diff --git a/plist b/plist
index 15cdc7011d0..4f5b632cb41 100644
--- a/plist
+++ b/plist
@@ -399,6 +399,7 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogVlan.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Interfaces/forms/dialogVxlan.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/CtrlAgentController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/DhcpddnsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/Dhcpv4Controller.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/Dhcpv6Controller.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/Leases4Controller.php
@@ -407,6 +408,10 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/Api/ServiceController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/DhcpController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/agentSettings.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsDnsServer.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsForwardDomain.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsReverseDomain.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsTsigKey.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogPDPool6.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogPeer4.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogPeer6.xml
@@ -416,6 +421,7 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet6.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettings4.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettings6.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettingsDdns.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Monit/Api/ServiceController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Monit/Api/SettingsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Monit/Api/StatusController.php
@@ -822,6 +828,8 @@
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/FieldTypes/KeaStaticRoutesField.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaCtrlAgent.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaCtrlAgent.xml
+/usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.php
+/usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
 /usr/local/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php
@@ -973,6 +981,7 @@
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/vlan.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Interface/vxlan.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Kea/ctrl_agent.volt
+/usr/local/opnsense/mvc/app/views/OPNsense/Kea/dhcp_ddns.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Kea/dhcpv4.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Kea/dhcpv6.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Kea/leases4.volt
diff --git a/src/etc/inc/plugins.inc.d/kea.inc b/src/etc/inc/plugins.inc.d/kea.inc
index f5fa4bc24f3..b98d9cb5213 100644
--- a/src/etc/inc/plugins.inc.d/kea.inc
+++ b/src/etc/inc/plugins.inc.d/kea.inc
@@ -62,6 +62,14 @@ function kea_services()
         $services[] = $service;
     }
 
+    if (!(new \OPNsense\Kea\KeaDhcpDdns())->general->enabled->isEmpty()) {
+        $service = $template;
+        $service['pidfile'] = '/var/run/kea/kea-dhcp-ddns.kea-dhcp-ddns.pid';
+        $service['description'] = gettext('KEA DHCP DDNS server');
+        $service['id'] = 'ddns';
+        $services[] = $service;
+    }
+
     return $services;
 }
 
@@ -146,6 +154,7 @@ function kea_configure_do($verbose = false)
 {
     $keaDhcpv4 = new \OPNsense\Kea\KeaDhcpv4();
     $keaDhcpv6 = new \OPNsense\Kea\KeaDhcpv6();
+    $keaDhcpDdns = new \OPNsense\Kea\KeaDhcpDdns();
 
     killbypid('/var/run/kea_prefix_watcher.pid');
 
@@ -159,6 +168,9 @@ function kea_configure_do($verbose = false)
             /* skip kea-dhcp6.conf when configured manually */
             $keaDhcpv6->generateConfig();
         }
+        if ($keaDhcpDdns->isEnabled() && $keaDhcpDdns->general->manual_config->isEmpty()) {
+            $keaDhcpDdns->generateConfig();
+        }
         (new \OPNsense\Kea\KeaCtrlAgent())->generateConfig();
         if ($keaDhcpv6->isEnabled()) {
             mwexecfb(
@@ -175,7 +187,7 @@ function kea_configure_do($verbose = false)
 function kea_syslog()
 {
     $logfacilities = [];
-    $logfacilities['kea'] = ['facility' => ['kea-dhcp4', 'kea-dhcp6', 'kea-ctrl-agent']];
+    $logfacilities['kea'] = ['facility' => ['kea-dhcp4', 'kea-dhcp6', 'kea-ctrl-agent', 'kea-dhcp-ddns']];
     return $logfacilities;
 }
 
@@ -289,7 +301,7 @@ function kea_xmlrpc_sync()
         'description' => gettext('Kea DHCP'),
         'section' => 'OPNsense.Kea',
         'id' => 'kea',
-        'services' => ["kea-dhcpv4", "kea-dhcpv6"],
+        'services' => ["kea-dhcpv4", "kea-dhcpv6", "kea-dhcp-ddns"],
     ];
 
     return $result;
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/Api/DhcpddnsController.php b/src/opnsense/mvc/app/controllers/OPNsense/Kea/Api/DhcpddnsController.php
new file mode 100644
index 00000000000..4e47963cdf9
--- /dev/null
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/Api/DhcpddnsController.php
@@ -0,0 +1,140 @@
+<?php
+
+/*
+ * Copyright (C) 2025 Yip Rui Fung <rf@yrf.me>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Kea\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class DhcpddnsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'dhcp_ddns';
+    protected static $internalModelClass = 'OPNsense\Kea\KeaDhcpDdns';
+
+    /* Forward DDNS domains */
+    public function searchForwardDomainAction()
+    {
+        return $this->searchBase('forward_ddns.ddns_domains', null, 'name');
+    }
+
+    public function getForwardDomainAction($uuid = null)
+    {
+        return $this->getBase('ddns_domains', 'forward_ddns.ddns_domains', $uuid);
+    }
+
+    public function addForwardDomainAction()
+    {
+        return $this->addBase('ddns_domains', 'forward_ddns.ddns_domains');
+    }
+
+    public function setForwardDomainAction($uuid)
+    {
+        return $this->setBase('ddns_domains', 'forward_ddns.ddns_domains', $uuid);
+    }
+
+    public function delForwardDomainAction($uuid)
+    {
+        return $this->delBase('forward_ddns.ddns_domains', $uuid);
+    }
+
+    /* Reverse DDNS domains */
+    public function searchReverseDomainAction()
+    {
+        return $this->searchBase('reverse_ddns.ddns_domains', null, 'name');
+    }
+
+    public function getReverseDomainAction($uuid = null)
+    {
+        return $this->getBase('ddns_domains', 'reverse_ddns.ddns_domains', $uuid);
+    }
+
+    public function addReverseDomainAction()
+    {
+        return $this->addBase('ddns_domains', 'reverse_ddns.ddns_domains');
+    }
+
+    public function setReverseDomainAction($uuid)
+    {
+        return $this->setBase('ddns_domains', 'reverse_ddns.ddns_domains', $uuid);
+    }
+
