Question 1

What is CertaDNS?

Accepted Answer

CertaDNS is a DNS platform that does three things in one product: (1) Dynamic DNS for users with changing IPs, (2) managed authoritative DNS hosting for full zones, and (3) email authentication — SPF, DKIM, DMARC, MTA-STS, BIMI, and TLS-RPT — at a single flat add-on price. You can use any one of those on its own, or combine them.

Question 2

Is CertaDNS a free Dynamic DNS service?

Accepted Answer

Yes. The Free tier includes 5 subdomains with a 60-minute TTL — fine for personal use, home labs, and testing. Paid tiers add faster TTL, more subdomains, API access, and additional features. See the pricing page for current tier details.

Question 3

What is Dynamic DNS?

Accepted Answer

Dynamic DNS (DDNS) is a service that automatically updates a hostname's DNS record when the underlying IP address changes. It lets you reach your home or office network using a stable domain name like myserver.certadns.com even when your ISP rotates your public IP.

Question 4

How do I update my IP address?

Accepted Answer

Three options: (1) the web dashboard, (2) the API (Pro and Elite plans), or (3) the dyndns2-compatible update endpoint your router probably already supports. Most consumer routers have a DDNS settings page that handles updates automatically once configured.

Question 5

How do I set up CertaDNS on my router?

Accepted Answer

1. Open your router's admin panel and find the DDNS / Dynamic DNS section.
2. Pick "Custom" or "DynDNS" as the service type.
3. Settings:
   - Server / Host: www.certadns.com
   - Username: your CertaDNS username
   - Password: your CertaDNS password (or an API key)
   - Hostname: your full domain, e.g. myserver.certadns.com
4. Save and enable DDNS.

Notes: Ubiquiti routers — avoid the "afraid" service type, use "custom." Model-specific guides are linked from your dashboard.

Question 6

How fast do DNS changes propagate?

Accepted Answer

Free accounts use a 60-minute TTL; paid plans (Pro and Elite) use a 60-second TTL. Once we publish the change at the authoritative server, downstream resolvers will pick it up within the TTL window — meaning a paid DDNS update is typically visible everywhere in well under two minutes.

Question 7

Is there an API for DDNS automation?

Accepted Answer

Yes. API key access is available on Pro and Elite plans. Use it to script updates, integrate with your own monitoring, or run DDNS from non-router devices (e.g. a server behind a residential connection). The API also exposes account-level operations like managing subdomains.

Question 8

What is managed DNS, and how is it different from Dynamic DNS?

Accepted Answer

Managed DNS means CertaDNS is your authoritative nameserver for an entire zone you own (e.g. example.com), not just a single dynamic hostname. We host the full zone, serve queries from the public nameserver fleet, and let you manage every record type — A, AAAA, MX, TXT, CNAME, NS, SRV, CAA — from the dashboard. Dynamic DNS is a single hostname with an auto-updating IP; managed DNS is your whole zone.

Question 9

Can I import an existing zone?

Accepted Answer

Yes. Point your registrar's nameservers at ns1.certadns.com and ns2.certadns.com, and we read the zone from your existing authoritative server during onboarding. You can review the imported records before any change goes live, and adjust them in the dashboard afterward.

Question 10

Do you support DNSSEC?

Accepted Answer

Yes. The certadns.com zone is itself DNSSEC-signed, and we support DNSSEC for managed customer zones. Records are automatically re-signed on every change, and we handle SOA serial bumps + NOTIFY-driven propagation to the secondary nameservers.

Question 11

Can I use vanity nameservers?

Accepted Answer

Yes — vanity nameservers (e.g. ns1.yourdomain.com instead of ns1.certadns.com) are available on the Elite plan. This lets you white-label the service so end customers see your brand on the NS records.

Question 12

Do you offer DNS analytics?

Accepted Answer

Yes. We aggregate query telemetry from the authoritative fleet and surface it per-zone in the dashboard — query volume over time, source countries, query types, and which records are most queried. Useful for capacity planning, anomaly detection, and understanding which subdomains actually get traffic.

Question 13

How many nameservers do you operate?

