A dynamic IP is assigned by DHCP and can change; a static IP is permanently reserved for you. Most home users need neither, because residential dynamic addresses rarely change and dynamic DNS covers the remaining cases for free.
The actual difference
A dynamic IP address is leased to you by your ISP's DHCP server for a defined period, after which your router renews it. Renewal usually returns the same address, so the term dynamic describes the mechanism rather than a guarantee of change.
A static IP address is reserved for your account permanently and does not change until you or the ISP deliberately change it. It is configured either as a DHCP reservation keyed to your equipment, or manually on the router's WAN interface with an address, subnet mask, gateway and resolvers supplied by the ISP.
Two distinctions get conflated constantly, and both matter more than static versus dynamic. First, public versus private: a public address is reachable from the internet, a private one behind CGNAT is not, regardless of whether it changes. Second, static versus merely stable: an address that has not changed in two years is still dynamic, and it will change the day your ISP re-architects its pools or your modem stays offline long enough for the lease to expire.
You can have a static private address, which is the worst of both worlds, and some ISPs sell exactly that by mistake. Confirm you are buying a public routable address if reachability is the goal.
# see your current lease details
ipconfig /all | findstr /i "Lease DHCP IPv4" # Windows
ipconfig getpacket en0 | grep -i lease # macOS
nmcli -f DHCP4 connection show "Wired connection 1" # Linux NetworkManagerHow often a dynamic IP really changes
Less often than people expect. Most US cable and fibre operators use lease times between 12 hours and 7 days, but the renewal process is designed to hand back the same address. A residential address commonly persists for months.
The events that actually cause a change are specific and worth knowing, because avoiding them is often enough to keep an address stable indefinitely.
The practical upshot: if you need an address that will probably be the same next week, you already have one. If you need an address that is guaranteed to be the same in eighteen months, buy a static one.
- Modem or router powered off long enough for the lease to expire, typically more than a few hours.
- Replacing the modem or router, since the DHCP client identifier or MAC address changes.
- ISP maintenance, pool re-architecture, or a regional equipment swap.
- Migrating a subscriber to CGNAT, which many operators are doing progressively on existing accounts.
- Explicitly releasing the lease, for example
ipconfig /releasefollowed byipconfig /renewon a directly connected machine.
If you want your dynamic address to stay put, do not power-cycle the modem casually and do not swap hardware. If you want it to change, leave the modem off for several hours, or clone a different MAC address on the WAN interface where your router supports it.
When you genuinely need static
There are a small number of cases where nothing else works, and a much larger number where people buy static addresses they do not need.
Running a mail server is the clearest case. Receiving mail requires stable MX targets, and having your mail accepted requires a reverse DNS (PTR) record matching your sending hostname, forward-confirmed. ISPs only create PTR records for addresses assigned to you permanently, and most receiving servers reject mail from addresses with generic or missing rDNS. Residential dynamic ranges are also listed wholesale on the Spamhaus PBL specifically to indicate they should not be sending mail directly.
IP allowlisting is the second solid case. Corporate VPN concentrators, database services, payment processors and some APIs restrict access to declared source addresses. If the far side maintains an allowlist and you cannot ask them to update it daily, you need an address that does not move.
Hosting a service with strict uptime requirements is the third. Dynamic DNS introduces a propagation gap between an address change and DNS catching up, typically a few minutes with a short TTL. For a hobby service that is irrelevant; for anything with an SLA it is not.
Certain site-to-site VPN configurations also require it, because IKE peer configurations and IPsec policies frequently reference peer addresses rather than hostnames. Modern implementations support dynamic peers, but plenty of deployed enterprise equipment does not.
Gaming does not require a static IP, despite what forum posts and some ISP sales scripts claim. Console NAT type is determined by the translation behaviour of your router and any carrier NAT, not by whether the address changes. A static address behind CGNAT still yields strict NAT.
When dynamic DNS is the better answer
Dynamic DNS solves the addressing problem for almost everyone who thinks they need a static IP. A small client on your router or a machine inside the network detects address changes and updates an A record within seconds, so a hostname always points at your current address.
