Question 1

What is CertaDNS?

Accepted Answer

CertaDNS is a DNS platform that does three things in one product: (1) Dynamic DNS for users with changing IPs, (2) managed authoritative DNS hosting for full zones, and (3) hosted email authentication — SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI — on a tier that starts free. You can use any one of those on its own, or combine them. Email authentication does not require you to host your DNS here.

Question 2

Is CertaDNS a free Dynamic DNS service?

Accepted Answer

Yes. The Free tier includes 5 subdomains with a 60-minute TTL — fine for personal use, home labs, and testing. Paid tiers add faster TTL, more subdomains, API access, and additional features. See the pricing page for current tier details.

Question 3

What is Dynamic DNS?

Accepted Answer

Dynamic DNS (DDNS) is a service that automatically updates a hostname's DNS record when the underlying IP address changes. It lets you reach your home or office network using a stable domain name like myserver.certadns.com even when your ISP rotates your public IP.

Question 4

How do I update my IP address?

Accepted Answer

Three options: (1) the web dashboard, (2) the API (Pro and Elite plans), or (3) the dyndns2-compatible update endpoint your router probably already supports. Most consumer routers have a DDNS settings page that handles updates automatically once configured.

Question 5

How do I set up CertaDNS on my router?

Accepted Answer

1. Open your router's admin panel and find the DDNS / Dynamic DNS section.
2. Pick "Custom" or "DynDNS" as the service type.
3. Settings:
   - Server / Host: www.certadns.com
   - Username: your CertaDNS username
   - Password: your CertaDNS password (or an API key)
   - Hostname: your full domain, e.g. myserver.certadns.com
4. Save and enable DDNS.

Notes: Ubiquiti routers — avoid the "afraid" service type, use "custom." Model-specific guides are linked from your dashboard.

Question 6

How fast do DNS changes propagate?

Accepted Answer

Free accounts use a 60-minute TTL; paid plans (Pro and Elite) use a 60-second TTL. Once we publish the change at the authoritative server, downstream resolvers will pick it up within the TTL window — meaning a paid DDNS update is typically visible everywhere in well under two minutes.

Question 7

Is there an API for DDNS automation?

Accepted Answer

Yes. API key access is available on Pro and Elite plans. Use it to script updates, integrate with your own monitoring, or run DDNS from non-router devices (e.g. a server behind a residential connection). The API also exposes account-level operations like managing subdomains.

Question 8

What is managed DNS, and how is it different from Dynamic DNS?

Accepted Answer

Managed DNS means CertaDNS is your authoritative nameserver for an entire zone you own (e.g. example.com), not just a single dynamic hostname. We host the full zone, serve queries from the public nameserver fleet, and let you manage every record type — A, AAAA, MX, TXT, CNAME, NS, SRV, CAA — from the dashboard. Dynamic DNS is a single hostname with an auto-updating IP; managed DNS is your whole zone.

Question 9

Can I move an existing domain to CertaDNS?

Accepted Answer

Yes. Add the domain under Managed DNS and prove you own it with a TXT record. Then add your records in the dashboard — they are not copied from your current provider, so recreate the ones you need before you switch. Finally, point your registrar's nameservers at ns1.certadns.com, ns2.certadns.com and ns3.certadns.com. A domain already set up under Email Authentication keeps its email records: they are copied into the zone for you.

Question 10

Do you support DNSSEC?

Accepted Answer

Yes. The certadns.com zone is itself DNSSEC-signed, and we support DNSSEC for managed customer zones. Records are automatically re-signed on every change, and we handle SOA serial bumps + NOTIFY-driven propagation to the secondary nameservers.

Question 11

Can I use vanity nameservers?

Accepted Answer

Yes — vanity nameservers (e.g. ns1.yourdomain.com instead of ns1.certadns.com) are available on the Elite plan. This lets you white-label the service so end customers see your brand on the NS records.

Question 12

Do you offer DNS analytics?

Accepted Answer

Yes. We aggregate query telemetry from the authoritative fleet and surface it per-zone in the dashboard — query volume over time, source countries, query types, and which records are most queried. Useful for capacity planning, anomaly detection, and understanding which subdomains actually get traffic.

Question 13

How many nameservers do you operate?

