Bottom Line: The Malformed URL Came From the Extra update_IP Key
The DuckDNS token and subdomain were not the problem. Removing update_IP from the configuration fixed the real case. That matches the current DuckDNS API, whose accepted request parameters are domains, token, optional ip, ipv6, verbose and clear.
Validate the Configuration Against the DuckDNS API
https://www.duckdns.org/update?domains=YOUR_SUBDOMAIN&token=YOUR_TOKEN&verbose=trueThe DuckDNS update API says the domain should be the subname without .duckdns.org, and leaving ip blank lets DuckDNS detect IPv4 automatically.
A curl Error 3 Means Fix the URL Before Testing DNS
curl: (3) URL rejected: Malformed input happens before DuckDNS can accept or reject the DNS update. Look for malformed variables, unexpected keys, quotes, spaces or characters that break the generated request. Curl's curl error behavior is the upstream reference.
Verify the Update Result, Not Just the Container State
DuckDNS returns OK or KO; with verbose mode it also reports UPDATED or NOCHANGE. A container showing “running” does not prove your public DNS record is current.
The DuckDNS requirements covers the current ZimaOS-side updater model.
DuckDNS Does Not Solve CGNAT or Secure Remote Access
DDNS only maps a hostname to an address. It does not open router ports, bypass CGNAT or authenticate users. If the actual goal is remote NAS access, pair the hostname with a secure reverse proxy/VPN design—or use the built-in remote-access path.
The ZimaOS HTTPS proxying covers the HTTPS layer.
