DashboardSign in

Help & guides

Setup instructions for routers, DNS providers, and the API.

Getting started

  1. Create an account and confirm your email address.
  2. In the dashboard, go to Hostnames → Create and add a subdomain like myhouse.dnsfollowme.uk.
  3. On the API keys tab, create an API key (e.g. "Fritz!Box Living Room") and copy it safely — it's only shown once.
  4. Configure your router per Router setup — use the API key as the password.

Router setup

Rather install a program on the device than configure your router? That is what the native clients are for.

IPv4 or IPv6?

The values above update the IPv4 address (A record) — the normal case on connections with their own public IPv4. For IPv6 (AAAA record) the device sends the parameter &myipv6=<IPv6> in addition or instead. How to do that on this device is in the "IPv6" row of the table.

DS-Lite or CGNAT (many cable and fibre connections): the router then has no public IPv4, and the service rejects a private WAN address with "abuse". In that case send only myipv6 — or use the DNS Beacon client directly on the target device, which detects both address families itself.

Fritz!Box (AVM)

Internet → Permit Access → DynDNS

Provider:
Custom
Update URL:
https://api.dnsbeacon.com/nic/update?hostname=<domain>&myip=<ipaddr>
Domain name:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
Placeholder <ip6addr>. Dual stack: append &myipv6=<ip6addr> to the update URL. DS-Lite: send only ?hostname=<domain>&myipv6=<ip6addr>, without <ipaddr>.
Detailed setup guide →

Synology NAS

Control Panel → External Access → DDNS → Add

Provider:
Custom
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
Server URL:
https://api.dnsbeacon.com/nic/update?hostname=__HOSTNAME__&myip=__MYIP__
IPv6:
DSM 7: placeholder __MYIPV6__ — append &myipv6=__MYIPV6__ to the server URL (drop &myip=__MYIP__ on DS-Lite). Older DSM versions do not know the placeholder.
Detailed setup guide →

Ubiquiti UniFi

Settings → Internet → WAN → Dynamic DNS

Service:
custom (or dyndns)
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
Server:
api.dnsbeacon.com/nic/update?hostname=%h&myip=%i
IPv6:
IPv4 only – UniFi OS does not support AAAA updates. For IPv6, run the DNS Beacon client directly on the target device.

Note: UniFi only sends updates when the WAN IP actually changes. To force an update, disable the DynDNS config, save, re-enable, save.

Detailed setup guide →

pfSense / OPNsense

Services → Dynamic DNS → Add

Service type:
Custom
Update URL:
https://api.dnsbeacon.com/nic/update?hostname=%h&myip=%IP%
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
Add a second entry with service type "Custom (v6)", using &myipv6=%IP% instead of &myip=%IP% in its update URL.
Detailed setup guide →

OpenWrt

Services → Dynamic DNS

Provider:
-- custom --
Update URL:
https://api.dnsbeacon.com/nic/update?hostname=[DOMAIN]&myip=[IP]
Domain name:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
Add a second DDNS configuration with IP address version IPv6 (use_ipv6), using &myipv6=[IP] instead of &myip=[IP] in its update URL.

Install the luci-app-ddns package first (System → Software, or opkg install luci-app-ddns ddns-scripts). OpenWrt substitutes [DOMAIN] and [IP] in the URL automatically.

Detailed setup guide →

OPNsense

Services → Dynamic DNS → Settings

Service type:
Custom
Server:
api.dnsbeacon.com
Username:
your email address
Password:
your API key
Hostname:
myhouse.dnsfollowme.uk
IPv6:
Add a second account for IPv6 only: set "Check ip method" to an IPv6 service and enable "Allow IPv6" under General Settings.

Install the os-ddclient plugin first (System → Firmware → Plugins) and pick the Custom service — it sends standard DynDNS2 updates to /nic/update.

Detailed setup guide →

DD-WRT

Services → DDNS

Service:
Custom
Server:
api.dnsbeacon.com
Update URL:
/nic/update?hostname=
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
IPv4 only – the DDNS UI only sends the IPv4; IPv6 would need a custom cron script. For IPv6, run the DNS Beacon client directly on the target device.

Set the DDNS Service to Custom. DD-WRT appends your hostname and current IP to the URL automatically.

