A high-performance, ultra-lightweight, and full-featured Dynamic DNS (DDNS) and notification service written in pure Rust
简体中文 | English
rddns draws deep architectural and user experience inspiration from the outstanding open-source project ddns-go.
Building upon its battle-tested workflow, rddns is rewritten entirely in pure Rust (2024 Edition + Tokio async runtime + Axum web framework) with zero GC overhead, offering ultra-low memory footprint, high-throughput concurrency, and single self-contained binary distribution.
- Ultra-lightweight & High Performance:
- Private memory usage is only ~2.9 MB (Physical working set ~10.5 MB);
- Zero-cost abstractions and RAII memory management in pure Rust, eliminating garbage collection pauses and memory bloat;
- Millisecond-level startup response, running comfortably on 64MB / 128MB low-end embedded routers (e.g. OpenWrt), lightweight VPSs, or NAS devices.
- Single Self-Contained Binary:
- Web dashboard frontend assets and trusted CA root certificates are fully embedded inside the executable. No external runtimes or dependencies needed.
- Multi-Task Master-Detail Management:
- Modern responsive dual-pane dashboard with independent configurations for multiple DDNS synchronization tasks;
- Each task can independently specify DNS provider, outbound network interface, domain list, TTL, and dual-stack strategies.
- Comprehensive Dual-Stack IP Detection:
- URL Endpoints: Built-in high-availability public IP query endpoints, supporting custom URL lists and regular expression matching;
- Network Interface Direct Reading: Automatic enumeration of system physical and virtual interfaces, with
@1,@2indexing syntax to select specific IPv6 addresses; - System Script / Command: Execute custom Shell / PowerShell commands or external scripts to retrieve IPs.
- Multi-WAN Router Interface Binding (
HttpInterface):- Bind individual tasks to specific outbound physical interfaces (such as
eth0,pppoe-wan), essential for multi-WAN load balancing and policy routing.
- Bind individual tasks to specific outbound physical interfaces (such as
- Anti-Pollution & Custom DNS Resolution:
- Built-in pure Rust async DNS resolver, supporting
--dnsCLI parameter and Web UI configuration for custom upstream DNS servers (e.g.223.5.5.5,1.1.1.1), directly querying authoritative servers to bypass local ISP DNS hijacking and cache poisoning.
- Built-in pure Rust async DNS resolver, supporting
- Supports 27 Mainstream DNS Providers (Pure Rust drivers & signatures):
- Global Cloud Providers: Cloudflare, Alibaba Cloud (AliDNS), Tencent Cloud (DNSPod), Huawei Cloud, Baidu Cloud, Volcano Engine (TrafficRoute);
- Domain Registrars: Porkbun, GoDaddy, Namecheap, NameSilo, Spaceship, Dynadot, Name.com, Gcore, Dynv6, ClouDNS, NS1 Connect (IBM NS1);
- Edge & Cloud Hosting: Alibaba Cloud ESA, Tencent Cloud EdgeOne (supports dynamic OriginGroup syncing), Vercel (with teamId support), RainYun, DNS.LA;
- Dedicated & Self-Hosted: Now.cn / Eranet / TNetHK, HiPM DNSMgr, and Generic Custom Webhook Callbacks.
- 8 Major Notification Channels:
- WeCom (Enterprise WeChat): Group bot Webhooks & Corporate App API messaging;
- Feishu / Lark: Group bot Webhooks with secret signatures and interactive card messages;
- DingTalk: Group bot Webhooks with secret signing;
- WeChat Official Account: Native template messages directly delivered to personal WeChat;
- Telegram: Real-time push notifications via Telegram Bot;
- Bark: iOS instant push notification (supports grouping, custom icons, and ringtones);
- SMTP Email: Pure Rust async TLS mail delivery (supports STARTTLS and HTML templates);
- Custom Webhook: Customizable HTTP headers, request body templates, and dynamic placeholder substitutions.
- Security Hardening & Operations:
- Access Control: Web admin credentials hashed using BCrypt;
- WAN Access Isolation: One-click toggle to disable WAN access to the Web console (LAN-only management);
- Startup Network Probing: Concurrent network connectivity probing before running DDNS sync loops;
- Operational Utilities: Password reset (
--resetPassword), skip TLS certificate verification (--skipVerify), and online auto-upgrade (--upgrade).
