TLDR; I have a working DDNS at ddns.example.com, I want to make it capable of routing requests such host1.example.com to my locally hosted machines.

So, I have a public domain at let's say example.com at Google Domains. I have a DDNS capable router, which let's say has a dynamic IP address that is currently set to

I point my router to properly recognize my GD account, and at GD, I set ddns.example.com to match my router. Everything works at this point, and I can see that, for instance, host1 on my local network whose port 1234 is forwarded, can be seen at ddns.example.com:1234.

What I instead want to do, is to be able to write host1.example.com:1234/a/b?c and get to host1:1234/a/b?c on my local network.

My current thinking is that this should be possible by:

  1. I add a wildcard record from *.ddns to ddns.example.com in Google Domains.

  2. Add a CNAME from host1 to host1.ddns.example.com on Google Domains.

  3. Set up a dynamic DNS server+client on host2 on my local network with port 53 with port-forwarding through my router (I have a DNS server that is capable of including the current external IP address in authoritative answers which is installed on host2).

  4. Add the appropriate entries to my local DDNS client/server (host2):

    1. Add NS record ns.ddns.example.com to host2.

    2. Add dynamic A record ns.ddns.example.com to host2.

    3. Add dynamic A record services.ddns.example.com to host2.

  5. I port-forward 1234 from host1 on my router.

Here is what I think should happen:

I type in host1.example.com/a/b?c:

  1. NS request to com., example.com., and then A request for host1.

  2. host1.example.com gets redirected to host1.ddns.example.com

  3. Client asks for NS record from ddns.example.com. Answer is

  4. Client asks for the IP address of host1.ddns.example.com. Answer is

  5. Client connects to which is hosted by host1:1234/a/b/?c.

diging the host1.example.com domain does return the CNAME record host1.ddns.example.com. However, then diging host1.ddns.example.com returns the Google NS domains. It was my understanding that a CNAME record would basically mean that any request for that record would be forwarded. So I expected that doing a dig for the host1.ddns.example.com would match the wildcard, become a CNAME redirect to ddns.example.com, which in turn would be able to handle the rest of the recursion. What am I missing here?

  • Do you have enough public IP addresses for each host you want to give a public DNS to? DNS does not resolve to an IP:port, it only resolves to an IP.
    – LawrenceC
    Sep 26, 2018 at 19:23
  • I am aware of that, and I do. I fixed my problem. Sep 26, 2018 at 19:41
  • Do you have rights to example.com or ddns.example.com? It's a bit unclear at times in your question, and very important to having efficient and correct routing... Are the devices that should respond to ddns.example.com and hostN.ddns.example.com on the same network or do each have a different external IP address?... I ask because I think ya may be missing that names are resolved in reverse order, meaning that ya could just hint where to find *.ddns.example.com and let your server forward beyond that.
    – S0AndS0
    May 23, 2019 at 15:21

2 Answers 2


This might be a really old question but I was in a similar situation as I have a dynamic public IP. I just use multiple instances of duckdns which point to 10 different sub-domains for different services running on my server.

I use Lets-encrypt to handle reverse proxy and ssl certificates and am able to use different sub domains such as a.duckdns.org, b.duckdns.org point to the relevant IP:Port.

The only port forwarding done on the router is to point the ssl port to letsencrypt. I wouldnt advise opening up extra ports unnecessarily.

This is a sample letsencrypt .conf for a music server accessible at a.duckdns.org

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name abcsonic.*; #(Your subdomain/cname)
    include /config/nginx/ssl.conf;
    client_max_body_size 0;
    # enable for ldap auth, fill in ldap details in ldap.conf
    #include /config/nginx/ldap.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;
        # enable the next two lines for ldap auth
        #auth_request /auth;
        #error_page 401 =200 /login;
        include /config/nginx/proxy.conf;
        resolver valid=30s;
        set $upstream_airsonic airsonic;
        proxy_pass; #(Airsonic IP address)


  • 1
    Thanks for the answer. I actually have a solution for this now :) I have an nginx relay with automaitc letsencrypt in front of it. So, only ports 80 and 443 open, for that. Plus, I have a DDNS client/server pair running alongside, with port 53, to allow for sub-sub domains. Also, wildcard DNS for the main doamin, which means any dubdomain can be hosted with dynamic IP. May 23, 2019 at 22:37

I fixed my problem by examining each piece in isolation and determining that they were working correctly. The problem laid with the Google domains account. Apparently, due to a bug on their side, my account was blocked as not being activated. Once the customer service agent fixed that, everything worked smoothly. As such, I think this question's layout can be used to successfully set up a DDNS behind another DDNS and support dynamic domains/subdomains without owning a static IP.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .