From 3e90062255c40152c74d0081f11eaa4f77bc7ef1 Mon Sep 17 00:00:00 2001 From: William Mantly Date: Thu, 16 Jul 2026 12:55:06 -0400 Subject: [PATCH] DuckDNS: validate token via a TXT write, not the A/AAAA record listDomains() used to validate the token by calling DuckDNS's update endpoint with ip/ipv6 omitted, which makes DuckDNS auto-detect and apply this host's public IP -- so adding a provider instantly repointed the domain. Validate via a fixed TXT marker instead, which DuckDNS's API supports independently and doesn't touch routing. --- nodejs/models/dns_provider/duckdns.js | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/nodejs/models/dns_provider/duckdns.js b/nodejs/models/dns_provider/duckdns.js index 4a0f422..57322e4 100644 --- a/nodejs/models/dns_provider/duckdns.js +++ b/nodejs/models/dns_provider/duckdns.js @@ -67,14 +67,15 @@ class DuckDns extends DnsApi{ } // No API to enumerate owned subdomains, so the operator supplies them. - // This call both validates the token and, as a side effect, syncs each - // domain's A/AAAA record to this host's current public IP if the token - // is valid (DuckDNS auto-detects the caller's IP when `ip` is omitted) - // — the same thing an operator would need to do anyway when pointing a - // fresh DuckDNS domain at this proxy. + // This call validates the token by writing a fixed marker to the TXT + // record only -- never `ip`/`ipv6` -- so adding/validating a provider + // never changes where the domain's A/AAAA records actually point. (An + // earlier version omitted `ip` here, which made DuckDNS auto-detect and + // apply this host's public IP as a side effect of validation; that's + // exactly what this call must not do.) async listDomains(){ let labels = this.subdomains.split(',').map(d => this.__normalizeLabel(d.trim())).filter(Boolean); - await this.update(labels.join(','), {}); + await this.update(labels.join(','), {txt: 'theta42-proxy-validated'}); return labels.map(label => ({domain: `${label}.duckdns.org`})); }