Accepted Answer

Four public anycast secondary nameservers (geographically distributed: US East, EU, and APAC), plus a hidden primary that the secondaries replicate from. The hidden-primary architecture means a single compromise of a public nameserver can't touch your authoritative data.

Question 14

What does the Email Authentication add-on include?

Accepted Answer

Every email-authentication pillar in one add-on, billed at $10 per domain per month: SPF (both static flattening and macro-based dynamic SPF), DKIM (key generation and scheduled rotation), DMARC (aggregate report ingestion + policy wizard), MTA-STS (managed cert issuance + policy hosting + auto-renewal), BIMI (configuration + hosted SVG), and TLS-RPT (ingestion and parsing). No per-feature tier gates inside the add-on, and it works on any account regardless of plan.

Question 15

What is SPF, and how do you fix the 10-lookup limit?

Accepted Answer

SPF (Sender Policy Framework) tells receiving mail servers which IPs are authorized to send mail for your domain. RFC 7208 caps SPF at 10 DNS lookups per evaluation — adding too many include: mechanisms breaks it. We solve this two ways: (1) static flattening (we resolve all your provider includes into a single TXT record), and (2) macro-based dynamic SPF (we generate a tailored response per sending IP at query time, so the lookup count is always 1). You don't have to choose — both modes are available.

Question 16

What is dynamic SPF, and why does it matter?

Accepted Answer

Dynamic SPF uses RFC 7208 macros (s, l, o, i, h) so the SPF response is computed per query based on the sending IP and the EHLO hostname. The advantage over static flattening: the record never grows as you add providers, you never hit the 10-lookup limit, and provider IP changes propagate without you republishing anything. We handle this via authoritative DNS — no behavior change required at your mail infrastructure.

Question 17

How does CertaDNS handle DKIM keys?

Accepted Answer

We generate the keypair, publish the public key as a TXT record at selector._domainkey.<zone>, and let you download or rotate it from the dashboard. Scheduled rotation is built in (default 90 days with a configurable overlap window so in-flight signatures don't break). You can also import your own keys if you already have them.

Question 18

How does DMARC report ingestion work?

Accepted Answer

Set your DMARC record's rua= to reports@certadns.com (or a custom RUA address we host for you). Receiving mail servers send aggregate reports daily — we ingest, parse, attribute the sending IPs to known providers, and surface what you need to know in the dashboard. No mailbox to manage on your side.

Question 19

How does the Policy Wizard help me get to p=reject?

Accepted Answer

The wizard walks you from monitoring (p=none) through quarantine to full reject, gated on real signal from your aggregate reports. It won't advance you until your authorized-sender alignment is healthy, and it surfaces which senders are tripping you up. Most teams reach p=reject within a quarter if their sender footprint is workable.

Question 20

Do you host MTA-STS certs and policies for me?

Accepted Answer

Yes. For every managed zone with MTA-STS enabled, we issue a Let's Encrypt cert for mta-sts., host the policy file behind it at the standard /.well-known/mta-sts.txt path, publish the matching DNS records (A mta-sts. and TXT _mta-sts.), and handle automatic renewal. You configure the policy mode (testing or enforce) in the dashboard; we handle the rest of RFC 8461.

Question 21

What is the Report Card?

Accepted Answer

A single per-zone view of your entire email-auth posture: status icons across SPF, DKIM, DMARC, BIMI, MTA-STS, and TLS-RPT, the configured DMARC policy, your reporting addresses, plus a weighted compliance score (0-100) so you know what's missing at a glance. Zones are sorted lowest-compliance first so the most actionable rows surface up top.

Question 22

Do I need to import my zone into managed DNS to use Email Authentication?

Accepted Answer

Yes — email authentication features are managed-DNS-only by design. Each feature publishes DNS records on your behalf (SPF flattening republishes the TXT, MTA-STS publishes the A + TXT, DKIM publishes the selector TXT, etc.), which requires us to be authoritative for the zone. If you only need DDNS for a single hostname, no zone import is required.

Frequently Asked Questions

Dynamic DNS

Managed DNS

Email Authentication