curl -s -k --user "username:password" "https://domains.google.com/nic/update?hostname=yourdomain.com"

Here are the docs: https://support.google.com/domains/answer/6147083?hl=en#zipp...

Quick question, is there a reason the -k (--insecure) flag is included? I imagine that https://domains.google.com would use a cert trusted by curl so it seems unnecessary and adds a risk that your traffic could be MitM.

Does this mean Let's Encrypt dns-01 challenges could be automated?

[edit: Oh the API only allows changing an A record, for dynamic DNS, not updating anything else in the zone. That makes more sense.]

Here's the relevant portion of my ddclient config:

  protocol=googledomains                                  
  login=XXXXXXX
  password=XXXXXXX                            
  host4.mydomain.com

  protocol=googledomains                                  
  use=web                                                 
  web=checkipv6.dyndns.org/                               
  ipv6=yes                                                
  login=XXXXXXXC                                  
  password=XXXXXXX                             
  host6.mydomain.com

when I go into the web ui for my domain and go to create a dynamic dns name, it only gives me an option for only an A record.

My "guess" is that your solution is to create a normal AAAA record and ddclient can update that record with the info retrieved from checkipv6.dyndns.org? so not using google's UI to setup a AAAA dyn dns record? and my guess is that username/password scoping that you got for host4 worked the same for the "fake static" AAAA record?

or you could have the ability to create AAAA dyn dns records via the UI and for some reason I'm just blind.

But after you update the record using ddclient or whatever, the UI will show the correct type:

https://i.imgur.com/7Vb2eqg.png

As a side note - will the recent announcement by Google about unsafe logins being denied affect you?

https://en.wikipedia.org/wiki/Basic_access_authentication#Se...

~~Also as the parent noted, Google have the last few years been very aggressive about "unsafe login" (using usr+pass outside of Google) and this might disappear.~~

Edit: Never mind, buried in the docs it appears the user:pass are scoped.

https://support.google.com/domains/answer/6147083?hl=en&ref_...

There is a free tier, although you need to provide them a full domain (not a subdomain) for it to work, and then each site/tunnel will create a subdomain. It does work with free domains like .tk if you really want to go that route.

https://developers.cloudflare.com/cloudflare-one/connections...

There are also open-source alternatives using VPNs like Wireguard + nginx, but typically these solutions require you to run a publicly-accessible server already to host the proxy.

Prior to that i used https://freedns.afraid.org which is free if you are willing to share your domain (people can create subdomains that point to their IP) or you can pay to keep it private. It's been around for a very long time, so it's unlikely to vanish. It's a very good service.

And it works on their free account level! Maybe someday they’ll kill that, but they have a history of keeping features in free going.

Correct.

I would definitely not use something like this commercially.

[0] https://github.com/ddclient/ddclient

Something that:

* Lets you set up a domain with a single command

* Handles security for you. There shouldn't be any manual admin needed to make a secure context site

* Works offline on the LAN if possible, and on Yggdrasil meshes.

I should be able to buy a device, plug it in, then scan the QR code on it's display and be instantly taken to its website, no setup or account creation.

Unfortunately the web blocks all insecure requests from within secure contexts, and has no MDNS type functionality, so building a P2P solution with service workers or something is very hard/impossible.

DuckDNS is really almost there. It's the security that makes it hard, Let's Encrypt is not exactly consumer grade.

The security is fine, but it's definitely not plug and play like I'd expect a commercial NAS or something to be.

DDG (unfortunately) is bigger and bigger with every year. They are developing desktop browser, email proxy etc.

I wouldn't be surprised if they'd lunched DDGDNS.

I'd like to think DDG were too principled to do this, but money can really direct moral compasses in large enough quantities.

There are many companies / sites / blogs / YT channels etc that put quantity over quality.

The only possible downside is that you end up with a url with "duckdns.org" in it, but I don't mind

I used an old Android phone with their app to keep the IP updated. Like the old no-ip but without a PC.

When a pro duck needs another roll of duct tape from his industrial supplier, they just put it on his bill and he's good to go.

I have some domains with country-specific tlds, and I'm using small registrars there. he.net is free even in this case.

Edit - I'll leave my original comment up but I originally thought this was a service that users could deploy themselves into their own AWS accounts which it is not. It is, as it says, a DDNS service which is free. The fact that it's hosted in AWS should be neither here nor there.

It kind of gives it a sense of professionalism for marketing purposes.