# Review OPNsense IPv4 and IPv6 DDNS updates separately > Use separate address-family accounts and verify both published records rather than treating one successful dynamic DNS update as a dual-stack result. - Canonical URL: https://update.dsesecurity.com/updates/review-opnsense-ipv4-and-ipv6-ddns-updates-separately/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-29T20:33:11+00:00 - Modified: 2026-10-29T20:33:35+00:00 - Last reviewed by DSE: 2026-10-29 - Resource type: Guide - DSE priority: Advisory - Topics: Networks & Infrastructure - Reading time: 3 minutes ## What you need to know Use separate address-family accounts and verify both published records rather than treating one successful dynamic DNS update as a dual-stack result. ## Potentially affected OPNsense Dynamic DNS configurations publishing A and AAAA records. ## DSE recommendation Map each address-family update account to its checking method, interface and intended DNS record. ## Article Bottom line: Review the IPv4 and IPv6 update paths as two explicit jobs. Record the expected A and AAAA values and verify each against its own checking method and interface. ## Source fact: what the authority says The [OPNsense Dynamic DNS reference](https://docs.opnsense.org/manual/dynamic_dns.html) requires one account using an IPv4 checking service and another using an IPv6 checking service to update both an A and an AAAA record. The same note requires Allow IPv6 on the General Settings tab. Check ip method selects the service used to obtain the appliance address. Interface to monitor selects the interface used to connect to that checking service, or the interface from which to collect an address when the method is Interface. ## What the source does not establish This article addresses the documented dual-record update configuration, not a guarantee of global DNS propagation or application reachability. It does not choose a provider credential scope or qualify every Dynamic DNS backend. ## Applicability questions - Which fully qualified name and address-family records are intended? - What address should each checking method observe on the selected connection? - Is an interface address or an external checking service the approved source of truth? - Who can compare the published A and AAAA values with the network inventory? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends a two-row update worksheet, one row for IPv4 and one for IPv6. Put the account, hostname, checking method, monitored interface and intended record value in each row. Keep a provider credential reference without copying the secret into the worksheet. Review what the interface field means for the selected checking method. For an external checking service, name the connection the request should use. For the Interface method, identify the exact local interface whose address is intended. Do not approve the entry from a familiar interface label without comparing its active address and purpose. Use an approved test hostname for the first dual-stack trial. Ask the DNS owner to confirm that both record types belong in the intended zone and that the expected values are suitable for the service. Treat an existing stale record as a separate observation rather than silently deleting it during account setup. Plan a controlled address-change rehearsal only where the network owner permits it. Keep the original account definitions and DNS values available for restoration. Agree how to handle a missing IPv6 path without publishing a guessed address or weakening a separate application access rule. ## Verification and evidence Proposed verification: inspect both accounts and the global IPv6 option against the worksheet. Observe the actual address obtained by each configured method, then query the intended DNS name for A and AAAA separately. Record the observation times and returned values so the reviewer can distinguish record state from the update attempt. In an approved change rehearsal, compare each later update with its intended new value. Include the case where only one address family changes and inspect the other record independently. Check the application path through each intended family as a separate acceptance task; an updated record should not close an unperformed connectivity test. ## Official references - [OPNsense — Dynamic DNS](https://docs.opnsense.org/manual/dynamic_dns.html) — official product documentation; confirm the installed release and configuration. Source review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change. ## Primary reference - Name: OPNsense — Dynamic DNS - Authority: docs.opnsense.org - URL: https://docs.opnsense.org/manual/dynamic_dns.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Review OPNsense IPv4 and IPv6 DDNS updates separately,” DSE Security, https://update.dsesecurity.com/updates/review-opnsense-ipv4-and-ipv6-ddns-updates-separately/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.