dns.he.net

What is Hurricane Electric Hosted DNS?

Hurricane Electric Hosted DNS is a free DNS hosting service run by Hurricane Electric, a network and colocation provider. It lets you manage forward DNS (your domain's records) and reverse DNS (PTR records for IP addresses) through a web portal, without paying for a separate managed-DNS plan. It is aimed at people who are comfortable editing DNS records themselves — system administrators, developers, and smaller operators — rather than at users who want a hands-off, phone-support product.

What it does

• Serves queries over both IPv4 and native IPv6, so IPv6-only clients can resolve your records directly.
• Supports a broad record set: A, AAAA, ALIAS, CNAME, CAA, MX, NS, TXT, SRV, SSHFP, SPF, RP, NAPTR, HINFO, LOC and PTR.
• Simplifies reverse DNS with "smart mode" IPv4 and IPv6 reverse zones, and accepts multiple reverse-zone formats (Standard, RFC 4183, RFC 2317, DeGroot).
• Allows multiple domains per account and slave (secondary) support.
• Runs on geographically diverse servers and applies sanity checking for delegation plus basic field syntax checking.
• Includes dynamic DNS, and dynamic TXT records intended for automated certificate validation workflows such as Let's Encrypt DNS-01 challenges.

Who it fits

A concrete scenario: you run a small site plus mail on a VPS, you want IPv6 answers and correct reverse records for your own address block, and you are willing to log in and edit records yourself. That is squarely the intended use. If you instead want a vendor to handle migration, monitoring and support tickets, a commercial managed-DNS provider will suit you better.

Trade-offs to weigh

The portal is an "open beta" that has been expanded to include IPv6 certification or tunnelbroker account holders, colocation customers, and customers with transit services from Hurricane Electric. In practice, that means access is tied to having (or creating) an account, and some users will need to contact support to get a password for an existing admin.he.net account. The interface is functional rather than polished, and there is no indication of a paid support tier — appropriate for self-directed users, less so for organisations that need contractual service levels.

Dynamic TXT records come with two practical constraints worth planning around: you must create the record in the dns.he.net interface before updates will work, and you cannot create or delete those records dynamically because doing so would remove the associated DDNS key. A propagation delay of up to five minutes is also possible while the record's TTL expires, so you should wait before triggering DNS-01 validation.

Next step

Decide based on your record needs and your tolerance for self-service. If you need ALIAS or CAA records, dual-stack resolution, and reverse zones for your own addresses, create a free account and add one low-risk domain first to test the workflow. If you need a formal support contract or a fully managed migration, compare a commercial provider instead.

How do I set up dynamic DNS updates for my home network?

Use Hurricane Electric's Free DNS portal at Hurricane Electric Hosted DNS if you want authoritative DNS hosting with dynamic updates, including dynamic TXT records for ACME DNS-01 challenges. The practical setup is: create an account, add your domain as a zone, create the specific record you want to update, then have your router or a small script call HE's dynamic update endpoint with your record's key.

The basic workflow

1. Sign up for a free account and add your domain. HE's portal manages both forward and reverse DNS, and supports multiple domains per account.
2. Create the record you intend to update — typically an A or AAAA record for your home hostname, or a TXT record if you are automating certificate validation.
3. Generate or note the DDNS key associated with that record. HE's dynamic updates use a per-record key, so treat it like a password.
4. Configure your router's built-in DDNS client, or a cron job on a always-on device, to send updates when your address changes.

What HE's page actually supports

• Dual-stack queries over IPv4 and native IPv6.
• Record types including A, AAAA, ALIAS, CNAME, CAA, MX, NS, TXT, SRV, SSHFP, SPF, RP, NAPTR, HINFO, LOC and PTR.
• "Smart mode" for IPv4 and IPv6 reverse zones, plus slave support and several reverse-zone formats.
• Dynamic TXT records using the same DDNS syntax, with txt= in place of myip=. HE notes a propagation delay of up to five minutes, so wait before requesting DNS-01 validation.
• Important limitation from the page: you must create the dynamic TXT record inside the dns.he.net interface first. You cannot dynamically create and delete these TXT records, because that would remove the DDNS key tied to the record.