+    public function delReverseDomainAction($uuid)
+    {
+        return $this->delBase('reverse_ddns.ddns_domains', $uuid);
+    }
+
+    /* TSIG keys */
+    public function searchTsigKeyAction()
+    {
+        return $this->searchBase('tsig_keys', null, 'name');
+    }
+
+    public function getTsigKeyAction($uuid = null)
+    {
+        return $this->getBase('tsig_keys', 'tsig_keys', $uuid);
+    }
+
+    public function addTsigKeyAction()
+    {
+        return $this->addBase('tsig_keys', 'tsig_keys');
+    }
+
+    public function setTsigKeyAction($uuid)
+    {
+        return $this->setBase('tsig_keys', 'tsig_keys', $uuid);
+    }
+
+    public function delTsigKeyAction($uuid)
+    {
+        return $this->delBase('tsig_keys', $uuid);
+    }
+
+    /* Shared DNS servers */
+    public function searchDnsServerAction()
+    {
+        return $this->searchBase('dns_servers', null, 'ip_address');
+    }
+
+    public function getDnsServerAction($uuid = null)
+    {
+        return $this->getBase('dns_servers', 'dns_servers', $uuid);
+    }
+
+    public function addDnsServerAction()
+    {
+        return $this->addBase('dns_servers', 'dns_servers');
+    }
+
+    public function setDnsServerAction($uuid)
+    {
+        return $this->setBase('dns_servers', 'dns_servers', $uuid);
+    }
+
+    public function delDnsServerAction($uuid)
+    {
+        return $this->delBase('dns_servers', $uuid);
+    }
+}
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/DhcpController.php b/src/opnsense/mvc/app/controllers/OPNsense/Kea/DhcpController.php
index 9e3f115ec9a..950e2ea8ddc 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/Kea/DhcpController.php
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/DhcpController.php
@@ -88,4 +88,26 @@ public function leases6Action()
     {
         $this->view->pick('OPNsense/Kea/leases6');
     }
+
+    public function ddnsAction()
+    {
+        $this->view->pick('OPNsense/Kea/dhcp_ddns');
+        $this->view->formGeneralSettings = $this->getForm("generalSettingsDdns");
+
+        // Forward zones (domains)
+        $this->view->formDialogForwardDomain = $this->getForm("dialogDdnsForwardDomain");
+        $this->view->formGridForwardDomain = $this->getFormGrid("dialogDdnsForwardDomain");
+
+        // Reverse zones (domains)
+        $this->view->formDialogReverseDomain = $this->getForm("dialogDdnsReverseDomain");
+        $this->view->formGridReverseDomain = $this->getFormGrid("dialogDdnsReverseDomain");
+
+        // Shared DNS servers
+        $this->view->formDialogDnsServer = $this->getForm("dialogDdnsDnsServer");
+        $this->view->formGridDnsServer = $this->getFormGrid("dialogDdnsDnsServer");
+
+        // TSIG keys
+        $this->view->formDialogTsigKey = $this->getForm("dialogDdnsTsigKey");
+        $this->view->formGridTsigKey = $this->getFormGrid("dialogDdnsTsigKey");
+    }
 }
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsDnsServer.xml b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsDnsServer.xml
new file mode 100644
index 00000000000..947a6b81aa3
--- /dev/null
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsDnsServer.xml
@@ -0,0 +1,26 @@
+<form>
+    <field>
+        <id>dns_servers.description</id>
+        <label>Description</label>
+        <type>text</type>
+        <help>Description for this DNS server entry</help>
+    </field>
+    <field>
+        <id>dns_servers.ip_address</id>
+        <label>IP address</label>
+        <type>text</type>
+        <help>DNS server IP address (IPv4 or IPv6)</help>
+    </field>
+    <field>
+        <id>dns_servers.port</id>
+        <label>Port</label>
+        <type>text</type>
+        <help>DNS server port, default 53</help>
+    </field>
+    <field>
+        <id>dns_servers.key_name</id>
+        <label>TSIG key</label>
+        <type>dropdown</type>
+        <help>Select an optional TSIG key for updates sent to this server. When set, this server-specific key overrides any TSIG key configured on the domain/zone.</help>
+    </field>
+</form>
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsForwardDomain.xml b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsForwardDomain.xml
new file mode 100644
index 00000000000..f9d29901fe2
--- /dev/null
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsForwardDomain.xml
@@ -0,0 +1,20 @@
+<form>
+    <field>
+        <id>ddns_domains.name</id>
+        <label>Forward domain</label>
+        <type>text</type>
+        <help>Forward DDNS domain (e.g. example.com.)</help>
+    </field>
+    <field>
+        <id>ddns_domains.key_name</id>
+        <label>TSIG key</label>
+        <type>dropdown</type>
+        <help>Select an optional TSIG key to authenticate updates for this domain. Note: if a DNS server has a TSIG key configured, that server-specific key takes precedence over the domain key.</help>
+    </field>
+    <field>
+        <id>ddns_domains.dns_servers</id>
+        <label>DNS servers</label>
+        <type>select_multiple</type>
+        <help>Select one or more shared DNS servers to update for this domain.</help>
+    </field>
+</form>
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsReverseDomain.xml b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsReverseDomain.xml
new file mode 100644
index 00000000000..eaa47754b64
--- /dev/null
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsReverseDomain.xml
@@ -0,0 +1,20 @@
+<form>
+    <field>
+        <id>ddns_domains.name</id>
+        <label>Reverse domain</label>
+        <type>text</type>
+        <help>Reverse DDNS domain (e.g. 0.168.192.in-addr.arpa. or ip6.arpa. variant)</help>
+    </field>
+    <field>
+        <id>ddns_domains.key_name</id>
+        <label>TSIG key</label>
+        <type>dropdown</type>
+        <help>Select an optional TSIG key to authenticate updates for this reverse zone. Note: if a DNS server has a TSIG key configured, that server-specific key takes precedence over the domain key.</help>
+    </field>
+    <field>
+        <id>ddns_domains.dns_servers</id>
+        <label>DNS servers</label>
+        <type>select_multiple</type>
+        <help>Select one or more shared DNS servers to update for this reverse zone.</help>
+    </field>
+</form>
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsTsigKey.xml b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsTsigKey.xml
new file mode 100644
index 00000000000..38a2d5a6d72
--- /dev/null
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogDdnsTsigKey.xml
@@ -0,0 +1,20 @@
+<form>
+    <field>
+        <id>tsig_keys.name</id>
+        <label>Name</label>
+        <type>text</type>
+        <help>TSIG key name.</help>
+    </field>
+    <field>
+        <id>tsig_keys.algorithm</id>
+        <label>Algorithm</label>
