Dynamic DNS (DDNS): What It Is & How to Use It for a Self-Hosted VPN (2026)

If you host anything at home - a VPN, a NAS, a game server - you eventually hit the same wall: your public IP keeps changing, so you can never reliably reach your own network from outside. Dynamic DNS is the standard fix. It keeps a hostname permanently pointed at your current IP, so you connect to a name instead of a number that won't stay still. This guide explains what DDNS is, how it works, how to set it up for a self-hosted VPN, and when a VPS is the better base.

What dynamic DNS is

Most home internet connections come with a dynamic IP - an address your provider can change at any time, on a reboot or on their own schedule. That's fine for browsing, but it breaks anything that needs to be reached at a fixed location.

Dynamic DNS (DDNS) solves it with a small program - an updater - that watches your public IP and, whenever it changes, updates a DNS record to match. The result: a hostname like home.example.com that always resolves to your current address, no matter how often it changes.

Why a self-hosted VPN needs it

A WireGuard or OpenVPN client connects back to your server using an endpoint - an address and port. Host that VPN at home on a dynamic IP, and the endpoint moves every time your ISP rotates the address. Your phone, away from home, suddenly can't reconnect.

Point your clients at a DDNS hostname instead, and the endpoint becomes stable: the name follows the IP automatically, and your tunnels keep working through every address change. In a WireGuard config, you simply use the hostname in the peer's Endpoint = line.

How to set it up

Create a hostname. Use a DDNS provider (many routers include one) and register something like home.example.com.
Run the updater. Either enable your router's built-in DDNS with your account credentials, or run a client on the server - ddclient, or a small Docker-based updater that refreshes the record on a schedule.
Point your service at the hostname. Set your VPN endpoint (and anything else you expose) to the hostname rather than a raw IP.
Test. Confirm the hostname resolves to your real public IP, then verify a connection from an outside network (mobile data is a good test).

For the full server build, see setting up a self-hosted VPN on Contabo with WireGuard, the PiVPN one-line installer for a home Raspberry Pi, and reusable WireGuard config templates.

The catch: dynamic IP, CGNAT and uptime

DDNS only fixes the changing address problem. Two limits remain:

CGNAT. Many ISPs (especially mobile and some fibre) put you behind Carrier-Grade NAT, where you don't have a real public IP at all - inbound connections are blocked and DDNS can't help. Check whether your public IP matches what your router reports; if not, you're likely on CGNAT.
Home uptime and bandwidth. A home line goes down with power cuts and reboots, and upload speeds are often modest - fine for a personal tunnel, frustrating for anything you truly depend on.

When a VPS beats DDNS

If your VPN needs to be reliable - always reachable, good bandwidth, immune to CGNAT - a cheap VPS is the stronger base. It gives you a permanent public IP (no DDNS needed), better uptime than a home line, and full inbound access. A Contabo VPS at €5.50/month runs a personal WireGuard server with a fixed address out of the box. Compare hosts in our best self-hosted VPN guide.

DDNS is the right tool for a home server on a dynamic IP; a VPS is the right tool when you'd rather not depend on your home connection at all.

The bottom line

Dynamic DNS turns an unstable home IP into a stable hostname, which is exactly what a self-hosted VPN endpoint needs. Set up a free hostname and an updater on your router or server, point your WireGuard clients at the name, and your tunnels survive every IP change. Just watch for CGNAT - if your ISP blocks inbound connections, no DDNS will fix it, and a cheap VPS with a permanent public IP is the cleaner answer.

Editorial guide based on how dynamic DNS, dynamic ISP addressing and CGNAT work. Your results depend on your ISP and hardware. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.

★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed

Self-host your VPN on your own VPS → ContaboFull root access · public IPv4 · pick your region→

Frequently asked questions

What is dynamic DNS?

Dynamic DNS (DDNS) is a service that automatically keeps a hostname - like home.example.com - pointed at your current public IP address, even when that address changes. Most home internet connections get a dynamic IP that your provider can change at any time, which breaks anything you try to reach by IP. A small DDNS updater running on your router or server detects the new IP and updates the DNS record within seconds, so the hostname always resolves to your network.

Why do I need DDNS for a self-hosted VPN?

A WireGuard or OpenVPN client needs a stable address (endpoint) to connect back to your server. If you host the VPN at home on a dynamic IP, that endpoint changes whenever your ISP rotates the address, and your clients can no longer connect. DDNS solves this by giving you a fixed hostname that always tracks the current IP - you point your VPN clients at the hostname instead of a number, and connections keep working through IP changes.

How do I set up dynamic DNS?

Three steps. First, pick a DDNS provider (many routers have one built in, or use a standalone service) and create a hostname. Second, run the updater: either enable your router's DDNS feature with your account credentials, or run a small client like ddclient or a Docker-based updater on the server itself. Third, point whatever you're hosting - VPN endpoint, web service - at the hostname. Test by checking the record resolves to your real public IP, then from an outside network.

Is dynamic DNS free?

Often, yes. Several providers offer free hostnames on shared domains, and many routers include DDNS support for popular services at no cost. Paid tiers add custom domains, more hostnames, and reliability guarantees. For a single home VPN, a free hostname is usually enough. The trade-off with free tiers is occasional confirmation emails to keep the hostname active and fewer features - fine for personal use.

DDNS vs a static IP or VPS - which is better?

DDNS is the cheapest way to reach a home server on a dynamic IP, but it depends on your home connection's uptime and bandwidth, and some ISPs use CGNAT, which blocks inbound connections entirely. A static IP from your ISP removes the changing-address problem but costs extra and still relies on your home line. A cheap VPS gives you a permanent public IP, better uptime and bandwidth, and sidesteps CGNAT - the more reliable base for a VPN you depend on.