Detailed setup guide →

TP-Link Omada

Settings → Services → Dynamic DNS (or Device Config → DNS → Dynamic DNS)

Service Provider:
Custom
Update URL:
https://api.dnsbeacon.com/nic/update?hostname=[DOMAIN]&myip=[IP]
Domain Name:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
IPv4 only – Omada DDNS does not support IPv6 updates yet. For IPv6, run the DNS Beacon client directly on the target device.

Works with Omada Controller v5+ and gateway firmware that exposes a Custom DDNS entry (ER605, ER7206 and similar). Pick "Custom" as the Service Provider and create a new Dynamic DNS entry — Omada substitutes [DOMAIN], [IP], [USERNAME] and [PASSWORD] in the URL automatically.

Detailed setup guide →

Aruba Instant

Configuration → Services → Dynamic DNS

Provider:
DynDNS
URL:
https://api.dnsbeacon.com/nic/update?hostname=<h>&myip=<a>
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
IPv4 only – Aruba Instant On does not support DDNS with IPv6. For IPv6, run the DNS Beacon client directly on the target device.

Aruba Instant (ArubaOS 8.x+) supports custom Dynamic DNS profiles. In the Web UI or via CLI (`dynamic-dns` / `ddns-profile`), set the provider to "DynDNS" and override the URL so updates go to the DNS Beacon API. Aruba substitutes <h> with the hostname and <a> with the current IP.

Detailed setup guide →

LANCOM

Communication → General → Action Table (LANconfig)

Action (URL):
https://api.dnsbeacon.com/nic/update?hostname=%h&myip=%a
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
Placeholder %z. Dual stack: append &myipv6=%z to the action URL. DS-Lite: use only ?hostname=%h&myipv6=%z.

In LANconfig, under Communication → General → Action Table, create a new action triggered on "Established" / IP change. LANCOM substitutes %h with the hostname and %a with the current IPv4 (use %z for IPv6). Embed your credentials as `https://<username>:<API key>@…` in the URL.

Detailed setup guide →

DrayTek Vigor

Applications → Dynamic DNS Setup

Service Provider:
User-Defined
Provider Host:
api.dnsbeacon.com
Service API:
/nic/update?hostname=myhouse.dnsfollowme.uk&myip=###IP###
Domain Name:
myhouse.dnsfollowme.uk
Login Account:
your email address
Password:
your API key
IPv6:
IPv4 only – Customized DDNS only provides the WAN IPv4 via ###IP###. For IPv6, run the DNS Beacon client directly on the target device.

Pick "User-Defined" as the Service Provider. DrayTek substitutes ###IP### with the current WAN IP automatically; the Login Account and Password are sent as HTTP basic auth to /nic/update. Set "Determine Real WAN IP" to "WAN IP" if the router is connected directly to the internet.

Detailed setup guide →

Ubiquiti EdgeRouter

CLI (configure) — or GUI: Services → DNS → Dynamic DNS

Protocol:
dyndns2
Server:
api.dnsbeacon.com
Hostname:
myhouse.dnsfollowme.uk
Login:
your email address
Password:
your API key
IPv6:
IPv4 only – the ddclient shipped with EdgeOS does not handle AAAA updates reliably. For IPv6, run the DNS Beacon client directly on the target device.

EdgeOS uses ddclient. In the CLI: `set service dns dynamic interface eth0 service custom-dnsbeacon protocol dyndns2`, then `server <API host>`, `host-name <hostname>`, `login <email>`, `password <API key>` — then `commit; save`. Replace eth0 with your WAN interface.

Detailed setup guide →

FortiGate

Network → DNS → Dynamic DNS

Server:
genericDDNS
Server address:
api.dnsbeacon.com
Domain:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
FortiOS 7.0+: add a second DDNS entry with server-type ipv6 and addr-type ipv6.

FortiOS 6.x and later support the "genericDDNS" server type, which calls the standard DynDNS2 /nic/update endpoint on any server you specify. In the CLI: `config system ddns` → `set ddns-server genericDDNS`, `set ddns-server-addr` with the API address, `set ddns-domain` with your hostname, `ddns-username` / `ddns-password` for authentication. Set the monitor-interface to your WAN interface.

