DynDNS64

DynDNS64 automatically keeps your ipv64.net domains pointed at your connection's public IPv4 and IPv6. This page shows how to set it up with your API key, which modes there are, how often it checks and what happens on errors and limits.

How it works

DynDNS64 only opens outbound connections. You don't need to forward any port.

  # Home network                              # Internet · outbound only
 ┌──────────────────┐  1 What is my IP?        ┌────────────────────────────┐
 │      Node64      │ ───────────────────────► │ ipv4. / ipv6.ipv64.net     │
 │     DynDNS64     │    HTTPS, tcp4 / tcp6    ├────────────────────────────┤
 │                  │  2 What does DNS say?    │                            │
 │ checks every     │ ───────────────────────► │ zone's name servers        │
 │ 5 min (default)  │    DNS, UDP 53           ├────────────────────────────┤
 │                  │  3 only if different     │                            │
 │ no open port     │ ───────────────────────► │ ipv64.net/update.php       │
 │                  │    HTTPS, token header   ├────────────────────────────┤
 │                  │  optional with API key   │                            │
 │                  │ ───────────────────────► │ ipv64 API v2               │
 └────────┬─────────┘    picker, quota         └────────────────────────────┘
          │ notifications
          ▼
   e-mail · Telegram · Discord · ntfy · Gotify · Pushover · webhook

1. Find the IP: Node64 asks ipv4.ipv64.net or ipv6.ipv64.net – with the address family enforced, so the other side sees the public address (for IPv4, your router's).
2. Compare: Node64 asks the zone's authoritative name servers directly (no cache) what they're currently serving.
3. Report: Only if the expected address is missing does Node64 call ipv64.net/update.php – and only for the address family that changed.

Getting and entering your API key

With an ipv64 API key you can pick names straight from your account, see your update quota, and Node64 fetches tokens by itself. It also works without a key – see Enter manually.

1. Create a key
   Log in at ipv64.net and create an API key in your account. The interface itself is described in the API documentation.
2. Enter it in Node64
   Paste the key under Settings → ipv64 API key. It's stored centrally in the settings and used by all modules; Node64 shows its name and expiry date and stores it encrypted.
3. Enable the module
   Enable the DynDNS module under Settings → Modules. When it's off, nothing runs.

Choosing domains

1. Add target
   Under DynDNS → Add target, "Domains and records of your account" lists all active domains with their A and AAAA records.
2. Tick names
   For each name, choose what gets updated (IPv4 and IPv6 mode). The defaults match the existing records. With "prefix + interface ID", Node64 takes the interface ID from the existing AAAA record.
3. Add selection
   Node64 fetches fresh tokens from ipv64 and creates the targets, grouped by domain. Fixed addresses and interface mode are set afterwards when editing a target.

• You can add as many targets as you like; each one has its own token.
• Records belonging to the ipv64 CDN itself are never touched. Names behind ipv64's reverse proxy/CDN can be selected (note "via ipv64 CDN"): DynDNS64 then only maintains the origin address. DNS returning the CDN addresses is intended – the target shows "up to date · DNS via CDN/proxy" and is re-checked once a day.
• If you no longer want a target, delete it when editing. The record at ipv64 stays, and so does the history.

Enter manually (without API key)

Without an API key, create targets under Enter manually – fully functional, just without the picker and without the quota display:

Modes for IPv4 and IPv6

For every target you set IPv4 and IPv6 separately. At least one family has to be on.

IPv4

IPv6

Connection check: CGNAT and DS-Lite

After every module start, DynDNS64 traces the first up to six hops towards ipv4.ipv64.net (Linux only, IPv4 only). If a hop lies in the provider NAT range 100.64.0.0/10, you get a CGNAT hint; with 192.0.0.0/29, a DS-Lite hint – each with links to relevant help at ipv64. The analysis is only an indication: from inside your network it can't be determined for sure. If your IPv4 isn't reachable from outside, set IPv4 to "off" for your targets and use IPv6 – or publish services via CDN64.

