How to Configure Automated Dynamic DNS Updates on Ubuntu Server Using ddclient

Self-hosting home labs, VPN endpoints, web applications, or remote SSH tunnels on residential or small-business internet connections frequently presents an obstacle: dynamic public IP addresses. When Internet Service Providers (ISPs) cycle public IP leases, established DNS records point to obsolete addresses. The standard daemon for solving this in Linux environments is ddclient, a lightweight Perl background utility designed to detect public WAN address changes and automatically update DNS records across DNS providers including Cloudflare, DuckDNS, Namecheap, Google Domains, and DynDNS.

Installing ddclient on Ubuntu Server

The ddclient utility is maintained within Ubuntu universe repositories. Prior to installation, update the local package index:

sudo apt update
sudo apt install ddclient libio-socket-ssl-perl -y

The libio-socket-ssl-perl package ensures that ddclient can establish encrypted HTTPS/TLS handshakes when communicating with third-party DNS provider APIs.

During the APT installation, Ubuntu displays a series of interactive Debconf configuration prompts (asking for dynamic DNS provider, domain names, usernames, and passwords). You can press Tab and select Cancel or enter temporary dummy values, as we will configure the master configuration file manually with proper security permissions.

Configuring ddclient for Cloudflare or Standard DDNS

The primary configuration file resides at /etc/ddclient.conf. First, back up the default template:

sudo cp /etc/ddclient.conf /etc/ddclient.conf.bak

Open /etc/ddclient.conf in a text editor:

sudo nano /etc/ddclient.conf

For modern environments using Cloudflare with an API Token, populate the file with the following configuration:

# Global configuration
daemon=300
syslog=yes
pid=/run/ddclient/ddclient.pid
ssl=yes

# IP discovery mechanism using Web-based IP check
use=web, web=https://checkip.amazonaws.com/, web-skip='IP Address'

# Cloudflare API configuration
protocol=cloudflare
zone=example.com
ttl=1
login=token
password=your_cloudflare_api_token_here
home.example.com, vpn.example.com

For services using standard HTTP basic authentication (such as DuckDNS or Namecheap):

daemon=300
syslog=yes
ssl=yes
use=web, web=https://checkip.amazonaws.com/
protocol=namecheap
server=dynamicdns.park-your-domain.com
login=example.com
password=your_namecheap_dynamic_dns_password
subdomain

Securing Configuration File Permissions

Because /etc/ddclient.conf contains sensitive API tokens or passwords, restrict read and write permissions to the root user and the ddclient system user group:

sudo chown root:ddclient /etc/ddclient.conf
sudo chmod 600 /etc/ddclient.conf

Testing and Validating DNS Updates

Before launching ddclient as an unmonitored background service, execute a manual check in verbose and force mode to ensure your authentication credentials and IP discovery checks succeed:

sudo ddclient -daemon=0 -debug -verbose -noquiet -force

Review the command-line output. A successful run displays:

SUCCESS:  home.example.com: skipped: IP address was already set to 203.0.113.45.
# or
SUCCESS:  updating home.example.com: good: IP address set to 203.0.113.45

If the output returns an authentication error, verify that your Cloudflare API Token possesses Zone.DNS:Edit permissions for the target zone.

Enabling and Managing the Systemd Service

Once configuration is validated, enable and start the ddclient background systemd daemon:

sudo systemctl enable ddclient
sudo systemctl restart ddclient

Check the operational status of the service:

sudo systemctl status ddclient

To view real-time update logs generated by ddclient:

sudo journalctl -u ddclient -f

Configuring ddclient ensures your Ubuntu Server maintains continuous domain reachability without relying on external hardware routers or manual DNS updates when ISP addressing changes.