Detailed setup guide →

bintec elmeg

Local Services → DynDNS Client → DynDNS Provider → New

Server:
api.dnsbeacon.com
Update URL:
/nic/update?hostname=<domain>&myip=<ipaddr>
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
From firmware 10.2.5 the DynDNS client also reports IPv6 (incl. DS-Lite) — enable the IPv6 option in the provider entry; placeholder per the firmware help.

Under Local Services → DynDNS Client → DynDNS Provider, create a new provider with this server and update URL. bintec substitutes <domain> with the hostname and <ipaddr> with the current WAN IP; username and password are sent for authentication. Then select this provider in the DynDNS registration.

Detailed setup guide →

Zyxel USG FLEX / ATP

Configuration → System → DDNS

DDNS Provider:
User customize
Server / Host:
api.dnsbeacon.com
URL:
/nic/update?hostname=<domain>&myip=<ipaddr>
Domain Name:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
IPv4 only – the ZLD DDNS feature only reports the IPv4 of the WAN interface. For IPv6, run the DNS Beacon client directly on the target device.

Pick "User customize" as the DDNS Provider. Zyxel substitutes <domain> with the Domain Name and <ipaddr> with the WAN IP; Username and Password are sent as authentication to /nic/update. The trailing "?" in the URL is required.

Detailed setup guide →

Peplink Balance

Network → WAN → [connection] → Dynamic DNS Settings

Service:
custom (User-defined)
Server:
api.dnsbeacon.com
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address
Password:
your API key
IPv6:
IPv4 only – Peplink's DDNS does not report IPv6 addresses. For IPv6, run the DNS Beacon client directly on the target device.

From firmware 6.3 you can specify a custom DDNS server under Dynamic DNS Settings. The custom option speaks the DynDNS protocol — enter the API host as the server. Username is your email, password is an API key.

Detailed setup guide →

VyOS

CLI (configure)

Protocol:
dyndns2
Server:
api.dnsbeacon.com
Hostname:
myhouse.dnsfollowme.uk
Login:
your email address
Password:
your API key
IPv6:
VyOS 1.4+: create a separate name block for IPv6 (e.g. dnsbeacon6) and additionally set ip-version ipv6 there.

In the CLI: `set service dns dynamic name dnsbeacon protocol dyndns2`, then `server <API host>`, `host-name <hostname>`, `username <email>`, `password <API key>`, `address interface eth0` — then `commit; save`. On VyOS 1.2/1.3 the path is `service dns dynamic interface eth0 service …`.

Detailed setup guide →

MikroTik RouterOS

System → Scripts and System → Scheduler (WinBox or terminal)

WAN interface:
interface that holds the public IP, e.g. ether1 or pppoe-out1 (replace ether1 in the script)
Hostname:
myhouse.dnsfollowme.uk
Username:
your email address (<email> in the script)
Password:
your API key (<api-key> in the script)
Script, line 1:
:local a [/ip address get [find interface=ether1] address]; :local ip [:pick $a 0 [:find $a "/"]]
Script, line 2:
:local r [/tool fetch url="https://api.dnsbeacon.com/nic/update?hostname=myhouse.dnsfollowme.uk&myip=$ip" user="<email>" password="<api-key>" output=user as-value]; :log info ("dnsbeacon: " . ($r->"data"))
Scheduler:
/system scheduler add name=dnsbeacon interval=5m on-event=dnsbeacon policy=read,write,test
IPv6:
In line 1 replace /ip address with /ipv6 address and [find interface=ether1] with [find interface=ether1 global]; in line 2 send &myipv6=$ip instead of &myip=$ip.

RouterOS has no built-in DynDNS2 client — IP Cloud only talks to MikroTik's own service. A two-line script does the update instead: line 1 reads the IP of the WAN interface, line 2 calls /nic/update via /tool fetch with HTTP basic auth and writes the response to the log. On DSL/PPPoE the WAN interface is usually pppoe-out1. Behind CGNAT/DS-Lite the WAN IP is private and unreachable over IPv4 anyway — send myipv6 with the global IPv6 address instead. Applies to RouterOS 7 (and 6.45+).

