Dynamic DNS

What the API updates

DuckDNS sets an address with an HTTP GET, so this is not a form against a call. What that call updates is a subdomain that already exists, claimed once in their web interface.

So there is nothing to ask for a name while a program is running, and nothing to hand one back when whatever needed it is gone. A minted hostname is created and released over the same API that reads it.

One token, and one TXT record per name

A name pointed at an address is not HTTPS. The certificate is still an ACME client somebody runs, and HTTP-01 needs the internet to reach the machine, which is not a given for a box whose address keeps changing behind a router.

DNS-01 is open, because DuckDNS writes a TXT record over that same endpoint. Two things come with it, both from their own specification. The token is the account's, so whatever renews one certificate can answer the challenge for every subdomain on the account. And one TXT value covers a subdomain and everything under it, so two validations beneath one name cannot be in flight together.

With DNSMint every hostname carries its own DNS-01 credential, scoped to that hostname. A fleet renews together rather than in turn, and the machine that renews one certificate cannot touch the rest.

What the Public Suffix List does and does not buy

duckdns.org is one registrable domain and everyone is on it. It is on the Public Suffix List, so cookies and certificate rate limits stay yours. Reputation does not: a blocklist applies to the registrable domain, so it lands on every label under it whoever earned it.

With DNSMint the domain is yours alone, and on a plan holding several you decide which names sit on which.