Check interval and check URL

You'll find these settings on the DynDNS page under Checking.

• Looking up your own address does not use any update quota. Updates only happen on a change.
• Order of sources: your own check URL (if set), then ipv4.ipv64.net or ipv6.ipv64.net, with ipv64.net/api/v2/ip as fallback. Only public addresses are accepted – private, CGNAT, link-local, documentation and test addresses are not.
• The first run starts a few seconds after startup. Each run starts with a small random offset so that not all nodes ask at the same moment.
• If no target is enabled, the regular check is idle (no queries, no quota lookups).
• Check now starts a run immediately. Update now reports a target's address to ipv64 right away, even without a change – this uses update quota.

Behaviour on errors and limits

DynDNS64 is built to spare your daily quota and never end up in an endless loop:

• Only on change: the expected address is compared with the last reported one and with the answer from up to two of the zone's name servers. If a name has several A/AAAA records, it's enough for the expected address to be among them. Even a "nochg" would count toward the daily limit – so without a difference, nothing is reported at all.
• Queue: there are at least 5 seconds between two calls to ipv64.
• Grace period: after an update, DynDNS64 waits at least 3 minutes or two check intervals while the name servers still return the old state.
• Too many requests (429/cooldown): backoff of 1, then 5, then 15 minutes.
• Daily limit reached: no further attempts until the next day.
• Server or network errors: only hold back the affected target – 2, 4, 8 … at most 60 minutes.

Automatic pauses

In some cases, another attempt would only burn quota. DynDNS64 then pauses the target and explains why:

"Unknown name", "conflict", "ignored at ipv64" and "changed elsewhere" are retried automatically after 6 hours.

Target status

Keeping an eye on the quota

With an API key, the page shows "DynDNS updates today: X of Y" from your ipv64 account, plus this node's own count of calls in the last 24 hours. It's fetched at most every 15 minutes (when you open the page and the value is older than 5 minutes). From 80 % the page warns you – after that, ipv64 won't accept updates until the counter resets.

History

The History page has two tabs: Updates and IP checks. Filter by target, address family, result and time range (24 hours, 7 days, 30 days, everything); each view shows the newest 300 entries. For every update you see the time, target, trigger (automatic or manual), the IPv4/IPv6 or prefix sent, HTTP code, ipv64's response, errors and duration.

Changes to targets and settings are also recorded in Node64's audit log.

Notifications

Under Checking → Notifications you switch these notifications on or off individually:

• Public address has changed
• Update failed or target paused – automatic runs only. A persistently failing IP lookup (three runs in a row) is reported too; the all-clear follows on the next success.
• Update limit almost or fully reached – at most once a day.

Notifications go to this node's default channels – e-mail, Telegram, Discord, Slack, Microsoft Teams, Matrix, ntfy, Gotify, Pushover or webhook – even if the node is linked to ipv64. Nothing is sent during quiet hours, but the history still shows everything. ipv64 mail and SMS are sent with your API key directly through the ipv64 API. Webhooks receive the kinds dyndns_ip, dyndns_fail and dyndns_limit. Set up channels under Notifications.

API, Prometheus and export

Everything in the UI is also available through the local JSON API (log in with a Node64 API key, details under API):

# Start a check run right away
curl -X POST -H "Authorization: Bearer YOUR_API_KEY" http://NODE-IP:8080/api/dyndns/check

For Prometheus and Grafana, GET /api/metrics provides, among others, node64_dyndns_target_status, node64_dyndns_target_ok, node64_dyndns_targets and node64_dyndns_updates_24h (calls to ipv64.net in 24 hours). Examples and alert rules are under Prometheus.

Export/import: the export contains targets and settings without tokens; on import, Node64 fetches them again with the API key. More under Update & backup.

Something unclear, missing, or a question about Node64? Ask in the official forum v64.tech.