Choosing between a router client and a script

A concrete next step

If your router lists Hurricane Electric as a DDNS provider, enter your hostname and the record's DDNS key there and trigger a test update. If it does not, run a small scheduled script that fetches your current public address and posts it to HE's update endpoint with the same credentials. Verify by querying the hostname from outside your network — for example, from a phone on cellular data — rather than from a machine behind the same NAT.

One caution: dynamic DNS keeps a name pointed at a changing address, but it does not open ports or provide security. Pair it with your router's firewall rules and, for remote access, a VPN rather than exposing services directly.

What record types does Hurricane Electric Hosted DNS support?

Hurricane Electric Hosted DNS supports a broad set of forward and reverse record types through its free management portal.

Supported record types: A, AAAA, ALIAS, CNAME, CAA, MX, NS, TXT, SRV, SSHFP, SPF, RP, NAPTR, HINFO, LOC, and PTR.

What that covers in practice

• Address records: A and AAAA handle IPv4 and IPv6 hosts; the service also supports dual-stack queries over both IPv4 and native IPv6.
• Aliases and mail: CNAME and ALIAS cover name redirection, while MX and SPF/TXT handle mail routing and sender policy.
• Security and service records: CAA restricts which certificate authorities may issue for a domain, and SRV, SSHFP, NAPTR, and HINFO cover service discovery and host metadata.
• Reverse DNS: PTR records are supported, with smart mode for IPv4 and IPv6 reverse zones and multiple reverse zone formats (Standard, RFC 4183, RFC 2317, DeGroot).

A useful detail for automation

Dynamic TXT records are supported for DNS-01 challenges, using the same dynamic DNS syntax with txt= in place of myip=. The record must be created in the interface first, and updates can take up to five minutes to propagate, so wait before requesting validation.

Next step

If you manage a domain here, check your zone against the list above before migrating: ALIAS and CAA are the types most often missing elsewhere, and both are available here. For comparison, Cloudflare's DNS documentation also lists its supported types at Cloudflare.

How can I use dynamic TXT records for Let's Encrypt DNS-01 validation?

Use dynamic TXT records to automate the DNS-01 challenge: your ACME client writes a temporary _acme-challenge TXT value into your zone, the CA reads it, and validation succeeds without any inbound HTTP access to your server. Hurricane Electric's free DNS portal supports this via its DDNS update syntax, using txt= in place of the usual myip= parameter.

Setup steps

1. In the dns.he.net interface, create the _acme-challenge TXT record manually first. The page notes you cannot dynamically create and delete these records, because doing so would remove the DDNS key tied to the record.
2. Copy the DDNS key shown for that record.
3. Configure your ACME client to push the challenge value with the txt= form of the update URL, then wait before triggering validation.
4. Allow for propagation: HE states a delay of up to 5 minutes while the record's TTL expires and refreshes, so pause before requesting DNS-01 validation.

Practical notes

• This is the right fit if you run a home lab, a server behind CGNAT, or a host with no public port 80/443 — the certificate authority only needs DNS, not a reachable web server.
• Wildcard certificates require DNS-01, so this is often the only route for *.example.com.
• Because the record is pre-created and persistent, treat the DDNS key as a credential: anyone with it can rewrite that TXT value. Rotate it if it leaks.
• If your client supports it, set a short TTL on the challenge record to reduce the wait, but still respect HE's stated propagation window.

Decision criterion

Choose this method when your ACME client can issue authenticated HTTP updates and your account already hosts the zone here. If you need records created and deleted automatically per issuance, or you want a provider-agnostic API with broad client support, a dedicated DNS API provider may be less manual — Let's Encrypt documents the challenge types, and EFF's Certbot documentation covers client-side DNS plugins.

