AnyIP

DNS server for development HTTPS — resolve any IP from a hostname, with free wildcard TLS.

$ dig 127-0-0-1.anyip.dev +short
127.0.0.1

$ dig myapp-192-168-1-5.anyip.dev +short
192.168.1.5

$ curl https://myapp-127-0-0-1.anyip.dev  # ✅ valid TLS

Usage

Public Services

anyip.dev is the primary public service, supporting both public and private IP addresses. The general usage examples on this page use anyip.dev.

Service	DNS policy for IP-encoded hostnames
anyip.dev	Public and private IP addresses
lanip.dev	Permitted private, loopback, and reserved addresses only; public IPs return no address

Both services support IPv4, IPv6, prefixed and nested IP hostnames, ECDSA/RSA development certificates, on-demand subdomain certificates, and DNS over HTTPS.

When to use lanip.dev

Use lanip.dev when your workflow requires IP-encoded hostnames that will not resolve to public IP addresses, such as development callback policies that exclude public-IP destinations. It is publicly available to everyone and resolves only permitted private, loopback, and reserved addresses. See the permitted ranges and OAuth guidance.

This restriction applies to IP-encoded hostnames; the bare domain and www remain public service endpoints. Your browser connects directly to the returned IP.

Development security: private-address filtering does not prove application ownership or make all subdomains trusted OAuth callbacks. Shared certificate private keys are intentionally public. See the security and OAuth guidance.

For these use cases, substitute lanip.dev in the examples:

dig myapp-192-168-1-5.lanip.dev +short   # 192.168.1.5
dig preview.127-0-0-1.lanip.dev +short  # 127.0.0.1
dig 8-8-8-8.lanip.dev +short            # no address

Migrating from tap.dev? Replace the hostname suffix and obtain certificates for the new domain. Both services support on-demand subdomain issuance; request the specific certificate before use. DNS resolution of nested names does not imply coverage by the root wildcard certificate. See certificate coverage.

DNS Resolution

Embed any IP address in the hostname. It just works:

ping myapp-192-168-1-5.anyip.dev      # → 192.168.1.5
curl http://127-0-0-1.anyip.dev:3000  # → connects to localhost:3000

# Nested subdomains work too
dig preview.127-0-0-1.anyip.dev +short  # → 127.0.0.1

HTTPS Certificate

Download the wildcard certificate to enable HTTPS on your local dev server:

# Download cert + key
curl -o fullchain.pem https://anyip.dev/cert/fullchain.pem
curl -o privkey.pem   https://anyip.dev/cert/privkey.pem

# Use with any framework
vite --https --host \
  --ssl-cert fullchain.pem --ssl-key privkey.pem

Subdomain Certificate

For nested subdomains like user1.127-0-0-1.anyip.dev, request a per-IP wildcard cert:

# Request issuance (~10-30s on first call)
curl -X POST https://anyip.dev/cert/sub/127-0-0-1

# Download
curl -o fullchain.pem https://anyip.dev/cert/sub/127-0-0-1/fullchain.pem
curl -o privkey.pem   https://anyip.dev/cert/sub/127-0-0-1/privkey.pem

DNS over HTTPS

Use AnyIP as an encrypted DNS resolver in your browser:

# Browser: Settings → Secure DNS → Custom
https://anyip.dev/dns-query

# Or query directly
curl "https://anyip.dev/dns-query?name=127-0-0-1.anyip.dev&type=A"

Features

Embedded IP Resolution

Any <name>-<ip>.domain hostname resolves to the embedded IP. IPv4 and IPv6 supported.

Nested Subdomains

prefix.ip.domain also resolves — perfect for per-user or per-branch preview domains.

Automatic TLS

Let's Encrypt wildcard certificates via DNS-01, with auto-renewal. Root and per-IP subdomain certs.

Certificate Distribution

Download certs over HTTPS. One curl command to get your dev server running with valid TLS.

DNS over HTTPS

RFC 8484 compliant DoH endpoint. Use as your browser's secure DNS resolver.

Single Binary

Written in Go. Zero dependencies, cross-platform. Deploy anywhere in minutes.

Self-Hosting

Deploy your own instance with Docker:

# 1. Point NS records to your server
#    anyip.dev.  NS  ns1.anyip.dev.
#    ns1.anyip.dev.  A  <your-server-ip>

# 2. Run with Docker
docker run -d --name anyip \
  -e ANYIP_DOMAIN=yourdomain.dev \
  -e ANYIP_ACME_EMAIL=you@example.com \
  -p 53:53/udp -p 53:53/tcp -p 443:443 \
  -v anyip-certs:/certs \
  ghcr.io/taptap/anyip:latest

Or build from source: go build -o anyip ./src

See the full self-hosting guide for details.