Detailed setup guide →

Other devices (DynDNS2 compatible)

Any device that speaks DynDNS2 works with the following:

Update URL:
https://api.dnsbeacon.com/nic/update?hostname=<host>&myip=<ip>
Auth:
Basic Auth (email / API key)
IPv6 (optional):
extra parameter &myipv6=<ipv6>

Native update clients

Beta

A lightweight update client that runs on the device itself — ideal for laptops, workstations and servers that should report their public IP without the router owning the DynDNS configuration. Available for Windows, macOS and Linux.

  • ✓Status at a glance — a tray icon on Windows, a menu bar icon on macOS, the dnsbeacon-client status command on Linux: last update time, reported IP, next run.
  • ✓Autostart at boot, no manual trigger needed; updates run in the background.
  • ✓Detects IPv4 and IPv6 separately and can keep both address families up to date in parallel.
  • ✓Signed installers: MSI for Windows, notarized pkg for macOS (universal). For Linux, deb, rpm or a static binary for x86-64, ARM64 and ARMv7.

All three clients are available in the dashboard under Downloads; the guides below walk through the setup step by step.

Windows Client

tray icon → Settings

Install:
download the MSI from the Downloads page (dashboard → Downloads) and install it
Hostname:
myhouse.dnsfollowme.uk
API key:
dyndns_… key from the dashboard (input is masked)
Interval:
minutes between IP checks (default 5)
IPv4 (A):
“Update IPv4 (A)” checkbox — default on
IPv6 (AAAA):
“Update IPv6 (AAAA)” checkbox — untick IPv4 for IPv6-only (DS-Lite)
Service:
the Windows service updates even with no user logged in

The API key is a dyndns_… key from the dashboard — account passwords are rejected by the server. The service keeps itself updated automatically; the tray app shows the status and last IP.

Detailed setup guide →

macOS Client

Terminal

Install:
download the pkg from the Downloads page (dashboard → Downloads) and double-click to install
Configure:
sudo dnsbeacon-client configure --hostname myhouse.dnsfollowme.uk
--hostname <fqdn>:
hostname to keep updated
--interval <min>:
minutes between IP checks (default 5)
--ipv4 / --no-ipv4:
update IPv4 (A record) — default on
--ipv6 / --no-ipv6:
update IPv6 (AAAA record) — default off; --no-ipv4 --ipv6 for IPv6-only (e.g. DS-Lite)
--api-key-stdin:
read the API key from stdin (for scripting); without it you get a hidden prompt
Apply:
sudo launchctl kickstart -k system/com.dnsbeacon.client
Verify:
dnsbeacon-client status or sudo dnsbeacon-client once --force
Log:
/Library/Logs/DynDnsClient/daemon.log

The API key is a dyndns_… key from the dashboard — account passwords are rejected by the server. After installing, the “DNS Beacon” menu bar icon shows the status; the daemon runs as a launchd service even with no user logged in and keeps itself updated.

Detailed setup guide →

Linux Client

Terminal

Install:
download the package from the Downloads page (dashboard → Downloads): sudo dpkg -i dnsbeacon-client_*.deb, sudo rpm -i dnsbeacon-client-*.rpm, or sudo sh install.sh from the tarball
Configure:
sudo dnsbeacon-client configure --hostname myhouse.dnsfollowme.uk
--hostname <fqdn>:
hostname to keep updated
--interval <min>:
minutes between IP checks (default 5)
--ipv4 / --no-ipv4:
update IPv4 (A record) — default on
--ipv6 / --no-ipv6:
update IPv6 (AAAA record) — default off; --no-ipv4 --ipv6 for IPv6-only (e.g. DS-Lite)
--api-key-stdin:
read the API key from stdin (for scripting); without it you get a hidden prompt
Apply:
sudo systemctl restart dnsbeacon-client
Verify:
dnsbeacon-client status or sudo dnsbeacon-client once --force
Log:
journalctl -u dnsbeacon-client -f

The API key is a dyndns_… key from the dashboard — account passwords are rejected by the server. The client runs as a systemd service under root and updates from boot even with no user logged in. It keeps itself up to date, taking the same route it was installed by (dpkg, rpm, or a binary swap). For systems without dpkg/rpm — Alpine, Arch, NAS firmware — there is a tarball with install.sh; the binary is statically linked and has no dependencies.

