Most home connections do not keep the same public IPv4 address forever. A router reboot, a lease renewal, or the ISP simply reshuffling its pool can hand out a new one at any time. Dynamic DNS is the standard answer: a small client on the router or the server notices the change and updates a DNS record so a hostname keeps resolving to the right place.
That fixes exactly one problem: name resolution. It does not fix everything else that quietly depends on the address staying the same. Knowing where that line sits decides whether Dynamic DNS is enough for a homelab, or whether a routed IPv4 needs to replace it for a specific service.
What Dynamic DNS actually does
A DDNS client, whether it runs on the router's firmware or as a small background process on the server, periodically checks the connection's current public IPv4 address. When that address changes, the client calls the DDNS provider's API and the hostname's DNS record is updated to match. Anyone who looks up that hostname from that point on gets the new address.
That is the entire mechanism. It is enough for a simple self-hosted website, a personal media server reached only by its owner, or anything else where the sole requirement is that a URL keeps working. It does not touch anything that identifies the service by its raw IP address instead of its hostname.
Where Dynamic DNS stops helping
The update is not instant. Between the moment the IP actually changes and the moment every resolver on the internet has picked up the new DNS answer, there is a window, often minutes long, where some visitors are still trying to reach an address that no longer belongs to the server. For an occasional personal project that gap barely matters. For anything a homelab depends on being reachable right away, it is friction that a stable address does not have.
GRE and IPsec tunnels are a harder case. Taipan's own documentation is direct about it: these protocols "require a stable public IPv4 address for your tunnel endpoint," and if the provider changes that address, "Taipan can no longer send tunnel traffic to the correct location and the tunnel stops working." Taipan Reference: Dynamic IP Dynamic DNS cannot patch this, because the tunnel endpoint is configured as a fixed IP on both sides, not as a hostname that gets re-resolved on every reconnect.
Third-party IP allowlists behave the same way. A monitoring tool, a partner's firewall rule, or a game server's admin allowlist that only accepts a specific IP address does not re-check a hostname before deciding whether to trust the connection. If the allowlisted address changes, access breaks until someone manually updates it, regardless of how quickly Dynamic DNS reacted.
Mail is a related case worth naming honestly. Reputation is tracked against the sending IP address itself, not the hostname in the "From" header, and a residential dynamic IP is drawn from a pool that most receiving mail servers already treat cautiously. Taipan's mail policy exists because reputation is address-based in exactly this way. Taipan Reference: Taipan and mailing A dedicated, non-shared address changes what that reputation history looks like; Dynamic DNS changes nothing about it.
| What needs to stay reachable | Dynamic DNS | Routed IPv4 |
|---|---|---|
| A website or app reached by its hostname | Works, after the update propagates | Works, with no propagation delay |
| A GRE or IPsec tunnel to Taipan | Breaks; endpoint is a fixed IP | Not affected; the address does not change |
| A third-party IP allowlist | Breaks until updated by hand | Never needs updating |
| Mail sending reputation | Still a shared, residential address | A dedicated address of your own |
How a routed IPv4 removes the problem
A Taipan routed IPv4 does not depend on the home connection's address staying fixed either, but it solves the mismatch from the other direction. Ordering the tunnel with WireGuard's Dynamic IP mode means the home gateway authenticates with its WireGuard key rather than a fixed source address. When the ISP hands out a new IP, "Taipan learns the new endpoint from its authenticated WireGuard traffic," with "no dynamic DNS configuration required on your side." Taipan Reference: Dynamic IP
The routed IPv4 address itself, the one visitors, tunnels, and allowlists actually see, lives on Taipan's network and never moves. The home connection's own address becomes an implementation detail underneath the tunnel, invisible to anything downstream. That is what a hostname-based fix cannot do: it can only chase a moving address after the fact, while a routed IPv4 removes the need to chase anything.
Taipan Transit routes a dedicated public IPv4 through a WireGuard tunnel that stays up through a changing home address, starting at €2 per month for the tunnel and €0.70 per month per address, on its pricing page. Select WireGuard with Dynamic IP when ordering; no client-side Dynamic DNS setup is needed.
When Dynamic DNS is still the right call
None of this means Dynamic DNS should be abandoned everywhere. A hobby project reached only by its own owner, a small web app with no external allowlist and no GRE or IPsec tunnel behind it, has no real exposure to any of the failure modes above. Keeping it on Dynamic DNS costs nothing and adds nothing to fix. The upgrade is worth making for the specific service that actually depends on a stable address: a tunnel endpoint, an allowlisted integration, or a mail server that needs its own sending reputation.
Frequently asked questions
Does Dynamic DNS work behind CGNAT?
No. Dynamic DNS only updates a hostname to point at whatever public IPv4 address the router currently has. Behind CGNAT the router never holds a public address at all, so there is nothing valid for the DDNS client to publish.
Does a Taipan WireGuard tunnel drop every time the home IP changes?
No. With WireGuard in Dynamic IP mode, Taipan re-learns the new endpoint from the gateway's authenticated WireGuard traffic, so the tunnel recovers automatically without any Dynamic DNS configuration on the customer side.
Do I still need Dynamic DNS once I have a Taipan routed IPv4?
Not for that service. The routed IPv4 stays the same address regardless of what the home connection is assigned, so a normal, unchanging DNS record replaces the one a DDNS client used to keep updating.
Why does a mail server care about a dedicated address instead of Dynamic DNS?
Mail reputation is tracked per IP address, not per hostname. A residential dynamic IP is drawn from a shared pool the mailbox provider already treats with suspicion, and Dynamic DNS does not change which address the mail actually leaves from.