DynamicDNS reports localhost IP (127.0.0.1) if sending domain is owned by a different account

Symptoms

When making a query to the Dynamic DNS cPanel webcall, if a domain that is owned by a different account is used, this can result in 127.0.0.1 being returned instead of the correct IP.

# curl -k https://example.tld/cpanelwebcall/oyotimyjjzfuhqszpxfofxbiuksvmkiq
ipv4: 127.0.0.1

Cause

For additional security, the proxy used for the DynamicDNS call is only trusted if the sending domain owns the account. If the incorrect domain is used, then the proxy is not considered to be trusted and thus the 127.0.0.1 IP is used.

We have opened case CPANEL-54166 for our developers to review this behavior, and to prevent the incorrect domain from causing the DDNS record to be updated to the localhost IP.

Resolution

The only known workaround is to ensure that the correct domain is used with the correct ID, as it is shown in cPanel.