Magic DNS

The name is the address

That is the whole design, and it is why it works with no account. It is also the constraint: a machine that moves gets a different name, and every URL holding the old one is dead. There is nothing to update, because there was never a record.

A minted hostname holds the address in a field instead. Moving a machine is a PUT onto the same name, and a URL somebody already has keeps working.

Certificates for an address

Let's Encrypt issues certificates for IP addresses, so a machine the internet can reach can serve HTTPS with no name at all. Those last six days by rule, because an address is transient, and they validate over http-01 or tls-alpn-01 only.

That rules out the machines most likely to want one: behind NAT, on a private range, or not answering on 443. DNS-01 is the only self-serve path left for those, and it needs a name in a zone somebody will publish a challenge record in.

One domain, shared by everyone on it

Neither nip.io nor sslip.io is on the Public Suffix List, which browsers and Let's Encrypt both honour. Everyone using them sits inside one cookie scope and one certificate rate limit, and a blocklist applies to the registrable domain, so it lands on everybody under it whoever earned it.

Checked against publicsuffix.org on 2026-09-08, when sslip.io was also serving a 301 to nip.io.

Moving off one

POST the address the derived name encodes and use the hostname that comes back. The old name keeps resolving, because it always did for anyone holding it, so there is no cutover to coordinate and nothing to switch off.