Accepted Answer

Six public secondary nameservers published as ns1, ns2 and ns3.certadns.com, run on two independent networks across five locations on two continents — US East, US West, Germany, France and the UK — each reachable over IPv4 and IPv6. Every published name resolves to more than one server, and no name depends on a single location. Behind them is a hidden primary the secondaries replicate from, which is not reachable from the internet: a compromise of a public nameserver cannot touch your authoritative data.

Question 14

What do the Email Authentication tiers include?

Accepted Answer

Free covers one domain: hosted DMARC and BIMI, aggregate and forensic report processing, the geolocation breakdown, and two-factor authentication. Plus, at $12 a month, adds hosted DKIM, MTA-STS and TLS-RPT across two domains, plus TLS reports and scheduled reports by email. Premium, at $70, covers five domains, adds hosted SPF and permission and group management, and includes unlimited users with a year of data history. Enterprise is quoted and adds unlimited domains, three years of history, report export, brand protection, SIEM and chat integrations, API access and audit logs. Hosted SPF is available on Free and Plus as a $10-a-month add-on.

Question 15

What is SPF, and how do you fix the 10-lookup limit?

Accepted Answer

SPF (Sender Policy Framework) tells receiving mail servers which IPs are authorized to send mail for your domain. RFC 7208 caps SPF at 10 DNS lookups per evaluation — adding too many include: mechanisms breaks it. We solve this two ways: (1) static flattening (we resolve all your provider includes into a single TXT record), and (2) macro-based dynamic SPF (we generate a tailored response per sending IP at query time, so the lookup count is always 1). You don't have to choose — both modes are available.

Question 16

What is dynamic SPF, and why does it matter?

Accepted Answer

Dynamic SPF uses RFC 7208 macros (s, l, o, i, h) so the SPF response is computed per query based on the sending IP and the EHLO hostname. The advantage over static flattening: the record never grows as you add providers, you never hit the 10-lookup limit, and provider IP changes propagate without you republishing anything. We handle this via authoritative DNS — no behavior change required at your mail infrastructure.

Question 17

How does CertaDNS handle DKIM keys?

Accepted Answer

We generate the keypair, publish the public key as a TXT record at selector._domainkey.<zone>, and let you download or rotate it from the dashboard. Scheduled rotation is built in (default 90 days with a configurable overlap window so in-flight signatures don't break). You can also import your own keys if you already have them.

Question 18

How does DMARC report ingestion work?

Accepted Answer

Set your DMARC record's rua= to reports@certadns.com (or a custom RUA address we host for you). Receiving mail servers send aggregate reports daily — we ingest, parse, attribute the sending IPs to known providers, and surface what you need to know in the dashboard. No mailbox to manage on your side.

Question 19

How does the Policy Wizard help me get to p=reject?

Accepted Answer

The wizard walks you from monitoring (p=none) through quarantine to full reject, gated on real signal from your aggregate reports. It won't advance you until your authorized-sender alignment is healthy, and it surfaces which senders are tripping you up. Most teams reach p=reject within a quarter if their sender footprint is workable.

Question 20

Do you host MTA-STS certs and policies for me?

Accepted Answer

Yes. For every managed zone with MTA-STS enabled, we issue a Let's Encrypt cert for mta-sts., host the policy file behind it at the standard /.well-known/mta-sts.txt path, publish the matching DNS records (A mta-sts. and TXT _mta-sts.), and handle automatic renewal. You configure the policy mode (testing or enforce) in the dashboard; we handle the rest of RFC 8461.

Question 21

What is the Report Card?

Accepted Answer

A single per-zone view of your entire email-auth posture: status icons across SPF, DKIM, DMARC, BIMI, MTA-STS, and TLS-RPT, the configured DMARC policy, your reporting addresses, plus a weighted compliance score (0-100) so you know what's missing at a glance. Zones are sorted lowest-compliance first so the most actionable rows surface up top.

Question 22

Do I need to move my DNS to CertaDNS to use Email Authentication?

Accepted Answer

No. Add the domain under Email Authentication and your DNS stays where it is: you create a few CNAME records once, and CertaDNS publishes and maintains the records behind them. SPF is the exception — it sits at the root of your domain, so you publish it at your DNS host and CertaDNS keeps the addresses behind it current. If the domain also uses Managed DNS, CertaDNS publishes every record directly in your zone.

Frequently Asked Questions

Dynamic DNS

Managed DNS

Email Authentication