+        <type>dropdown</type>
+        <help>Select the TSIG hash algorithm.</help>
+    </field>
+    <field>
+        <id>tsig_keys.secret</id>
+        <label>Secret</label>
+        <type>text</type>
+        <help>Base64-encoded shared secret.</help>
+    </field>
+</form>
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
index 4a7aba4922a..2dd2b6b5f59 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet4.xml
@@ -28,6 +28,47 @@
             <visible>false</visible>
         </grid_view>
     </field>
+    <field>
+        <type>header</type>
+        <label>Dynamic DNS (DDNS)</label>
+        <collapse>true</collapse>
+    </field>
+    <field>
+        <id>subnet4.ddns_options.send_updates</id>
+        <label>Send updates</label>
+        <type>checkbox</type>
+        <help>Enable Dynamic DNS updates for this subnet.</help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
+    <field>
+        <id>subnet4.ddns_options.update_on_renew</id>
+        <label>Update on renew</label>
+        <type>checkbox</type>
+        <help>Send DNS updates when leases are renewed.</help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
+    <field>
+        <id>subnet4.ddns_options.qualifying_suffix</id>
+        <label>Qualifying suffix</label>
+        <type>text</type>
+        <help>Suffix appended to hostnames to form FQDNs. Must end with a dot.</help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
+    <field>
+        <id>subnet4.ddns_options.conflict_resolution_mode</id>
+        <label>Conflict resolution</label>
+        <type>dropdown</type>
+        <help>How to resolve DNS conflicts.</help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
     <field>
         <type>header</type>
         <label>DHCP option data</label>
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet6.xml b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet6.xml
index 63d29de2bee..6c95ba19808 100644
--- a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet6.xml
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/dialogSubnet6.xml
@@ -37,6 +37,47 @@
         <type>textbox</type>
         <help>List of pools, one per line in range or subnet format (e.g. 2001:db8:1::-2001:db8:1::100, 2001:db8:1::/80</help>
     </field>
+    <field>
+        <type>header</type>
+        <label>Dynamic DNS (DDNS)</label>
+        <collapse>true</collapse>
+    </field>
+    <field>
+        <id>subnet6.ddns_options.send_updates</id>
+        <label>Send updates</label>
+        <type>checkbox</type>
+        <help>Enable Dynamic DNS updates for this subnet.</help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
+    <field>
+        <id>subnet6.ddns_options.update_on_renew</id>
+        <label>Update on renew</label>
+        <type>checkbox</type>
+        <help>Send DNS updates when leases are renewed.</help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
+    <field>
+        <id>subnet6.ddns_options.qualifying_suffix</id>
+        <label>Qualifying suffix</label>
+        <type>text</type>
+        <help>Suffix appended to hostnames to form FQDNs. Must end with a dot.</help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
+    <field>
+        <id>subnet6.ddns_options.conflict_resolution_mode</id>
+        <label>Conflict resolution</label>
+        <type>dropdown</type>
+        <help>How to resolve DNS conflicts.</help>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
     <field>
         <type>header</type>
         <label>DHCP option data</label>
diff --git a/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettingsDdns.xml b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettingsDdns.xml
new file mode 100644
index 00000000000..e6e4c53c9b1
--- /dev/null
+++ b/src/opnsense/mvc/app/controllers/OPNsense/Kea/forms/generalSettingsDdns.xml
@@ -0,0 +1,19 @@
+<form>
+    <field>
+        <type>header</type>
+        <label>Service</label>
+    </field>
+    <field>
+        <id>dhcp_ddns.general.enabled</id>
+        <label>Enabled</label>
+        <type>checkbox</type>
+        <help>Enable DHCP-DDNS service.</help>
+    </field>
+    <field>
+        <id>dhcp_ddns.general.manual_config</id>
+        <label>Manual config</label>
+        <type>checkbox</type>
+        <advanced>true</advanced>
+        <help>Disable configuration file generation and manage the file (/usr/local/etc/kea/kea-dhcp-ddns.conf) manually.</help>
+    </field>
+</form>
diff --git a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.php b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.php
new file mode 100644
index 00000000000..3d9960d1b68
--- /dev/null
+++ b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.php
@@ -0,0 +1,226 @@
+<?php
+
+/*
+ * Copyright (C) 2025 Yip Rui Fung <rf@yrf.me>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Kea;
+
+use OPNsense\Core\File;
+use OPNsense\Base\BaseModel;
+use OPNsense\Base\Messages\Message;
+
+class KeaDhcpDdns extends BaseModel
+{
+    /**
+     * {@inheritdoc}
+     */
+    public function performValidation($validateFullModel = false)
+    {
+        // Run default field-level validators first
+        $messages = parent::performValidation($validateFullModel);
+
+        // Explicitly validate that forward and reverse domain names end with a dot (FQDN)
+        foreach ($this->forward_ddns->ddns_domains->iterateItems() as $domain) {
+            if (!$validateFullModel && !$domain->isFieldChanged()) {
+                continue;
+            }
+            if (!($domain->name->isEmpty()) && !str_ends_with($domain->name->getValue(), '.')) {
+                $messages->appendMessage(
+                    new Message(
+                        gettext('Domain must be a fully qualified domain name ending with a dot.'),
+                        $domain->__reference . '.name'
+                    )
+                );
+            }
+        }
+        foreach ($this->reverse_ddns->ddns_domains->iterateItems() as $domain) {
+            if (!$validateFullModel && !$domain->isFieldChanged()) {
+                continue;
+            }
+            if (!($domain->name->isEmpty()) && !str_ends_with($domain->name->getValue(), '.')) {
+                $messages->appendMessage(
+                    new Message(
+                        gettext('Domain must be a fully qualified domain name ending with a dot.'),
+                        $domain->__reference . '.name'
+                    )
+                );
+            }
+        }
+
+        return $messages;
+    }
+
+    public function isEnabled()
+    {
+        return $this->general->enabled->isEqual('1');
+    }
+
+    /**
+     * Build a map of shared DNS servers defined at root level (dns_servers)
+     * keyed by their UUID for quick lookup.