Tested on a 64-bit operating system with Release optimization profile:
| Running Mode | Binary Size | Private Committed Bytes | Working Set | Runtime Dependencies |
|---|---|---|---|---|
| Full Web Management Mode | ~5.6 MB | ~2.93 MB | ~10.53 MB | None (Single Static Binary) |
Silent Background Sync (--noweb) |
~5.6 MB | ~2.88 MB | ~10.35 MB | None (Single Static Binary) |
Note: Working Set includes OS shared dynamic libraries and system API mappings. The actual private heap and stack committed by the application is only ~2.9 MB.
Download the pre-compiled binary for your architecture from GitHub Releases:
| 平台 / 架构 (Platform) | 适用设备与场景 (Recommended Devices) | 二进制特性 (Characteristics) |
|---|---|---|
Linux x86_64 (x86_64-unknown-linux-musl) |
64-bit PC, Cloud VPS, x86 Soft Router, NAS | Statically linked with musl, compatible with all distros, Alpine & OpenWrt |
Linux ARM64 (aarch64-unknown-linux-musl) |
Raspberry Pi 4/5, ARM Routers, ARM64 Servers | Statically linked with musl, zero shared library dependencies |
Linux ARMv7 (armv7-unknown-linux-musleabihf) |
Raspberry Pi 2/3, 32-bit ARM Routers | Statically linked with musl |
Linux ARMv6 (arm-unknown-linux-musleabihf) |
Raspberry Pi 1/1B+, Raspberry Pi Zero | Statically linked with musl |
Linux ARMv5TE (armv5te-unknown-linux-musleabi) |
Legacy Marvell NAS (e.g. Synology DS211j), Gateways | Statically linked with musl |
Linux 32-bit (x86) (i686-unknown-linux-musl) |
Legacy 32-bit Linux & 32-bit Alpine Containers | Statically linked with musl |
Linux RISC-V 64 (riscv64gc-unknown-linux-gnu) |
Allwinner D1, Milk-V RISC-V boards | Native 64-bit RISC-V binary |
Linux LoongArch 64 (loongarch64-unknown-linux-gnu) |
Loongson 3A5000/3C5000 servers & desktops | Native LoongArch binary |
FreeBSD x86_64 (x86_64-unknown-freebsd) |
64-bit pfSense, OPNsense firewalls & FreeBSD | Native FreeBSD 64-bit binary |
FreeBSD ARM64 (aarch64-unknown-freebsd) |
Raspberry Pi 4/5 / ARM64 Cloud FreeBSD/OPNsense | Native FreeBSD ARM64 binary |
FreeBSD 32-bit (i686-unknown-freebsd) |
Legacy 32-bit FreeBSD industrial firewalls | Native FreeBSD 32-bit binary |
Windows 64-bit (x86_64) (x86_64-pc-windows-msvc) |
Windows 10 / 11 / Server (Intel / AMD) | Native standalone executable |
Windows 64-bit (ARM64) (aarch64-pc-windows-msvc) |
Snapdragon X Elite / Copilot+ PCs, Surface ARM | Native ARM64 standalone executable |
Windows 32-bit (i686-pc-windows-msvc) |
Legacy 32-bit Windows & industrial PCs | Native standalone executable |
macOS Apple Silicon (aarch64-apple-darwin) |
Apple Silicon Mac (M1/M2/M3/M4) | Native ARM64 binary |
macOS Intel (x86_64-apple-darwin) |
Intel-based Mac | Native x86_64 binary |
Extract the archive and run:
chmod +x rddns
./rddnsrddns includes a cross-platform service manager to register and run as a system daemon:
# 1. Install and register as a system service
./rddns -s install
# 2. Start service
./rddns -s start
# 3. Check service status
./rddns -s status
# 4. Restart service
./rddns -s restart
# 5. Stop service
./rddns -s stop
# 6. Uninstall service
./rddns -s uninstall- Linux: Automatically creates and manages
/etc/systemd/system/rddns.serviceviasystemd; - Windows: Automatically registers a native Windows NT Service (SCM) running on boot without login, featuring 3-second automatic recovery on crash or taskkill;
- macOS: Generates
/Library/LaunchDaemons/com.mangerle.rddns.plistmanaged bylaunchd.
Run in background daemon mode without installing a system service:
./rddns -drddns can automatically detect the latest release from GitHub and replace its binary in-place:
./rddns -u
# or
./rddns --upgradeEnsure you have the Rust toolchain installed (Rust 1.85+ recommended):
# Clone the repository
git clone https://github.com/mangerle/rddns.git
cd rddns
# Build with maximum release optimizations
cargo build --releaseThe compiled binary will be located at target/release/rddns (rddns.exe on Windows).