Detailed setup guide →

Bring your own domain

You can attach a domain you host yourself with a supported DNS provider. Your API token is stored AES-256-GCM encrypted and is only used to update DNS records for that domain.

Cloudflare

Prerequisite: the domain is delegated to Cloudflare (nameservers set to Cloudflare).

  1. On dash.cloudflare.com/profile/api-tokens create a token.
  2. Use the template "Edit zone DNS" — permissions: Zone:DNS:Edit.
  3. Under Zone Resources pick either Specific zone → your-domain.com or All zones.
  4. Copy the token and paste it into the dashboard under Domains → Add domain.

Hetzner DNS

Prerequisite: the domain is set up as a zone in the Hetzner DNS Console.

  1. On dns.hetzner.com/settings/api-token create an API token.
  2. Copy the token — it's only shown once.
  3. In the dashboard, under Domains → Add domain, pick provider "Hetzner DNS" and paste the token.

united-domains

Prerequisite: the paid DNS API add-on is enabled for the zone at united-domains. Without it the token returns no zones.

  1. Book the DNS API add-on in the united-domains portfolio.
  2. Generate the API key in your customer account.
  3. In the dashboard, under Domains → Add domain, pick provider "united-domains" and paste the key.

Rate limit: 1,200 requests/hour per token.

IONOS

Prerequisite: the domain is in your IONOS account and API access is enabled in the developer portal.

  1. Open developer.hosting.ionos.de/keys and create a new key pair (public prefix + secret).
  2. Copy the combined token in the format "<prefix>.<secret>" — it is shown only once.
  3. In the dashboard, under Domains → Add domain, pick provider "IONOS" and paste the combined token.

TXT records are supported — Let's Encrypt certificates via DNS-01 work for IONOS-hosted zones.

INWX

Prerequisite: the domain is in your INWX account.

  1. Log into the INWX customer area and create an API sub-user without 2FA under "Account → User management".
  2. Note down the sub-user's username and password.
  3. In the dashboard, under Domains → Add domain, pick provider "INWX" and enter the username and password.

Important: INWX API login fails when the account has Mobile-TAN 2FA enabled. Create a separate sub-user without 2FA for this — your main account can (and should) keep 2FA.

netcup

Prerequisite: the domain is managed through your netcup account.

  1. In the netcup Customer Control Panel under "Stammdaten ändern → API", create a new API key pair.
  2. Note down customer number, API key, and API password (the password is only shown once).
  3. In the dashboard, under Domains → Add domain, pick provider "netcup" and paste all three values.

Note: the netcup API is recordset-based (every change replaces the entire record set). If you edit DNS records manually in the CCP at the same moment we set a Let's Encrypt TXT record, one change can be lost. For normal traffic (DynDNS updates, cert renewals) this is fine.

OVHcloud

Prerequisite: the domain is in your OVHcloud account and you're using the European endpoint (eu.api.ovh.com).

  1. Create a new API application at ovh.com/auth/api/createApp — you'll receive an application key and an application secret.
  2. Open the OVH Token Maker, enter the application key and secret, and generate a consumer key.
  3. Important: grant the consumer key these rights (GET, POST, PUT, DELETE each on /domain/zone/*), confirm in your OVH account, and copy the resulting consumer key.
  4. In the dashboard, under Domains → Add domain, pick provider "OVHcloud" and paste all three values.

Note: we default to the EU endpoint. CA/US accounts need a different base URL — please reach out beforehand.

deSEC

Prerequisite: a (free) deSEC.io account with a zone set up there.

  1. Create a new API token at desec.io/tokens.
  2. Copy the token immediately — it's shown only once.
  3. In the dashboard, under Domains → Add domain, pick provider "deSEC" and paste the token.

deSEC is ACME-DNS-01 friendly — Let's Encrypt certificates work without any special configuration.

Gandi

Prerequisite: the domain is managed through your Gandi account.

  1. Open admin.gandi.net and sign in.
  2. Under Authentication options → Personal Access Tokens, create a new token with the "Manage DNS records" permission.
  3. In the dashboard, under Domains → Add domain, pick provider "Gandi" and paste the token.

Gandi LiveDNS enforces a 300s minimum TTL — we raise lower values automatically.