What are the requirements to sign up for a free DNS account?

You can sign up for a free account directly through the Free DNS Hosting portal; no paid plan or existing customer relationship is required. The page describes the service as an Open Beta that has been expanded to include IPv6 certification or tunnelbroker account holders, Colocation customers, and Transit customers. If you already have an admin.he.net account, the page says to contact Support to request a password rather than creating a new one.

What you need

• An account sign-up: The portal states you can sign up for a free one if you do not have an account.
• A supported record set: The service supports A, AAAA, ALIAS, CNAME, CAA, MX, NS, TXT, SRV, SSHFP, SPF, RP, NAPTR, HINFO, LOC and PTR records.
• Dual-stack access: Queries are supported over both IPv4 and native IPv6.
• A reason to manage forward or reverse DNS: The tool is built for maintaining forward and reverse zones, including multiple domains per account.

Practical next step

If you are signing up to host a domain, decide first whether you need forward DNS only or also reverse zones. Reverse zones are handled through Smart mode for IPv4 and IPv6, with multiple reverse zone formats available. If you plan to use dynamic DNS for a certificate challenge, note that dynamic TXT records must be created inside the dns.he.net interface first, and a propagation delay of up to five minutes may occur before DNS01 validation should be requested.

For a concrete scenario: a small self-hoster with a home server and a domain registrar that lacks IPv6 glue can use this portal to manage A, AAAA and TXT records, then point the registrar's NS records at the hosted DNS. If they also need reverse DNS for a delegated IPv4 or IPv6 block, the reverse-zone tools avoid manual zone-file work. The main trade-off is that this is a free hosted service tied to Hurricane Electric's infrastructure, so you are relying on their portal and support channels rather than running your own nameservers.

How does the smart mode for IPv4 and IPv6 reverse zones work?

Smart mode in Hurricane Electric's free DNS portal is a convenience layer for reverse zones (PTR records): instead of making you hand-build the long reverse naming structure, it derives it from the IP range you enter and keeps the resulting zone consistent.

What it does in practice

• You supply an IPv4 or IPv6 network, and the tool generates the matching reverse zone name — for IPv4 a form like x.y.z.in-addr.arpa, for IPv6 the nibble-reversed ip6.arpa form.
• PTR entries are then managed as ordinary records inside that zone, rather than by editing raw zone files.
• It works alongside the portal's other reverse-zone handling, which also accepts several non-standard delegation formats (Standard, RFC 4183, RFC 2317, DeGroot) for cases where the address space is delegated in smaller blocks.

Why it matters

Reverse DNS is where most self-managed setups break: the zone name is easy to get wrong, especially for IPv6 where a single /64 becomes a long chain of hex nibbles. Smart mode removes that arithmetic and the syntax errors that follow from it. It also fits the rest of the service — dual-stack queries over IPv4 and native IPv6, support for the usual record types (A, AAAA, CNAME, MX, NS, TXT, SRV, PTR and others), multiple domains per account, and sanity checking on delegation for forward and reverse zones.

Trade-offs to expect

• It is a hosting-portal feature, not a protocol change: the resulting zones are still normal reverse zones visible to the rest of the DNS.
• Access is tied to having an account — the page notes the beta covers IPv6 certification and tunnelbroker account holders, colocation customers, and transit customers, with free signup for others.
• If your provider delegates reverse DNS to you in an unusual block size, you may still need the non-standard zone formats rather than plain smart mode.

A concrete scenario

Suppose you run a small mail server on a static IPv4 address and want matching forward and reverse names so receivers don't penalise you. You add the address range, let smart mode build the reverse zone, add the PTR, and confirm forward and reverse agree. If you also have an IPv6 block, you repeat it there — the part that would otherwise be most error-prone.

Next step

Before creating anything, write down the exact network and prefix length your provider assigned. Then check whether the portal's generated zone name matches what a lookup of your IP returns; if it doesn't, the delegation format is the likely culprit rather than the records themselves.