+     * @return array<string,array>
+     */
+    private function getSharedDnsServersMap()
+    {
+        $map = [];
+        $tsigNameMap = $this->getTsigKeyNameMap();
+        foreach ($this->dns_servers->iterateItems() as $uuid => $srv) {
+            $item = [];
+            if (!($srv->ip_address->isEmpty())) {
+                $item['ip-address'] = $srv->ip_address->getValue();
+            }
+            if (!($srv->port->isEmpty())) {
+                $item['port'] = $srv->port->asInt();
+            }
+            if (!($srv->key_name->isEmpty())) {
+                $kn = $srv->key_name->getValue();
+                // key_name is a ModelRelationField (UUID). Resolve to TSIG key name.
+                if (!empty($tsigNameMap[$kn])) {
+                    $item['key-name'] = $tsigNameMap[$kn];
+                }
+            }
+            if (!empty($item)) {
+                $map[$uuid] = $item;
+            }
+        }
+        return $map;
+    }
+
+    /**
+     * Build a map uuid => tsig key name for quick lookup when resolving relations.
+     * @return array<string,string>
+     */
+    private function getTsigKeyNameMap()
+    {
+        $map = [];
+        foreach ($this->tsig_keys->iterateItems() as $uuid => $key) {
+            if (!($key->name->isEmpty())) {
+                $map[$uuid] = $key->name->getValue();
+            }
+        }
+        return $map;
+    }
+
+    private function getTsigKeys() {
+        $tsig_keys = [];
+        foreach ($this->tsig_keys->iterateItems() as $key) {
+            $item = [];
+            if (!($key->name->isEmpty())) {
+                $item['name'] = $key->name->getValue();
+            }
+            if (!($key->algorithm->isEmpty())) {
+                $item['algorithm'] = $key->algorithm->getValue();
+            }
+            if (!($key->secret->isEmpty())) {
+                $item['secret'] = $key->secret->getValue();
+            }
+            if (!empty($item)) {
+                $tsig_keys[] = $item;
+            }
+        }
+        return $tsig_keys;
+    }
+
+    private function buildDomains ($domainsNode) {
+        $domains = [];
+        $serversMap = $this->getSharedDnsServersMap();
+        $tsigNameMap = $this->getTsigKeyNameMap();
+        foreach ($domainsNode->iterateItems() as $domain) {
+            $entry = [];
+            if (!($domain->name->isEmpty())) {
+                // emit stored value as-is; validation ensures FQDN (trailing dot)
+                $entry['name'] = $domain->name->getValue();
+            }
+            if (!($domain->key_name->isEmpty())) {
+                $kn = $domain->key_name->getValue(); // UUID from ModelRelationField
+                if (!empty($tsigNameMap[$kn])) {
+                    $entry['key-name'] = $tsigNameMap[$kn];
+                }
+            }
+
+            // dns-servers referenced via ModelRelationField (comma-separated UUIDs)
+            $servers = [];
+            $refs = !($domain->dns_servers->isEmpty()) ? $domain->dns_servers->getValue() : '';
+            if (!empty($refs)) {
+                foreach (array_filter(explode(',', $refs)) as $uuid) {
+                    if (empty($uuid) || empty($serversMap[$uuid])) {
+                        continue;
+                    }
+                    $servers[] = $serversMap[$uuid];
+                }
+            }
+            if (!empty($servers)) {
+                $entry['dns-servers'] = $servers;
+            }
+
+            if (!empty($entry)) {
+                $domains[] = $entry;
+            }
+        }
+        return $domains;
+    }
+
+    private function getForwardDomains() {
+        return $this->buildDomains($this->forward_ddns->ddns_domains);
+    }
+
+    private function getReverseDomains() {
+        return $this->buildDomains($this->reverse_ddns->ddns_domains);
+    }
+
+    public function generateConfig($target = '/usr/local/etc/kea/kea-dhcp-ddns.conf')
+    {
+        $result = [
+            'DhcpDdns' => [
+                'ip-address' => '127.0.0.1',
+                'port' => 53001,
+                'control-socket' => [
+                    'socket-type' => 'unix',
+                    'socket-name' => '/var/run/kea/kea-ddns-ctrl-socket'
+                ],
+                'loggers' => [
+                    [
+                        'name' => 'kea-dhcp-ddns',
+                        'output_options' => [
+                            [
+                                'output' => 'syslog'
+                            ]
+                        ],
+                        'severity' => 'INFO',
+                    ]
+                ],
+                'tsig-keys' => $this->getTsigKeys(),
+                'forward-ddns' => [
+                    'ddns-domains' => $this->getForwardDomains()
+                ],
+                'reverse-ddns' => [
+                    'ddns-domains' => $this->getReverseDomains()
+                ]
+            ]
+        ];
+
+        File::file_put_contents($target, json_encode($result, JSON_PRETTY_PRINT), 0600);
+    }
+}
diff --git a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.xml b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.xml
new file mode 100644
index 00000000000..1f74b3e77cc
--- /dev/null
+++ b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpDdns.xml
@@ -0,0 +1,132 @@
+<model>
+    <mount>//OPNsense/Kea/dhcp_ddns</mount>
+    <version>1.0.0</version>
+    <description>Kea DHCP-DDNS Configuration</description>
+    <items>
+        <general>
+            <enabled type="BooleanField">
+                <Default>0</Default>
+                <Required>Y</Required>
+            </enabled>
+            <manual_config type="BooleanField"/>
+        </general>
+        <!-- shared DNS servers, can be referenced by domains -->
+        <dns_servers type="ArrayField">
