MikroTik Cloud DDNS is enabled: convenient, and easy to find

What the audit found

The DDNS Enabled option under IP → Cloud is switched on. Your router periodically tells MikroTik's cloud service its current public IP address, and the service publishes it under a DNS name of the form <serial-number>.sn.mynetname.net. Anyone who resolves that name gets your address.

The audit reports this at info level. It is not a vulnerability: the feature works as designed and many people enable it on purpose. It is listed so that you know it is on, and so that you check the findings it interacts with — an exposed management service is more serious on a router that has a stable public name.

Why it matters

Dynamic DNS solves a real problem. Most home and small-business connections get a public address that changes from time to time, and a VPN client or a remote-management bookmark needs a name that follows it. MikroTik's built-in service does that with one checkbox and no third-party account.

The trade-off is discoverability. The name is built from the device serial number, and the service answers for any serial you ask about. Serial numbers appear on the router's label, in support tickets, in forum posts and in shared configuration exports. Someone who obtains the serial can find where your router is today, tomorrow and next year, however often the ISP changes your address. DDNS turns an address that was hard to keep track of into a permanent, public pointer to your device.

On its own that changes nothing: an attacker who has your address still faces your firewall. The combination is what matters. If Winbox, SSH, the API or WebFig can be reached from the internet, a permanent name means an address change will never hide the device from a scanner that found it once.

This is hygiene, not a hole. Keep the feature if you use it; make sure the rest of the configuration assumes the router is findable.

What it looks like in Winbox

Open IP → Cloud. The DDNS Enabled box is ticked, and the DNS Name field shows the assigned ….sn.mynetname.net name along with the Public Address the service last recorded. The Update Time checkbox is a separate function (time synchronisation from the cloud) and is not part of this finding.

How to fix it

There is no single remediation for this finding, because the right action depends on whether you use the name.

If you do not use it — you never set up a VPN or bookmark that points at the mynetname.net address — untick DDNS Enabled under IP → Cloud and the router stops publishing its address. If you do use it, keep it, and instead make sure the device is safe to find. Check three things in the rest of your audit report: management services (Winbox, SSH, WebFig, API) are restricted to your management network in their Available From field and not reachable from the WAN; the input chain of the firewall ends with a rule that drops everything not coming from the LAN; and the only service reachable from the internet is the VPN you actually use — WireGuard, IKEv2 or SSTP — with strong keys or passwords.

An alternative worth knowing: the mynetname.net name is tied to the serial, but you can point a name in your own domain at it with a CNAME record, and share that instead of the serial-based name. You avoid spreading the serial further.

Changing the DDNS setting has no effect on your current management sessions, so Safe Mode is not needed. Afterwards, with DDNS off the DNS Name field is empty; if you kept it on, resolve the name from outside and confirm that Winbox and SSH on that address time out from a network that is not yours. Then re-run the audit and check that no management-exposure findings remain.

The full MKRouterKit report tells you which of those exposure findings apply to your router and gives the exact commands to close them — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

Is this a vulnerability in MikroTik's cloud service?

No. The service does exactly what it advertises. The finding is informational: it points out that the router has a stable public name, and that this raises the stakes of any other exposure finding on the same device.

I use the cloud name for my WireGuard clients. Should I turn it off?

No — that is the intended use, and a VPN endpoint on a well-configured router is fine to find. Keep DDNS on and spend the effort on the items in the fix section: no management on WAN, a proper input chain, strong VPN keys.

Can I use a different dynamic DNS provider instead?

Yes. RouterOS can update most providers with a small script using the built-in fetch tool, and a name under your own domain does not reveal the serial. Whether it is worth the effort depends on how much you care about the serial being linkable to the address; the security of the router itself does not change.