Polfence docs

1. Create an account and add a hostname.
2. Copy the update URL (it includes your token) from the hostname page.
3. Paste it into your router's DDNS settings, or run it from any always-on device.

Send an HTTP GET (or POST) to:

GET https://update.polfence.net/nic/update?hostname=<FQDN>&myip=<IP>&token=<TOKEN>

Plain http:// works too — the update endpoint never redirects, so routers and embedded clients without modern TLS can still update.

Parameters:

The response is plain text, one line per hostname:

Authentication is either the token query parameter or HTTP Basic auth, where the password is your update token. The username is recorded but not checked, so any value works.

Leave out myip and Polfence uses the source address of the request — ideal when the updating device is the one whose IP you want to publish. To set a specific address (or both families), pass them explicitly:

# IPv4 + IPv6 in one call
curl "https://update.polfence.net/nic/update?hostname=myhome.polfence.net\
&myip=203.0.113.10,2001:db8::10&token=YOUR_TOKEN"

In your router's Dynamic DNS section, pick a Custom / dyndns2 provider and map the fields:

Run ddclient on any Linux/macOS box that's always on:

# /etc/ddclient.conf
protocol=dyndns2
use=web, web=checkip.amazonaws.com
server=update.polfence.net
ssl=yes
login=you@example.com
password=YOUR_TOKEN
myhome.polfence.net

Every hostname can publish TXT records, so you can issue real certificates — including wildcards like *.myhome.polfence.net — via the ACME DNS-01 challenge. Manage records on the hostname page, or let your ACME client publish them itself through our lego-compatible endpoint (httpreq provider, authenticated with the hostname's update token):

export HTTPREQ_ENDPOINT=https://www.polfence.com/api/acme
export HTTPREQ_USERNAME=polfence
export HTTPREQ_PASSWORD=YOUR_TOKEN

lego --email you@example.com --dns httpreq \
  -d 'myhome.polfence.net' -d '*.myhome.polfence.net' run

The same works from Traefik (certificatesresolvers.…​.acme.dnschallenge.provider=httpreq) and anything else built on lego. Enable Wildcard records on the hostname to also resolve every subdomain to your IP.

Shield is a filtering DNS resolver: every device you point at it gets malware, phishing, ads, trackers and any category you choose blocked at the DNS layer, before a connection is ever made. Queries are answered over DNS-over-HTTPS, resolved through EU upstreams (Quad9, Mullvad) and logged, if you want them logged, in the EU only. Each profile in the dashboard gets its own private endpoint:

https://www.polfence.com/dns-query/<TOKEN>

The token is the credential. Anyone holding the URL resolves through your policy and shows up in your log, so rotate it from the profile page if it leaks.

The endpoint speaks standard wire-format DNS-over-HTTPS, so every OS, browser and router that supports a custom DoH template works unchanged:

Responses:

A quick check from any shell:

curl -H 'accept: application/dns-json' \
  'https://www.polfence.com/dns-query/<TOKEN>/json?name=example.com'

# A blocked name — NXDOMAIN plus the reason:
curl 'https://www.polfence.com/dns-query/<TOKEN>/json?name=malware.testing.google.test'
# → {"Status":3, …, "polfence":{"action":"blocked","reason":"malware", …}}

1. Allow list — an entry on your allow list always wins, even over a category block. Use it to un-break a site.
2. Deny list — your own blocks, regardless of category.
3. Categories — malware, phishing, cryptomining, newly registered, ads, trackers, adult, gambling, social. Security categories are evaluated first so the log attributes a block to the most serious reason.
4. Safe search — when enabled, google.*, bing.com, duckduckgo.com and youtube.com are answered with their enforced-safe endpoints.
5. Everything else is forwarded upstream and cached for its TTL (at most 5 minutes).

Matching walks up the name: a query for a.b.example.com checks b.example.com, example.com and finally com, so a single list entry covers every subdomain. In your own lists, example.com matches the domain and all subdomains while *.example.com matches subdomains only.

Blocked names get NXDOMAIN with a 10-second negative-cache SOA, which every stub resolver handles cleanly (apps see “host not found” instead of hanging on 0.0.0.0). Each profile can switch to 0.0.0.0/:: answers under Protection → Blocked answer (some smart-TV and IoT firmware prefers it); SHIELD_BLOCK_MODE=zero changes the deployment default.

Two more sources sit between your deny list and the categories:

• Sentinel threat list — domains Polfence Sentinel flagged in real traffic (beaconing, DGA, phishing infrastructure) plus admin additions. On by default per profile; a hit is logged with reason sentinel and raises shield.threat. Entries expire on their own.
• Schedules — extra categories that apply only inside time windows, see below. A scheduled block is logged with its category and the JSON endpoint adds "scheduled": true.

One profile can serve a whole office. Add named devices on the profile page and each gets its own URL under the same token:

https://www.polfence.com/dns-query/<TOKEN>/<DEVICE>
https://www.polfence.com/dns-query/<TOKEN>/<DEVICE>/json?name=example.com

<DEVICE> is the device’s URL name (letters, digits, dashes — e.g. reception-pc). The policy is identical; only attribution changes: the query log gets a device column, analytics and the weekly report break down per device, and the device’s “last seen” and client IP update. An unknown device name answers 404 like an unknown token. Queries on the plain profile URL are logged without a device.

Each device has its own .mobileconfig download for Apple platforms; every other platform takes the per-device URL wherever it takes the profile URL. Rotating the token rotates all device URLs at once.

A schedule adds categories during time windows — social networks 09:00–17:00 on weekdays, gambling overnight. Windows are evaluated on a wall clock in the profile’s IANA time zone (Settings → Time zone), so daylight-saving changes are handled for you. The stored form is JSON:

[
  { "days": [1,2,3,4,5], "from": "09:00", "to": "17:00", "categories": ["social"] },
  { "days": [0,1,2,3,4,5,6], "from": "22:00", "to": "06:00", "categories": ["gambling"] }
]

The profile page shows “Active now: +Social networks” while a window is open and “Test a domain” evaluates the current moment. Up to 12 windows per profile.

Every profile page has copy-paste instructions for each platform with your token already filled in.

With logging on, each query stores the domain, record type, verdict, client IP, GeoIP country and resolver latency. Retention is per profile (1 day to 1 year) and enforced by the resolver itself; “Clear” on the profile page wipes the log immediately. Turn logging off for a strict no-logs resolver — filtering and the threat alerts keep working, only the log and analytics stop.

Custom lists can be imported and exported as text (one domain per line, hosts format, adblock ||domain^ and @@||domain^, or the exported allow|deny domain form) — handy when moving from Pi-hole or NextDNS. With the weekly report on, the profile owner gets queries, block rate, top blocked domains, threats and a per-device breakdown by email every 7 days.