Documentation

Grouped by what you are trying to do.

Point a name at something

• FritzBox
• OpenWrt
• Synology
• Ubiquiti / UniFi
• pfSense
• OPNsense
• ddclient
• curl and cron

Get a certificate

• Caddy
• Nginx Proxy Manager
• Traefik
• acme.sh
• lego
• cert-manager (Kubernetes)

Fix LAN resolution

If your name resolves on mobile data but fails at home, your local resolver is stripping the answer as DNS rebind protection. This is the most common support question we get, and the fix is one line.

• Unbound on OPNsense
• Unbound on pfSense
• dnsmasq on OpenWrt
• FRITZ!Box
• Pi-hole and AdGuard Home

Use with Tailscale, Headscale or WireGuard

• Names and certificates for a tailnet

Reference

• API reference: dyndns2, acme-dns, REST

Your zone is signed with ECDSA P-256 (RFC 6605) using a single CSK, with NSEC3 at zero iterations and an empty salt as RFC 9276 recommends. CAA records (RFC 8659) at the apex pin issuance to the CAs we use. Certificates are issued over ACME (RFC 8555) using the DNS-01 challenge, so nothing needs port 80 and nothing needs to be reachable from the internet.