3 — Create a DNS record
In your DDNS service or DNS provider's dashboard, create an A-record or add a hostname. At this stage, the service will give you a name, a token, a login/password, or an API key for updates.
Step 4 — Set up IP updates
Open the DDNS section on your router. It's usually found under the internet or network settings. Enter the service details and save the configuration.
If you're setting up DDNS on a server, create a scheduled task that runs the client or update script at regular intervals.
Step 5 — Set up access to the service
If you need to reach the service from the internet, forward only the necessary ports on your router. For a website, that's usually 80 and 443; for WireGuard, it's the port specified in the config.
Don't open ports "just in case."
Step 6 — Test that it works
Disconnect from your home Wi-Fi and try reaching the domain name over your mobile network. Then restart your router or wait for the IP to change, and confirm that DDNS updates the record.
What is TTL and why the address doesn't update instantly
DNS records have a TTL setting — Time To Live. It tells DNS resolvers how long they can keep a record cached before checking again.
For example, if the TTL is 300 seconds, some devices may keep using the old IP for up to five minutes after an update. In practice, the delay also depends on the browser, the operating system, the ISP, and the specific DNS service.
DDNS usually uses a relatively short TTL. But too small a value isn't always helpful: it increases the number of DNS queries and doesn't eliminate caching at every level.
If your domain keeps pointing to the old address for a while after the IP changes, that isn't necessarily a DDNS error. First check whether the record has updated at your DNS provider, then wait out the TTL and flush your local DNS cache if needed.
DDNS for a VPN: what to keep in mind
DDNS is especially useful for a VPN server at home. In the client config, you can use a domain name instead of an IP:
Endpoint = vpn.example.net:51820If your home's public IP changes, DDNS updates the record, and the next time the client connects it finds the server at the new address.
There's a caveat, though: an already-established VPN connection doesn't "follow" the new IP automatically. After the public address changes, you usually have to bring the existing connection back up. For always-on VPN access, it's better to use a static IP or a server in a data center.
For a personal VPN, also remember to:
- use unique keys for each device;
- never share configs in open chats;
- revoke access for any lost device;
- keep your server and router updated;
- restrict access to the admin panel.
Common DDNS problems
The domain points to an old IP
Check whether the DDNS client is running and whether the token, password, or API key is correct. Then look at the router's or client's log: it usually shows the most recent update attempt.
Also check the TTL and your local DNS cache.
You can't connect by domain but you can by local IP
A local IP only works inside your own network. For external access, you need to check your public IP, port forwarding, and firewall settings.
DDNS updates, but the service isn't reachable from outside
Common causes are CGNAT, missing port forwarding, double NAT, or a firewall on the server. DDNS can be configured correctly and still have no effect on the network route.
The router shows one IP but an IP-check service shows another
Your ISP is probably using CGNAT, or there's another router between you and the internet. Check whether a second router is sitting in front of your main device.
The domain won't open at home but works over mobile data
Some routers don't support NAT loopback — reaching your own public address from inside the local network. The fix: use local DNS, a separate internal name, or enable the corresponding feature on your router if it's available.
Security: what you shouldn't do with DDNS
DDNS makes your address permanent and convenient. That convenience benefits not just you but also the scanners crawling the internet, which is why security matters all the more.
You shouldn't:
- expose your router's admin panel to the internet;
- use default passwords;
- leave RDP, SSH, NAS devices, or cameras without updates;
- post your address and access credentials in public places;
- grant the DDNS token more permissions than it needs;
- disable the firewall for a "quick test."
The best baseline approach: expose only the services you actually need, use a VPN for administration, turn on two-factor authentication wherever it's available, and back up your configurations.
Bottom line
Dynamic DNS is a simple way to keep a permanent address for your home network even as your ISP changes the public IP. It's especially useful for a NAS, cameras, home servers, a smart home, and a personal VPN.
Keep this in mind: DDNS only handles the job of updating the DNS record. For full remote access, you still need a public IP, a correctly configured router, port forwarding where necessary, and secured services.
If you want to reach your home server at a single address and stop memorizing a new IP after every reconnect, DDNS is the right solution.