+            <description type="DescriptionField">
+                <Required>Y</Required>
+            </description>
+            <ip_address type="NetworkField">
+                <NetMaskAllowed>N</NetMaskAllowed>
+                <Required>Y</Required>
+            </ip_address>
+            <port type="PortField">
+                <Default>53</Default>
+                <Required>Y</Required>
+            </port>
+            <key_name type="ModelRelationField">
+                <Model>
+                    <tsig>
+                        <source>OPNsense.Kea.KeaDhcpDdns</source>
+                        <items>tsig_keys</items>
+                        <display>name</display>
+                    </tsig>
+                </Model>
+            </key_name>
+        </dns_servers>
+        <forward_ddns>
+            <ddns_domains type="ArrayField">
+                <name type="HostnameField">
+                    <IpAllowed>N</IpAllowed>
+                    <ValidationMessage>Please specify a valid domain name.</ValidationMessage>
+                    <Constraints>
+                        <check001>
+                            <type>UniqueConstraint</type>
+                            <ValidationMessage>Duplicate forward domain exists.</ValidationMessage>
+                        </check001>
+                    </Constraints>
+                </name>
+                <key_name type="ModelRelationField">
+                    <Model>
+                        <tsig>
+                            <source>OPNsense.Kea.KeaDhcpDdns</source>
+                            <items>tsig_keys</items>
+                            <display>name</display>
+                        </tsig>
+                    </Model>
+                </key_name>
+                <dns_servers type="ModelRelationField">
+                    <Model>
+                        <dns>
+                            <source>OPNsense.Kea.KeaDhcpDdns</source>
+                            <items>dns_servers</items>
+                            <display>description</display>
+                        </dns>
+                    </Model>
+                    <Multiple>Y</Multiple>
+                    <Required>Y</Required>
+                    <ValidationMessage>Please select at least one DNS server.</ValidationMessage>
+                </dns_servers>
+            </ddns_domains>
+        </forward_ddns>
+        <reverse_ddns>
+            <ddns_domains type="ArrayField">
+                <name type="HostnameField">
+                    <IpAllowed>N</IpAllowed>
+                    <ValidationMessage>Please specify a valid domain name.</ValidationMessage>
+                    <Constraints>
+                        <check001>
+                            <type>UniqueConstraint</type>
+                            <ValidationMessage>Duplicate reverse domain exists.</ValidationMessage>
+                        </check001>
+                    </Constraints>
+                </name>
+                <key_name type="ModelRelationField">
+                    <Model>
+                        <tsig>
+                            <source>OPNsense.Kea.KeaDhcpDdns</source>
+                            <items>tsig_keys</items>
+                            <display>name</display>
+                        </tsig>
+                    </Model>
+                </key_name>
+                <dns_servers type="ModelRelationField">
+                    <Model>
+                        <dns>
+                            <source>OPNsense.Kea.KeaDhcpDdns</source>
+                            <items>dns_servers</items>
+                            <display>description</display>
+                        </dns>
+                    </Model>
+                    <Multiple>Y</Multiple>
+                    <Required>Y</Required>
+                    <ValidationMessage>Please select at least one DNS server.</ValidationMessage>
+                </dns_servers>
+            </ddns_domains>
+        </reverse_ddns>
+        <tsig_keys type="ArrayField">
+            <name type="TextField">
+                <Required>Y</Required>
+                <Constraints>
+                    <check001>
+                        <ValidationMessage>Duplicate TSIG key name exists.</ValidationMessage>
+                        <type>UniqueConstraint</type>
+                    </check001>
+                </Constraints>
+            </name>
+            <algorithm type="OptionField">
+                <Required>Y</Required>
+                <OptionValues>
+                    <HMAC-MD5>HMAC-MD5</HMAC-MD5>
+                    <HMAC-SHA1>HMAC-SHA1</HMAC-SHA1>
+                    <HMAC-SHA224>HMAC-SHA224</HMAC-SHA224>
+                    <HMAC-SHA256>HMAC-SHA256</HMAC-SHA256>
+                    <HMAC-SHA384>HMAC-SHA384</HMAC-SHA384>
+                    <HMAC-SHA512>HMAC-SHA512</HMAC-SHA512>
+                </OptionValues>
+            </algorithm>
+            <secret type="Base64Field">
+                <Required>Y</Required>
+            </secret>
+        </tsig_keys>
+    </items>
+</model>
diff --git a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
index c0dff19e6fc..5381243913e 100644
--- a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
+++ b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.php
@@ -90,6 +90,24 @@ public function performValidation($validateFullModel = false)
             }
         }
 
+        // Enforce that ddns qualifying suffix ends with a dot when set
+        foreach ($this->subnets->subnet4->iterateItems() as $subnet) {
+            if (!$validateFullModel && !$subnet->isFieldChanged()) {
+                continue;
+            }
+
+            $suffix = $subnet->ddns_options->qualifying_suffix;
+            if (!($subnet->ddns_options->send_updates->isEqual('1')) &&
+                !($suffix->isEmpty()) && !str_ends_with($suffix->getValue(), '.')) {
