GoogleDomainsDDNSUpdater: Troubleshooting Common IssuesGoogleDomainsDDNSUpdater is a small, commonly used tool for automatically updating Dynamic DNS records on Google Domains when your IP address changes. This article walks through the most frequent problems users encounter, how to diagnose them, and clear step‑by‑step fixes to get your DDNS working reliably.
Overview of how it works
Google Domains provides a built‑in Dynamic DNS feature that uses a username (the hostname) and a single generated password to accept IP update requests. GoogleDomainsDDNSUpdater sends HTTP(S) requests to Google’s DDNS endpoint with the current public IP; if authenticated and formatted correctly, Google updates the domain’s A (and optionally AAAA) records.
Common issue 1 — Authentication failures (401 / 403)
Symptoms:
- Updates fail with 401 Unauthorized or 403 Forbidden.
- Logs show “authentication failed” or “invalid credentials.”
Causes and fixes:
- Incorrect username or password: Confirm you are using the exact hostname as the username (e.g., myhost.example.com) and the single password generated on the Google Domains page (not your Google account password).
- Extra characters or whitespace: Copy/paste can add hidden characters. Re-enter manually.
- Using the wrong update URL: Ensure the updater targets the correct Google Domains endpoint: https://domains.google.com/nic/update
- Account/permissions: Ensure the DDNS entry was created for that subdomain in Google Domains and hasn’t been removed.
Step to reproduce/fix:
- Log into Google Domains → Select domain → DNS → Synthetic records → Dynamic DNS (or the relevant section) and regenerate the password.
- Update your tool configuration with the exact hostname and new password.
- Test with curl to confirm:
curl -u "myhost.example.com:generated-password" "https://domains.google.com/nic/update?hostname=myhost.example.com"A successful response like “good 1.2.3.4” confirms authentication and update.
Common issue 2 — IP not updating (response: “nochg” or no change)
Symptoms:
- Service returns “nochg
” or updates appear not to take effect. - DNS still resolves to old IP after a change.
Causes and fixes:
- No IP change detected: Google returns “nochg” when the IP sent matches the existing record — this is normal.
- IPv4 vs IPv6 confusion: Ensure you’re updating the correct record type. If your network prioritizes IPv6, you may need to pass &myip= for IPv4 or use the AAAA endpoint behavior appropriately.
- Local caching/TTL: DNS propagation and local cache (OS, browser, or ISP) can delay visible changes. Check with dig or nslookup bypassing local cache:
dig +short myhost.example.com @8.8.8.8 - Updater not detecting public IP change: If the updater determines the IP from local interfaces, it may report a private address. Configure it to query an external service (like ifconfig.me) or set myip explicitly.
Common issue 3 — Rate limiting / temporary blocks
Symptoms:
- Responses like “911” or repeated failures; temporary inability to update.
- Updates rejected after many rapid requests.
Causes and fixes:
- Google rate‑limits frequent updates. Rapid polling or loops can trigger temporary blocks.
- Fix by reducing update frequency: only update when IP actually changes or poll every 5–30 minutes at most.
- Implement exponential backoff on failures and respect HTTP response codes.
Common issue 4 — SSL/TLS or network connectivity errors
Symptoms:
- Errors indicating TLS handshake failure, certificate verification failed, or connection refused.
- The updater cannot reach domains.google.com.
Causes and fixes:
- Outdated CA certificates or system time skew can break TLS. Ensure system clock is correct and ca-certificates are up to date.
- Firewalls or outbound filtering may block HTTPS. Verify firewall rules and proxy settings.
- If using an HTTP proxy, configure the updater or system to use it; or bypass the proxy for domains.google.com.
Quick checks:
- Test TLS from the machine:
openssl s_client -connect domains.google.com:443 -servername domains.google.com - Check system time:
date --utc
Common issue 5 — DNS records overwritten by other services
Symptoms:
- Your DDNS updates apply, but another service or DNS provider immediately reverts the A/AAAA record.
- Multiple tools or orchestrations manage DNS for the same domain.
Causes and fixes:
- Confirm Google Domains is authoritative for the domain and the only service changing records.
- If using multiple DNS management tools (e.g., Cloudflare, registrar UI, automation scripts), consolidate updates or coordinate so only one system manages the DDNS hostname.
Common issue 6 — IPv6/IPv4 dual-stack mismatches
Symptoms:
- Device reachable over IPv6 but not IPv4 or vice versa; clients prefer one protocol and fail.
Causes and fixes:
- Ensure you update the correct record type for the address family you want. Google Domains handles A for IPv4 and AAAA for IPv6; confirm your updater supports and sends the right address.
- If your ISP provides CGNAT for IPv4, you may need IPv6 or a VPN with a public IPv4 address.
Debugging checklist
- Verify credentials by testing with curl.
- Confirm the endpoint URL is exactly https://domains.google.com/nic/update
- Ensure the updater queries an external service for public IP or accept manual myip parameter.
- Check system clock and CA certificates.
- Reduce update frequency to avoid rate limits.
- Use dig/nslookup against public resolvers to verify DNS propagation.
- Inspect firewall/proxy settings that might block HTTPS.
Example troubleshooting session (concise)
- Run:
curl -v -u "host.example.com:password" "https://domains.google.com/nic/update?hostname=host.example.com&myip=1.2.3.4" - If 401 → regenerate password, re-enter credentials.
- If 911 or timeout → wait 5–10 minutes, reduce update frequency.
- If TLS errors → update ca-certificates and check system time.
- If DNS still shows old IP → query public resolver with dig and check TTL.
Tips to avoid future problems
- Store the generated DDNS password securely and avoid rotating it unnecessarily.
- Implement IP change detection (query a trusted external IP service) instead of frequent polling.
- Log responses and HTTP status codes to catch recurring errors early.
- Run the updater as a low‑frequency cron job (every 5–30 minutes) or trigger on WAN events if your router supports scripting.
If you want, I can: show a tested updater script (shell/Python) tailored to your environment, or help debug specific log output — paste the relevant logs/responses and I’ll pinpoint the issue.
Leave a Reply