In standards-based DNS, the DNS UPDATE operation lets an authorized client change zone records without manual zone-file edits. Automation can keep names aligned with changing addresses, hosts, and services.
The term also describes services that maintain a stable public hostname for a connection whose public IP address changes. Such a service may use DNS UPDATE or a provider-specific API. An updater detects the address, authenticates to the service, and changes the relevant record; resolvers see the change as caches expire or refresh.
Key points
Controlled scopeUpdate credentials should be authorized only for the zones, names, and record types that the updater genuinely needs to change.
Transaction protectionTransaction Signature (TSIG) can authenticate a DNS transaction and protect its integrity between configured parties.
Operational reliabilityMonitor update failures, unexpected record changes, credential use, stale records, and the effect of caching when addresses change rapidly.
Important limitationDDNS is not inherently unsafe, but a compromised updater, provider account, credential, or overbroad update policy can redirect every user of the affected name. TSIG protects a transaction between its parties; it does not provide DNSSEC validation for later resolver responses.