+                $messages->appendMessage(
+                    new Message(
+                        gettext('DDNS qualifying suffix must end with a dot.'),
+                        $subnet->__reference . '.ddns_options.qualifying_suffix'
+                    )
+                );
+            }
+        }
+
         return $messages;
     }
 
@@ -175,6 +193,21 @@ private function getConfigSubnets()
                 'pools' => [],
                 'reservations' => []
             ];
+
+            // Conditionally include DDNS settings only when send-updates is enabled,
+            // and only include fields that have meaningful values.;
+            if ($subnet->ddns_options->send_updates->isEqual('1')) {
+                $record['ddns-send-updates'] = true;
+                if (!($subnet->ddns_options->qualifying_suffix->isEmpty())) {
+                    $record['ddns-qualifying-suffix'] = $subnet->ddns_options->qualifying_suffix->getValue();
+                }
+                if ($subnet->ddns_options->update_on_renew->isEqual('1')) {
+                    $record['ddns-update-on-renew'] = true;
+                }
+                if (!($subnet->ddns_options->conflict_resolution_mode->isEmpty())) {
+                    $record['ddns-conflict-resolution-mode'] = $subnet->ddns_options->conflict_resolution_mode->getValue();
+                }
+            }
             /* add pools */
             foreach (array_filter(explode("\n", $subnet->pools->getValue())) as $pool) {
                 $record['pools'][] = ['pool' => $pool];
@@ -237,6 +270,11 @@ public function generateConfig($target = '/usr/local/etc/kea/kea-dhcp4.conf')
                     'socket-type' => 'unix',
                     'socket-name' => '/var/run/kea/kea4-ctrl-socket'
                 ],
+                'dhcp-ddns' => [
+                    'enable-updates' => false,
+                    'server-ip' => '127.0.0.1',
+                    'server-port' => 53001,
+                ],
                 'loggers' => [
                     [
                         'name' => 'kea-dhcp4',
@@ -255,6 +293,14 @@ public function generateConfig($target = '/usr/local/etc/kea/kea-dhcp4.conf')
         if ($expiredLeasesConfig !== null) {
             $cnf['Dhcp4']['expired-leases-processing'] = $expiredLeasesConfig;
         }
+
+        foreach ($this->subnets->subnet4->iterateItems() as $subnet) {
+            if ($subnet->ddns_options->send_updates->isEqual('1')) {
+                $cnf['Dhcp4']['dhcp-ddns']['enable-updates'] = true;
+                break;
+            }
+        }
+
         if (!(new KeaCtrlAgent())->general->enabled->isEmpty()) {
             $cnf['Dhcp4']['hooks-libraries'] = [];
             $cnf['Dhcp4']['hooks-libraries'][] = [
diff --git a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
index a5139f3012d..cb230369691 100644
--- a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
+++ b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv4.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/Kea/dhcp4</mount>
-    <version>1.0.4</version>
+    <version>1.0.5</version>
     <description>Kea DHCPv4 configuration</description>
     <items>
         <general>
@@ -136,6 +136,21 @@
                 <pools type=".\KeaPoolsField">
                 </pools>
                 <description type="DescriptionField"/>
+                <ddns_options>
+                    <send_updates type="BooleanField"/>
+                    <update_on_renew type="BooleanField"/>
+                    <qualifying_suffix type="HostnameField"/>
+                    <conflict_resolution_mode type="OptionField">
+                        <Default>check-with-dhcid</Default>
+                        <Required>Y</Required>
+                        <OptionValues>
+                            <check-with-dhcid>check-with-dhcid</check-with-dhcid>
+                            <no-check-with-dhcid>no-check-with-dhcid</no-check-with-dhcid>
+                            <check-exists-with-dhcid>check-exists-with-dhcid</check-exists-with-dhcid>
+                            <no-check-without-dhcid>no-check-without-dhcid</no-check-without-dhcid>
+                        </OptionValues>
+                    </conflict_resolution_mode>
+                </ddns_options>
             </subnet4>
         </subnets>
         <reservations>
diff --git a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php
index d8d5a746e5d..0a4a9a981ff 100644
--- a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php
+++ b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.php
@@ -72,6 +72,23 @@ public function performValidation($validateFullModel = false)
             }
         }
 
+        // Enforce that ddns qualifying suffix ends with a dot when set
+        foreach ($this->subnets->subnet6->iterateItems() as $subnet) {
+            if (!$validateFullModel && !$subnet->isFieldChanged()) {
+                continue;
+            }
+            $suffix = $subnet->ddns_options->qualifying_suffix;
+            if ($subnet->ddns_options->send_updates->isEqual('1') &&
+                !($suffix->isEmpty()) && !str_ends_with($suffix->getValue(), '.')) {
+                $messages->appendMessage(
+                    new Message(
+                        gettext('DDNS qualifying suffix must end with a dot.'),
+                        $subnet->__reference . '.ddns_options.qualifying_suffix'
+                    )
+                );
+            }
+        }
+
         return $messages;
     }
 
@@ -129,6 +146,21 @@ private function getConfigSubnets()
                 'pd-pools' => [],
                 'reservations' => []
             ];
+
+            // Conditionally include DDNS settings only when send-updates is enabled,
+            // and only include fields that have meaningful values.
