Comparisons

Magic DNS

nip.io/sslip.io answers any hostname that has an address written into it. Nothing is stored and there is no account.

  • Let's Encrypt issues certificates for IP addresses now, so a machine reachable from the internet can serve HTTPS with no name at all. They last six days by rule, because an address is transient.
  • With nip.io the address is the name, so a machine that moves gets a different name and every URL holding the old one is dead. With DNSMint the address is a field you PUT, and the name does not change.
  • An IP certificate validates over http-01 or tls-alpn-01 only. A machine behind NAT, on a private address, or not answering on 443 cannot have one; a DNS-01 credential certifies all three.
  • Neither nip.io nor sslip.io is on the Public Suffix List, so everyone using them shares one cookie scope, one Let's Encrypt limit and one reputation - a blocklist applies to the registrable domain, so it lands on everybody under it whoever earned it. With DNSMint nobody else is on your domain.

Dynamic DNS

DuckDNS and No-IP point a subdomain you claimed in a web form at an address that changes.

  • A DuckDNS subdomain is claimed by hand, from a fixed allowance. With DNSMint a hostname is created and released over the API, and how many you hold is what the plan says.
  • With DNSMint every hostname carries its own DNS-01 challenge record, so a fleet renews together rather than in turn.
  • duckdns.org is one registrable domain and everyone is on it. It is on the Public Suffix List, so cookies and certificate limits stay yours - reputation does not. A blocklist applies to the registrable domain, so it lands on every label under it. With DNSMint the domain is yours alone.

Programmable DNS/DIY

DNSimple and deSEC run the nameservers while you drive records over an API, and buying a domain and pointing it at Route53 or Cloudflare is the same shape by hand. Either way the unit is the zone, and a zone is a domain you bring.

  • A zone there is a domain you bought and delegated first, which is the step a program cannot take on its own. With DNSMint the domain is already ours and already delegated, so nothing has to exist before a hostname does.
  • Their unit is the zone, so a fleet spread over several domains is several zones to hold and pay for. With DNSMint the unit is the hostname, and spreading a fleet across domains is the same call as keeping it on one.
  • With DNSMint nothing caps a zone as a whole. The ceilings are per hostname - 10 records on each - and how many hostnames the plan holds, so a fleet grows with what you pay for rather than against a number set per zone.
  • With DNSMint every domain is signed and its DS published at the registry before it serves anything, so it is not a step anybody has to remember.
  • One registrable domain is one certificate limit, one cookie scope and one blocklist fate for everything under it. With DNSMint every account has a domain to itself, and tenants can be spread across several.
  • With a managed certificate, the certificate comes back from the same API as the hostname and we renew it, rather than it being an ACME client, a plugin and a renewal to run yourself.
  • The same shape at fleet scale is a wildcard on a domain you bought, with the device's address written into the label, which is what plex.direct and myunraid.net are. A wildcard a customer's box serves means the private key is on that box, on hardware you do not control, and one extraction is every customer. With DNSMint a hostname is its own certificate, so one device is one device.

A private CA you ship

A vendor generates its own root certificate, puts it in the product, and asks the customer to install it into the trust store of every device they browse from. Start9 documents those steps for Windows, macOS, Linux, iOS and Android.

  • That root goes in by hand, once per operating system. On iOS it is two steps in two places, because the profile only installs through Safari and trust is enabled separately under Certificate Trust Settings. A DNSMint hostname is already trusted by every browser, because a public CA issued the certificate.
  • A trust store belongs to one device and one person. The customer who installed the root is fine; the colleague they send the link to is not, and neither is the phone they replaced. Nothing has to be installed for a publicly trusted certificate.
  • Anything that is not a browser keeps its own trust store, and often has no way to add to it - a webhook from a payment processor, a mobile app with pinned roots, a CI job, a scanner. Those reach a DNSMint hostname without an exception being made for it.
  • A root sitting in a customer's trust store can sign for any name it was not explicitly constrained against, which makes it a key worth stealing for as long as it stays installed. A DNS-01 credential signs nothing and opens one hostname.

Tunnels, which do a different job

ngrok and Cloudflare Tunnel make a machine reachable that the internet cannot reach, by carrying every request through their own network. That is not what DNSMint does. We give a name to something you already have, an address public or private, or a platform endpoint the hostname follows, and answer DNS for it without touching the traffic. A machine behind NAT can hold a DNSMint hostname and a publicly trusted certificate over DNS-01 and still be reachable only from inside its own network. If what you need is for the outside world to connect to it, you need a tunnel.