What is RFC 2136 Dynamic DNS?

RFC 2136 is the IETF standard protocol for dynamic DNS updates over standard TCP/UDP port 53. It allows authorized systems, routers, and scripts to add, modify, or delete DNS records in real time without proprietary vendor HTTP APIs.

How are RFC 2136 updates authenticated?

Updates are authenticated using TSIG (Transaction Signature, RFC 2845) with cryptographic HMAC keys (such as HMAC-SHA256). Every update packet is mathematically signed and verified before being applied to the authoritative zone.

Can I use RFC 2136 for Let's Encrypt automated wildcard certificates?

Yes. OnlyDNS fully supports Certbot's standard 'certbot-dns-rfc2136' plugin, acme.sh, and Traefik for 100% automated DNS-01 ACME challenge verification and wildcard SSL certificate issuance.

Can I restrict TSIG keys to specific subdomains like _acme_challenge?

Yes. OnlyDNS supports granular subdomain restriction for TSIG keys. You can restrict a TSIG key to only update designated subdomains (such as _acme_challenge or specific hostnames) instead of allowing full read/write access to your entire DNS zone. This enforces least-privilege security for automated SSL daemons and remote systems.

Dynamic DNS & RFC 2136 TSIG Updates — Granular Subdomain Scoping

// Open Standards

Why Standard RFC 2136 Beats Proprietary APIs

Most cloud providers force you to build custom HTTP wrappers. OnlyDNS supports the universal Internet standard implemented by every major network operating system and automation tool.

⚡

Rapid Global Propagation (0.2–5s)

When your client executes an RFC 2136 update, our edge engine applies the changes immediately and propagates them across all 23 Anycast nodes in 0.2 to 5 seconds. No 60-second polling delays.

🛡️

Granular Subdomain Scoping

Restrict TSIG keys to update only designated subdomains (such as _acme_challenge.example.com) instead of granting full read/write to the entire zone. Enforces true least-privilege security.

🔑

Cryptographic TSIG Key Security

Secure updates using HMAC-SHA256, HMAC-SHA512, or HMAC-SHA384 (RFC 2845). Deploy individual TSIG keys per domain for isolated zero-trust authentication without sharing account-wide API tokens.

🌐

Universal Native Compatibility

Works natively out-of-the-box with BIND nsupdate, Certbot ACME, Kubernetes external-dns, Terraform, pfSense, OPNsense, OpenWrt, and Mikrotik RouterOS.

// Practical Integration

Integration Examples & Client Configurations

Standard configurations for common Dynamic DNS and automated TLS certificate workflows.

1. Standard BIND nsupdate RFC 2136

Update an A record dynamically from a Linux/macOS host or edge server:

$ nsupdate -y hmac-sha256:my-key-name:c2VjcmV0S2V5...
> server ns1.onlydns.com
> zone example.com
> update delete server1.example.com A
> update add server1.example.com 60 A 203.0.113.42
> send
> quit

2. Certbot Wildcard SSL (DNS-01) ACME

Automate Let's Encrypt wildcard certificates via /etc/letsencrypt/rfc2136.ini (tip: restrict key to _acme_challenge in the portal):

# /etc/letsencrypt/rfc2136.ini
dns_rfc2136_server = ns1.onlydns.com
dns_rfc2136_port = 53
dns_rfc2136_name = your-tsig-key-name
dns_rfc2136_secret = c2VjcmV0S2V5VmFsdWU=
dns_rfc2136_algorithm = HMAC-SHA256

# Issue certificate (scoped to _acme_challenge for maximum security)
certbot certonly --dns-rfc2136 \
  --dns-rfc2136-credentials /etc/letsencrypt/rfc2136.ini \
  -d "*.example.com" -d "example.com"

View Full ACME How-To Guide (Certbot, acme.sh, Caddy, Traefik) →

3. pfSense / OPNsense Firewall DDNS Router DDNS

Configure standard RFC 2136 client under Services > Dynamic DNS:

Service Type: RFC 2136
Server: ns1.onlydns.com
Key Name: Your TSIG Key Name
Key Secret: Your TSIG Secret Key
Key Algorithm: HMAC-SHA256

4. Key Provisioning & Subdomain Scoping CLI & Portal →

Create TSIG keys and bind them with granular subdomain restrictions in the Portal or via OnlyDNS CLI / API:

# Generate a new TSIG key (auto-generated key name)
onlydns tsig create --algo hmac-sha256

# Restrict dynamic updates via CLI to specific subdomain(s) (e.g. ACME challenge)
onlydns tsig set-permissions example.com <key_name> --update --subdomain _acme-challenge

# View configured TSIG permissions on a domain
onlydns tsig get-domain example.com

View CLI Tool Documentation →

// Dynamic DNS Comparison

OnlyDNS vs. Legacy Dynamic DNS Providers

Feature	OnlyDNS (RFC 2136)	Proprietary DDNS (No-IP, Dyn)	Cloudflare / Route 53
Protocol Standard	RFC 2136 (IETF Standard)	Proprietary HTTP GET/POST	Vendor REST API only
Propagation Speed	0.2–5s edge sync	1–5 minutes	30–60 seconds
Certbot & ACME Compatibility	Native (rfc2136 plugin)	✗ Custom hook scripts	Requires cloud-specific plugin
Granular Subdomain TSIG Scoping	✅ Yes (e.g. restrict to _acme_challenge)	✗ Account-wide tokens only	Requires complex IAM policy JSON
Custom Domain Names	Your own root & subdomains	Often forced third-party subdomains	Custom domains

// Real-Time Automation

Automate Your Dynamic Infrastructure with OnlyDNS

Full RFC 2136 and TSIG key management included on all plans. Start free with 250,000 monthly queries.

Create Free Account Read Migration Guide →

Standards-Compliant Dynamic DNS (RFC 2136)