+            if ($subnet->ddns_options->send_updates->isEqual('1')) {
+                $record['ddns-send-updates'] = true;
+                if (!($subnet->ddns_options->qualifying_suffix->isEmpty())) {
+                    $record['ddns-qualifying-suffix'] = $subnet->ddns_options->qualifying_suffix->getValue();
+                }
+                if ($subnet->ddns_options->update_on_renew->isEqual('1')) {
+                    $record['ddns-update-on-renew'] = true;
+                }
+                if (!($subnet->ddns_options->conflict_resolution_mode->isEmpty())) {
+                    $record['ddns-conflict-resolution-mode'] = $subnet->ddns_options->conflict_resolution_mode->getValue();
+                }
+            }
             $if = $subnet->interface->getValue();
             if (isset($cfg->interfaces->$if) && !empty($cfg->interfaces->$if->if)) {
                 $record['interface'] = (string)$cfg->interfaces->$if->if;
@@ -223,6 +255,11 @@ public function generateConfig($target = '/usr/local/etc/kea/kea-dhcp6.conf')
                     'socket-type' => 'unix',
                     'socket-name' => '/var/run/kea/kea6-ctrl-socket'
                 ],
+                'dhcp-ddns' => [
+                    'enable-updates' => false,
+                    'server-ip' => '127.0.0.1',
+                    'server-port' => 53001,
+                ],
                 'loggers' => [
                     [
                         'name' => 'kea-dhcp6',
@@ -241,6 +278,14 @@ public function generateConfig($target = '/usr/local/etc/kea/kea-dhcp6.conf')
         if ($expiredLeasesConfig !== null) {
             $cnf['Dhcp6']['expired-leases-processing'] = $expiredLeasesConfig;
         }
+
+        foreach ($this->subnets->subnet6->iterateItems() as $subnet) {
+            if ($subnet->ddns_options->send_updates->isEqual('1')) {
+                $cnf['Dhcp6']['dhcp-ddns']['enable-updates'] = true;
+                break;
+            }
+        }
+
         if (!(new KeaCtrlAgent())->general->enabled->isEmpty()) {
             $cnf['Dhcp6']['hooks-libraries'] = [];
             $cnf['Dhcp6']['hooks-libraries'][] = [
diff --git a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.xml b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.xml
index 34ffa71e4cf..8a14c22c541 100644
--- a/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.xml
+++ b/src/opnsense/mvc/app/models/OPNsense/Kea/KeaDhcpv6.xml
@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/Kea/dhcp6</mount>
-    <version>1.0.0</version>
+    <version>1.0.1</version>
     <description>Kea DHCPv6 configuration</description>
     <items>
         <general>
@@ -105,6 +105,21 @@
                     <Required>Y</Required>
                 </interface>
                 <description type="DescriptionField"/>
+                <ddns_options>
+                    <send_updates type="BooleanField"/>
+                    <update_on_renew type="BooleanField"/>
+                    <qualifying_suffix type="HostnameField"/>
+                    <conflict_resolution_mode type="OptionField">
+                        <Default>check-with-dhcid</Default>
+                        <Required>Y</Required>
+                        <OptionValues>
+                            <check-with-dhcid>check-with-dhcid</check-with-dhcid>
+                            <no-check-with-dhcid>no-check-with-dhcid</no-check-with-dhcid>
+                            <check-exists-with-dhcid>check-exists-with-dhcid</check-exists-with-dhcid>
+                            <no-check-without-dhcid>no-check-without-dhcid</no-check-without-dhcid>
+                        </OptionValues>
+                    </conflict_resolution_mode>
+                </ddns_options>
             </subnet6>
         </subnets>
         <reservations>
diff --git a/src/opnsense/mvc/app/models/OPNsense/Kea/Menu/Menu.xml b/src/opnsense/mvc/app/models/OPNsense/Kea/Menu/Menu.xml
index 3aa4d72fe2e..860c30b9fe5 100644
--- a/src/opnsense/mvc/app/models/OPNsense/Kea/Menu/Menu.xml
+++ b/src/opnsense/mvc/app/models/OPNsense/Kea/Menu/Menu.xml
@@ -4,6 +4,7 @@
             <ControlAgent order="5" VisibleName="Control Agent" url="/ui/kea/dhcp/ctrl_agent"/>
             <Keav4 order="10" VisibleName="Kea DHCPv4" url="/ui/kea/dhcp/v4"/>
             <Keav6 order="20" VisibleName="Kea DHCPv6" url="/ui/kea/dhcp/v6"/>
+            <KeaDdns order="30" VisibleName="Kea DHCP DDNS" url="/ui/kea/dhcp/ddns"/>
             <Leases4 order="50" VisibleName="Leases DHCPv4" url="/ui/kea/dhcp/leases4"/>
             <Leases6 order="60" VisibleName="Leases DHCPv6" url="/ui/kea/dhcp/leases6"/>
             <LogFile order="100" VisibleName="Log File" url="/ui/diagnostics/log/core/kea"/>
diff --git a/src/opnsense/mvc/app/views/OPNsense/Kea/dhcp_ddns.volt b/src/opnsense/mvc/app/views/OPNsense/Kea/dhcp_ddns.volt
new file mode 100644
index 00000000000..67b3a04a255
--- /dev/null
+++ b/src/opnsense/mvc/app/views/OPNsense/Kea/dhcp_ddns.volt
@@ -0,0 +1,111 @@
+{#
+ # Copyright (C) 2025 Yip Rui Fung <rf@yrf.me>
+ #
+ # Redistribution and use in source and binary forms, with or without modification,
+ # are permitted provided that the following conditions are met:
+ #
+ # 1. Redistributions of source code must retain the above copyright notice,
+ #    this list of conditions and the following disclaimer.
+ #
+ # 2. Redistributions in binary form must reproduce the above copyright notice,
+ #    this list of conditions and the following disclaimer in the documentation
+ #    and/or other materials provided with the distribution.
+ #
+ # THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ # AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ # AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ # POSSIBILITY OF SUCH DAMAGE.
