My home connection has a dynamic public IP, so a DNS record can quietly become wrong after an ISP change. This small scheduled task keeps one Cloudflare A record pointed at the current address.

The original version of this post used a Global API Key. Don’t use that for this job. It gives far more access than a DNS updater needs. Use a scoped API token instead.

What you need

• A domain in Cloudflare
• A Synology NAS with Task Scheduler access
• The Zone ID and DNS Record ID for the record you want to update
• A Cloudflare API token restricted to that one zone

Create a scoped API token

In Cloudflare, create a token using the Edit zone DNS template. Limit it to the one zone you are updating. The token needs Zone / DNS / Edit permission; set an expiry or IP restriction too if it suits your setup.

Cloudflare explains the current token flow in its API token documentation.

You can find the Zone ID on the domain’s overview page. For the Record ID, open the record in the Cloudflare dashboard, or use the API to list the zone’s records.

The update script

Create a user-defined task in Control Panel → Task Scheduler. Replace the placeholder values below, keep the token private, and run the task once manually before scheduling it.

#!/bin/sh
set -eu

ZONE_ID="your-zone-id"
DNS_RECORD_ID="your-dns-record-id"
CLOUDFLARE_API_TOKEN="your-scoped-api-token"
RECORD_NAME="home.example.com"

CURRENT_IP="$(curl -4fsS https://api.ipify.org)"

curl --fail --silent --show-error \
  --request PATCH \
  "https://api.cloudflare.com/client/v4/zones/${ZONE_ID}/dns_records/${DNS_RECORD_ID}" \
  --header "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
  --header "Content-Type: application/json" \
  --data "{\"type\":\"A\",\"name\":\"${RECORD_NAME}\",\"content\":\"${CURRENT_IP}\",\"ttl\":1,\"proxied\":true}"

This updates the record you named. It does not create a new one each time the task runs.

A couple of practical notes

• ttl: 1 means Cloudflare manages the TTL automatically.
• Set proxied to false if this record should be DNS-only—for example, some mail, VPN, or non-HTTP services.
• Schedule it every 15 to 30 minutes. There is little value in checking more often for a typical home connection.
• If you store the token in the script, make the task and its files readable only by the account that needs them.

That is the whole setup: one scoped token, one known DNS record, and a task that updates it when the address changes.