I don’t see much issues with privacy or security with a service like this.

They don’t get traffic going through them. They mainly exist to point to an IP. With enough data they have information on how an ISP rotates IP’s and who they’ve gone to.

In your case, with a WireGuard VPS, all traffic goes through the server. That’s a very different setup.

In their case, a request goes to them at a regular interval and they update the IP the dns record points to. That’s it.

When someone requests the domain, they simply respond with an IP. At most, if there’s little caching, they could get frequency of usage.

> They don’t get traffic going through them.

A rouge DNS can reply to select queries with an IP of a middleware that can TLS proxy and/or MitM that traffic.

We built such a thing mostly for anti-censorship purposes (bypass IP blocks): https://github.com/celzero/midway#demo

I use duckdns and the only service I'm accessing through that CNAME is ssh, which checks host keys, so it doesn't have to be a problem.

wouldn’t that invalidate the cerificate?

If they control the domain, they can get a new valid certificate

My biggest concern would be someone scanning CT logs to find hosts with hobbyist grade security. That’s not meant to insult hobbyists, but they might be a juicy target for immediately exploitation after a zero day hits. To be clear, it’s the same for any well known DynDNS domain.

Besides that, I looked at every DynDNS system I could find back in the summer. There were only 3 that I was happy with; Hurricane Electric, Google Domains, and a pair of self hosted Bind servers.

If you want the best, simple solution, and it doesn’t need to be completely free, register a domain with Google domains. If anyone knows of limitations, let me know.

Namecheap maxes out at 150 DynDNS hosts :-(

I prefer to use Cloudflare for my DNS including dynamic DNS. I happen to have my domains registered through them but it is not a requirement to use their free tier.

Best to pay the money for your own domain name, and find a free service to point it where you need to.

You can keep jumping to new gimmick first year deals on unusual TLDs but they are often considered spammy and always gouge on renewal pricing.

There's no routing of the actual traffic, only basic DNS forwarding. Of course it's not meant for business production services, but it's decent for homelab. Especially considering for how long has DuckDNS been operating.