Mittwald

Prerequisite: a Mittwald account with a project, and the domain is set up there as a DNS zone.

  1. In mStudio, under Profile → API Tokens, create a new token with write access to DNS zones.
  2. Note the project ID (UUID) of the project that owns the zone — visible in the mStudio URL.
  3. In the dashboard, under Domains → Add domain, pick provider "Mittwald" and paste the API token and project ID.

Note: Mittwald creates a separate "DNS Zone" object inside your project for every subdomain (sub-zone delegation). 10 DynDNS hosts → 10 sub-zones — functionally fine, but visible in the mStudio UI.

Infomaniak

Prerequisite: the domain is in your Infomaniak Manager account.

  1. Open Manager → Profile → API keys and create a token with the "Domain" scope.
  2. Note the token (shown only once).
  3. In the dashboard, under Domains → Add domain, pick provider "Infomaniak" and paste the token.

Infomaniak natively supports TXT records — Let's Encrypt certificates via DNS-01 work without special configuration.

Scaleway

Prerequisite: the domain is registered with Scaleway and managed in your account.

  1. In the Scaleway console, under IAM → API keys, create a new API key.
  2. Note the "Secret Key" only — the access key isn't needed.
  3. In the dashboard, under Domains → Add domain, pick provider "Scaleway" and paste the Secret Key.

Scaleway uses a PATCH-based change model — operations are atomic per request. Let's Encrypt DNS-01 works natively.

API & endpoints

DynDNS2 endpoint

The router-compatible update endpoint:

GET https://api.dnsbeacon.com/nic/update?hostname=<host>[&myip=<ipv4>][&myipv6=<ipv6>]
Authorization: Basic base64(<email>:<api-key>)

Possible responses:

good <ip>Update accepted
nochg <ip>IP unchanged, no DNS update needed
nohostHostname doesn't exist or is inactive
badauthEmail or API key is wrong
badparamInvalid parameters (e.g. malformed IP)
abuseIP address not allowed as a target (reserved range or regional policy) — do not retry
911Server error — retry later

Test with curl

curl -u "you@example.com:dyndns_..." \
  "https://api.dnsbeacon.com/nic/update?hostname=myhouse.dnsfollowme.uk&myip=1.2.3.4"
Available

Automatic SSL for your hostnames

One-click certificate issuance via Let's Encrypt — straight from the dashboard, no ACME client, no configuration on your side. Works for subdomains on our domain and for your own domain (BYOD).

  • ✓One-click issuance from the dashboard — works for subdomains on our domain and for your own domain (BYOD).
  • ✓Automatic renewal in the background; the latest certificate is always available for download.
  • ✓DNS-01 validation — no open port 80 needed, works behind NAT or DS-Lite.
  • ✓CAA pinning makes sure only authorized CAs can issue certificates for your hostnames.

Requires a PRO or BUSINESS plan.

FAQ

My router isn't sending updates — what do I do?▼

Most routers (UniFi, Fritz!Box) only send updates when the WAN IP actually changes. To force one, disable the DynDNS config in the router, save, re-enable, save. The dashboard's Hostnames → History tab shows whether updates are arriving.

My API key — how do I use it?▼

Enter it in the router as the password instead of your account password. The email stays as the username. You can revoke the API key any time without changing your account password.

Can I use IPv6?▼

Yes. Append "&myipv6=<your-ipv6>" to the update URL — the service will create an AAAA record alongside the A record. Free and Pro plans can use both in parallel.

What if I lose my API key?▼

API keys are only stored as hashes and can't be recovered. Delete the old key in the dashboard, create a new one, and update your router.

How many hostnames/domains can I create?▼

Free: 3 hostnames, 1 custom domain, 3 API keys. Pro: unlimited. Business: unlimited + team login.

What is domain verification?▼

When you add a custom domain, the service uses the supplied token to call the DNS provider and check that the zone exists and the token has access. If that works, the domain is marked verified and can be used immediately.

How do I enable two-factor authentication?▼

Under Settings → Two-factor authentication. During setup the service shows a QR code that you scan with Google Authenticator, Authy, Bitwarden, or 1Password. On activation you get 8 single-use backup codes — store them safely. API keys for /nic/update are not affected by 2FA — routers still only need email + API key.