Setup

01 Cloudflare token

In Cloudflare, open My Profile → API Tokens → Create Token → Create Custom Token and give the token these two permissions, Zone.Zone Read and Zone.DNS Edit:

Permission

Zone · Zone · Read

Permission

Zone · DNS · Edit

Zone Resources

Include · Specific zone · example.com

Under Zone Resources → Include → Specific zone, pick the one zone your FRITZ!Box lives in. Then a leaked token can't touch your other domains.

Your token travels to this Instance in the Update URL on every update. It is never logged, but whoever operates this Instance could read it. If that's not good enough, run your own →

show screenshot ▸

02 DNS records

The service only updates existing records and never creates them, so create them once by hand. In Cloudflare, open your domain → DNS → Records → Add record.

A record, for IPv4

Type

A

Name

home — the part of home.example.com before .example.com

IPv4 address

192.0.2.1 — any IPv4 works until the first update

Proxy status

DNS only

TTL

1 min

AAAA record, for IPv6

Type

AAAA

Name

home — the part of home.example.com before .example.com

IPv6 address

2001:0db8:85a3:0000:0000:8a2e:0370:7334 — any IPv6 works until the first update

Proxy status

DNS only

TTL

1 min

Skip the record for an IP family your line doesn't have: pick the IP families above that it does have, and the Update URL in step 03 follows.

show screenshot ▸

03 FRITZ!Box

In the FRITZ!Box admin page, open Internet → Permit Access → DynDNS(Internet → Freigaben → DynDNS), tick Use DynDNS (DynDns aktiv) and fill in:

Update URL (Update-URL)

https://fritzdns.piscis.dev/api/fritz-dyndns/?token=<pass>&record=home.example.com&zone=example.com&ipv4=<ipaddr>&ipv6=<ip6addr>

Domain name (Domainnamen)

home.example.com — the full hostname from the Update URL

Username (Benutzername)

fritz — any value, the service ignores it

Password (Kennwort)

●●●●●● — your Cloudflare API token from step 01

The token goes into the Password field and nowhere else: the FRITZ!Box puts it in place of <pass>, and <ipaddr> / <ip6addr> become your current addresses. Click Apply (Übernehmen).

show screenshot ▸

04 Check it

• On the FRITZ!Box Overview (Übersicht), the DynDNS line under Komfortfunktionen reads IPv4-Status: angemeldet, and IPv6-Status: angemeldet if you use IPv6.
• In Cloudflare, the records from step 02 now hold your real IP instead of the placeholder.

If not, look for DynDNS-Fehler entries in the FRITZ!Box event log, System → Event Log (System → Ereignisse). A failed update ends with one of these messages from the service:

Zone "example.com" not found.

The zone is misspelled, or the token is not scoped to it. Check the zone parameter against the domain name in Cloudflare, and the token's Zone Resources against step 01.

A record for "home.example.com" does not exist.

Create the A record from step 02. If your line has no IPv4, pick IPv6 only under IP families in step 02 and copy the Update URL again.

AAAA record for "home.example.com" does not exist.

Create the AAAA record from step 02. If your line has no IPv6, pick IPv4 only under IP families in step 02 and copy the Update URL again.

Missing ipv4 or ipv6 URL parameter.

A placeholder got deleted from the Update URL. Copy it again from step 03.

DynDNS-Fehler: Der angegebene Domainname kann trotz erfolgreicher Aktualisierung nicht aufgelöst werden.

The update worked, but the FRITZ!Box could not look up its own name afterwards. Make Domain name (Domainnamen) the same hostname as in the Update URL, home.example.com. Right after you create the records, give DNS a few minutes to catch up.

The record still holds the placeholder IP

Proxy status is set to Proxied: switch it to DNS only. For the A record, your line may have no public IPv4 (DS-Lite): delete the A record, pick IPv6 only under IP families in step 02 and copy the Update URL again.