+ #}
+
+<script>
+    $( document ).ready(function() {
+        const data_get_map = {'frm_generalsettings':"/api/kea/dhcpddns/get"};
+        mapDataToFormUI(data_get_map).done(function(data){
+            updateServiceControlUI('kea');
+        });
+
+        $("#{{formGridForwardDomain['table_id']}}" ).UIBootgrid(
+            {   search:'/api/kea/dhcpddns/search_forward_domain',
+                get:'/api/kea/dhcpddns/get_forward_domain/',
+                set:'/api/kea/dhcpddns/set_forward_domain/',
+                add:'/api/kea/dhcpddns/add_forward_domain/',
+                del:'/api/kea/dhcpddns/del_forward_domain/'
+            }
+        );
+
+        $("#{{formGridReverseDomain['table_id']}}" ).UIBootgrid(
+            {   search:'/api/kea/dhcpddns/search_reverse_domain',
+                get:'/api/kea/dhcpddns/get_reverse_domain/',
+                set:'/api/kea/dhcpddns/set_reverse_domain/',
+                add:'/api/kea/dhcpddns/add_reverse_domain/',
+                del:'/api/kea/dhcpddns/del_reverse_domain/'
+            }
+        );
+
+        $("#{{formGridTsigKey['table_id']}}" ).UIBootgrid(
+            {   search:'/api/kea/dhcpddns/search_tsig_key',
+                get:'/api/kea/dhcpddns/get_tsig_key/',
+                set:'/api/kea/dhcpddns/set_tsig_key/',
+                add:'/api/kea/dhcpddns/add_tsig_key/',
+                del:'/api/kea/dhcpddns/del_tsig_key/'
+            }
+        );
+
+        $("#{{formGridDnsServer['table_id']}}" ).UIBootgrid(
+            {   search:'/api/kea/dhcpddns/search_dns_server',
+                get:'/api/kea/dhcpddns/get_dns_server/',
+                set:'/api/kea/dhcpddns/set_dns_server/',
+                add:'/api/kea/dhcpddns/add_dns_server/',
+                del:'/api/kea/dhcpddns/del_dns_server/'
+            }
+        );
+
+        $("#reconfigureAct").SimpleActionButton({
+            onPreAction: function() {
+                const dfObj = new $.Deferred();
+                saveFormToEndpoint("/api/kea/dhcpddns/set", 'frm_generalsettings', function () { dfObj.resolve(); }, true, function () { dfObj.reject(); });
+                return dfObj;
+            },
+            onAction: function(data, status) {
+                updateServiceControlUI('kea');
+            }
+        });
+    });
+</script>
+
+<ul class="nav nav-tabs" data-tabs="tabs" id="maintabs">
+    <li class="active"><a data-toggle="tab" href="#settings" id="tab_settings">{{ lang._('Settings') }}</a></li>
+    <li><a data-toggle="tab" href="#forward-domains" id="tab_forward"> {{ lang._('Forward Domains') }} </a></li>
+    <li><a data-toggle="tab" href="#reverse-domains" id="tab_reverse"> {{ lang._('Reverse Domains') }} </a></li>
+    <li><a data-toggle="tab" href="#tsig-keys" id="tab_tsig"> {{ lang._('TSIG Keys') }} </a></li>
+    <li><a data-toggle="tab" href="#dns-servers" id="tab_dns"> {{ lang._('DNS Servers') }} </a></li>
+    </ul>
+<div class="tab-content content-box">
+    <div id="settings"  class="tab-pane fade in active">
+        {{ partial("layout_partials/base_form",['fields':formGeneralSettings,'id':'frm_generalsettings'])}}
+    </div>
+    <div id="forward-domains" class="tab-pane fade in">
+        {{ partial('layout_partials/base_bootgrid_table', formGridForwardDomain)}}
+    </div>
+    <div id="reverse-domains" class="tab-pane fade in">
+        {{ partial('layout_partials/base_bootgrid_table', formGridReverseDomain)}}
+    </div>
+    <div id="tsig-keys" class="tab-pane fade in">
+        {{ partial('layout_partials/base_bootgrid_table', formGridTsigKey)}}
+    </div>
+    <div id="dns-servers" class="tab-pane fade in">
+        {{ partial('layout_partials/base_bootgrid_table', formGridDnsServer)}}
+    </div>
+</div>
+
+{{ partial('layout_partials/base_apply_button', {'data_endpoint': '/api/kea/service/reconfigure'}) }}
+{{ partial("layout_partials/base_dialog",['fields':formDialogForwardDomain,'id':formGridForwardDomain['edit_dialog_id'],'label':lang._('Edit Forward Domain')])}}
+{{ partial("layout_partials/base_dialog",['fields':formDialogReverseDomain,'id':formGridReverseDomain['edit_dialog_id'],'label':lang._('Edit Reverse Domain')])}}
+{{ partial("layout_partials/base_dialog",['fields':formDialogTsigKey,'id':formGridTsigKey['edit_dialog_id'],'label':lang._('Edit TSIG Key')])}}
+{{ partial("layout_partials/base_dialog",['fields':formDialogDnsServer,'id':formGridDnsServer['edit_dialog_id'],'label':lang._('Edit DNS Server')])}}
diff --git a/src/opnsense/service/templates/OPNsense/Kea/keactrl.conf b/src/opnsense/service/templates/OPNsense/Kea/keactrl.conf
index bf8bc80986b..cd2f71867cc 100644
--- a/src/opnsense/service/templates/OPNsense/Kea/keactrl.conf
+++ b/src/opnsense/service/templates/OPNsense/Kea/keactrl.conf
@@ -34,7 +34,7 @@ dhcp4={% if not helpers.empty('OPNsense.Kea.dhcp4.general.enabled') %}yes{% else
 dhcp6={% if not helpers.empty('OPNsense.Kea.dhcp6.general.enabled') %}yes{% else %}no{% endif %}
 
 # Start DHCP DDNS server?
-dhcp_ddns=no
+dhcp_ddns={% if not helpers.empty('OPNsense.Kea.dhcp_ddns.general.enabled') %}yes{% else %}no{% endif %}
 
 # Start Control Agent?
 ctrl_agent={% if not helpers.empty('OPNsense.Kea.ctrl_agent.general.enabled') %}yes{% else %}no{% endif %}