Most consumer routers include a DDNS client covering several providers. Where they do not, a cron job or systemd timer running a single curl command is sufficient. Set a short TTL, 60 to 300 seconds, so resolvers do not cache a stale answer through a change.
The requirement dynamic DNS cannot satisfy is inbound reachability behind CGNAT. The hostname will correctly resolve to the carrier's shared address, which does not route to you. Detect CGNAT first; if you are behind it, dynamic DNS is not the tool.
It also cannot help with mail deliverability, because the problem there is PTR records and reputation, neither of which a hostname update affects.
- Set TTL to 60 to 300 seconds so changes propagate quickly.
- Update on address change rather than on a fixed schedule where your client supports it, to avoid provider rate limits.
- Verify with
digagainst an external resolver, not your local one, which may serve a cached record. - If
dig -xon your address returns nothing or a generic hostname like c-203-0-113-45.hsd1.tx.comcast.net, direct mail sending will fail regardless of DDNS.
# generic DDNS update via cron, adapt the URL to your provider
*/5 * * * * curl -fsS "https://user:token@dynupdate.example.com/nic/update?hostname=home.example.net&myip=$(curl -4 -s https://ifconfig.co)" >/dev/null
# confirm resolution and TTL
dig home.example.net A +noall +answer
dig home.example.net A +short
# check reverse DNS on your address, relevant for mail
dig -x 203.0.113.45 +shortCost, and the privacy trade-off
On US residential service, a static public IPv4 address typically costs $5 to $20 per month as an add-on, where it is offered at all. Many operators only sell it with a business-class plan, which adds $30 to $80 per month over the residential equivalent while also bringing a different support tier and, usually, an SLA. Business fibre plans frequently include a /29 block of five usable addresses.
Weigh that against free alternatives before buying. Dynamic DNS costs nothing. An overlay network such as Tailscale or ZeroTier costs nothing for personal use and works behind CGNAT. A $5 per month virtual server with a public address, used as a reverse tunnel endpoint, gives you a genuinely static public address plus somewhere to terminate TLS, and is often cheaper than the ISP add-on.
The privacy dimension is straightforward and worth stating plainly. A static IP is a permanent identifier tied to your account. Every site you visit sees the same address indefinitely, which makes cross-site correlation trivial and long-term profiling reliable without cookies. A dynamic address that occasionally rotates provides weak but real protection against that, and a CGNAT address provides more by mixing you with other subscribers.
There is also an exposure difference. A static public address is a fixed target for scanning. Anything you expose will be found and probed continuously, and an address known to host services attracts more attention over time than one that rotates. If you buy a static address, budget the time to firewall it properly rather than treating it as a purely administrative change.
Frequently asked
Do I need a static IP for gaming?
No. Console NAT type depends on how your router and any carrier NAT handle translation, not on whether your address changes. A static address behind CGNAT still produces strict NAT. Enabling UPnP on your own router, or confirming you are not behind CGNAT, addresses the actual cause.
How often does a residential dynamic IP change?
Frequently less than once every few months. Lease times run from 12 hours to 7 days, but renewal normally returns the same address. Changes are usually triggered by extended modem downtime, replacing network hardware, or ISP-side maintenance rather than by the lease expiring on schedule.
Is a static IP more secure?
No, and arguably less. Security depends on what services you expose and how they are configured. A static address is a permanent, easily catalogued scanning target, so anything listening on it will be probed continuously. The security benefit people associate with static addressing comes from allowlisting, which is a control on the far side.
Can I get a static IP behind CGNAT?
You can be assigned a static private address behind the carrier translator, which is useless for inbound reachability. What you need is a public routable address. Ask your ISP explicitly for that wording, because support scripts frequently treat static and public as interchangeable when they are not.
Does a VPN give me a static IP?
Standard VPN service gives you a shared exit address that changes each session and is used by many customers at once. Some providers sell a dedicated IP add-on that assigns one exit address to you alone, which satisfies allowlisting requirements. It does not give you inbound reachability unless port forwarding is also offered.