# 1. Default foreground start (listens on http://0.0.0.0:9876)
./rddns
# 2. Custom listening port
./rddns -p 8888
# 3. Silent background mode (disable Web UI to minimize memory usage)
./rddns --noweb
# 4. Use custom upstream anti-pollution DNS resolver
./rddns --dns 223.5.5.5
# 5. Set check interval to 120 seconds
./rddns -f 120
# 6. Reset Web console admin password
./rddns --resetPassword MyNewPassword123Open http://localhost:9876 in your browser to access the Web Management Console.
| Parameter | Short | Alias | Default | Description |
|---|---|---|---|---|
--config <PATH> |
-c |
- | .rddns.toml |
Path to configuration file |
--listen <ADDR> |
-l |
-p, --port |
9876 |
Web console listening address or port (e.g. 8888 or 127.0.0.1:8888) |
--frequency <SECS> |
-f |
- | 300 |
Sync check interval in seconds (runtime override) |
--noweb |
- | - | false |
Silent background mode (disable Web UI) |
--dns <SERVER> |
- | - | - | Custom upstream DNS server (e.g. 223.5.5.5 or 1.1.1.1:53) |
--skip-verify |
- | --skipVerify |
false |
Skip HTTPS/TLS certificate verification |
--reset-password <PASS> |
- | --resetPassword |
- | Reset Web admin password and exit immediately |
--daemon |
-d |
- | false |
Run as detached background daemon and exit terminal |
--upgrade |
-u |
- | false |
Check for updates and upgrade to the latest GitHub release |
--service <ACTION> |
-s |
- | - | Manage system service (install, uninstall, start, stop, restart, status) |
--help |
-h |
- | - | Print help information |
--version |
-V |
- | - | Print version information |
# Web console listen port
listen_port = 9876
# Global synchronization interval (seconds)
interval_secs = 300
# Periodic verification interval against remote records
cache_times = 10
# Disable WAN access to Web management console
not_allow_wan_access = true
# Custom upstream anti-pollution DNS resolver
dns_server = "223.5.5.5"
# Web console admin credentials
[auth]
username = "admin"
password_hash = "$2b$12$..." # BCrypt hash
# DNS task definitions
[[dns_tasks]]
name = "Primary WAN - Cloudflare"
enabled = true
ttl = 600
http_interface = "eth0" # Outbound interface binding
[dns_tasks.provider]
type = "cloudflare"
api_token = "your-cloudflare-token"
[dns_tasks.ipv4]
enabled = true
source_type = "url"
url_endpoints = ["https://api.ipify.org"]
domains = ["nas.example.com"]
[dns_tasks.ipv6]
enabled = true
source_type = "net_interface"
net_interface = "eth0"
regex = "@1"
domains = ["nas-v6.example.com"]
[[dns_tasks]]
name = "Secondary WAN - AliDNS"
enabled = true
ttl = 600
http_interface = "pppoe-wan2"
[dns_tasks.provider]
type = "alidns"
access_key_id = "your-aliyun-ak"
access_key_secret = "your-aliyun-sk"
[dns_tasks.ipv4]
enabled = true
source_type = "url"
url_endpoints = ["https://myip4.ipip.net"]
domains = ["backup.example.com"]
# Notification channels
[notifications.feishu]
enabled = true
webhook_url = "https://open.feishu.cn/open-apis/bot/v2/hook/..."
secret = "your-feishu-secret"
[notifications.dingtalk]
enabled = true
access_token = "your-dingtalk-access-token"
secret = "SEC..."
[notifications.wecom]
enabled = false
webhook_url = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=..."
[notifications.bark]
enabled = false
server_url = "https://api.day.app"
device_key = "your-bark-device-key"
[notifications.email]
enabled = false
smtp_server = "smtp.example.com"
smtp_port = 465
use_ssl = true
username = "notify@example.com"
password = "your-smtp-password"
from_address = "notify@example.com"
to_addresses = ["admin@example.com"]- Access Isolation: By default,
not_allow_wan_access = trueis enabled, binding exclusively to127.0.0.1. If exposing the dashboard to the WAN, reverse proxy via Nginx/Caddy with HTTPS/TLS is strongly recommended. - Credential Storage: Credentials in
.rddns.tomlare stored locally. On Unix/Linux systems, permissions are restricted to0600automatically. Do not commit.rddns.tomlto public repositories. - TLS Verification:
--skip-verifycompletely disables TLS validation. Use this only for local/intranet environments with self-signed certificates.
- ddns-go: Exceptional DDNS design and functional benchmark.
- Tokio & Axum: Foundation for lightning-fast asynchronous concurrency and modern web services.
- reqwest: Elegant and robust HTTP client for Rust.
This project is licensed under the MIT License.