DDNS-Go

Last reviewed Aug 26, 2026 · 873 words

Before you install DDNS-Go, open your router's status page and compare its WAN address with what curl -4 ifconfig.me reports from a machine inside. If they differ, and the router shows something in 100.64.0.0/10, you are behind carrier-grade NAT and no dynamic DNS client on earth will make inbound connections work. That check takes 30 seconds and saves an evening. If the addresses match, DDNS-Go is the lightest way to keep a domain pointed at a home connection: a 64 MB Go binary with a web page, many DNS providers, and IPv4 plus IPv6 handled in one place.

The compose that works, and why host networking

services:
  ddns-go:
    image: jeessy/ddns-go
    network_mode: host
    command: -l :9876 -f 300
    volumes:
      - ./ddns-go:/root
    restart: unless-stopped

-l :9876 sets the web UI port and -f 300 the check interval in seconds; 5 minutes is polite to your provider's API and quick enough for a home IP that changes a few times a year. Host networking is not optional if you want IPv6. In bridge mode the container sees Docker's internal addresses, so DDNS-Go cannot read the host's public IPv6 from an interface. With network_mode: host it can pick the address off the interface directly, which is more reliable than asking an external lookup service, and matters because IPv6 is the one case where a home address really is globally routable. The IPv6 homelab guide covers why that is worth setting up.

Scope the API token, then lock the UI

DDNS-Go needs a credential for your DNS provider, and it stores that credential in its config file. Two rules follow. First, mint a token that can only edit DNS records in the one zone, not an account-wide key; on Cloudflare that is a token with the DNS edit permission scoped to a single zone, and most providers with an API offer something similar. If the box is compromised, the attacker gets to change your subdomain, not your billing. Second, the web UI on 9876 must not face the internet. Set a username and password in the UI on first run, and keep the port reachable only from the LAN or over a VPN. There is also a -noweb flag to disable the interface entirely once the config is saved, which is the right end state for a set-and-forget service.

Providers, and what to do when yours is missing

The provider list is long and skews toward the projects' home market: Cloudflare, Alibaba Cloud DNS, DNSPod, Tencent Cloud and Huawei Cloud alongside Porkbun, GoDaddy and a few others. The documentation follows the same skew and is partly in Chinese, which the catalogue rightly flags; the UI itself is translated and the settings are few enough that a screenshot carries you through. If your registrar is not listed, the Callback provider fires an HTTP request of your own construction with the new address substituted into the URL or body, which covers any registrar with a simple update endpoint and most that have a REST API. Confirm each record with dig after the first run rather than trusting the green tick.

Detection order decides how often you get it wrong

DDNS-Go can learn its public address 3 ways: by asking an external URL, by reading a network interface, or by running a command. External lookup is the default and works everywhere, but depends on a third-party endpoint and fails silently when that endpoint changes. For IPv4 behind a normal home router it is the only option, so pick 2 lookup URLs so a dead one does not stall updates. For IPv6, read the interface. The log page in the UI shows every check and every update, and a record that is updated every 5 minutes with the same value is a sign the comparison is broken, usually because 2 addresses are appearing on the interface.

DDNS-Go against DuckDNS

DuckDNS is a free hosted service with its own subdomains and a one-line cron update; DDNS-Go is a client for the domain you already own at the provider you already use. DuckDNS is faster to start, and for a first homelab it removes the registrar step entirely. DDNS-Go wins once you want home.yourdomain.tld on a provider you control, IPv6 handled properly, and a UI showing what happened. The pieces fit together; the DNS for self-hosters piece explains the split between the public record this tool maintains and the internal names your services actually use.

What I'd do

Confirm you are not behind CGNAT, then run DDNS-Go with host networking, a zone-scoped token, a 300-second interval, and the UI locked to the LAN or disabled with -noweb after setup. Point one wildcard or a handful of subdomains at it and let a reverse proxy sort the rest. If you are behind CGNAT after all, stop here and use a mesh VPN or a tunnel; the three approaches to remote access explain which, and none of them needs a dynamic DNS client at all.