diff --git a/boot/master.js b/boot/master.js
index c8dfedc..b4aa74b 100644
--- a/boot/master.js
+++ b/boot/master.js
@@ -46,6 +46,8 @@ cluster.on('online', function (worker) {
   var certPaths = [path.join(__dirname, '..', '..', 'certs', 'live')];
   var info;
   var config = require('../../config');
+  conf.ddns = config.ddns;
+  conf.redirects = config.redirects;
 
   console.info('[MASTER] Worker ' + worker.process.pid + ' is online');
   fork();
@@ -63,6 +65,7 @@ cluster.on('online', function (worker) {
     , ipcKey: null
       // TODO let this load after server is listening
     , redirects: config.redirects
+    , ddns: config.ddns
     }
   };
   worker.send(info);
@@ -90,6 +93,7 @@ cluster.on('online', function (worker) {
       info.conf.privkey = config.privkey;
       info.conf.pubkey = config.pubkey;
       info.conf.redirects = config.redirects;
+      info.conf.ddns = config.ddns;
       worker.send(info);
     });
   }
diff --git a/ddns-redirects.js b/ddns-redirects.js
index 3cf435e..d9f6bbf 100644
--- a/ddns-redirects.js
+++ b/ddns-redirects.js
@@ -34,7 +34,7 @@ require('ipify')(function (err, ip) {
   , port: 65443
   , cacert: path.join(__dirname, 'certs/ca/ns1-test.root.crt.pem')
   , ddns: ddns
-  , token: require('./dyndns-token').token
+  , token: token
   }).then(function (data) {
     if ('string' === typeof data) {
       try {
diff --git a/lib/ddns-updater.js b/lib/ddns-updater.js
index e979341..4c04e92 100644
--- a/lib/ddns-updater.js
+++ b/lib/ddns-updater.js
@@ -3,22 +3,14 @@
 var fs = require('fs');
 var path = require('path');
 var updateIp = require('../holepunch/helpers/update-ip.js').update;
-// TODO XXX use API + storage
-var token = require('../dyndns-token.js').token;
 
 /*
  * @param {string[]} hostnames - A list of hostnames
  * @param {Object[]} addresses - A list of { address: <ip-address>, family: <4|6> }
  */
-function update(hostnames, addresses) {
+function update(services, hostnames, addresses, ddnsToken) {
   // TODO use not-yet-built API to get and store tokens
   // TODO use API to add and remove nameservers
-  var services = [
-    // TODO XXX don't disable cacert checking
-    { hostname: 'ns1.redirect-www.org', port: 6443, cacert: false, pathname: '/api/com.daplie.dns/ddns' }
-  , { hostname: 'ns2.redirect-www.org', port: 6443, cacert: false, pathname: '/api/com.daplie.dns/ddns' }
-  // { cacert = [path.join(__dirname, '..', 'certs', 'ca', 'my-root-ca.crt.pem')] };
-  ];
   var answers = [];
   var promises;
   var results = [];
@@ -31,7 +23,8 @@ function update(hostnames, addresses) {
       , "value": address.address
       , "type": null
       , "priority": null
-      , "token": token
+        // token = require('../dyndns-token.js').token;
+      , "token": ddnsToken
       };
 
       if (4 === address.family) {
@@ -56,7 +49,7 @@ function update(hostnames, addresses) {
     , port: service.port
     , pathname: service.pathname
     , cacert: service.cacert
-    , token: token
+    , token: ddnsToken
     , ddns: answers
     }).then(function (data) {
       results[i] = { service: service, data: data };
@@ -72,33 +65,14 @@ function update(hostnames, addresses) {
   });
 }
 
-module.exports.update = function () {
-  var allMap = {};
-  var hostnames = require('../redirects.json').reduce(function (all, redirect) {
-    if (!allMap[redirect.from.hostname]) {
-      allMap[redirect.from.hostname] = true;
-      all.push(redirect.from.hostname);
-    }
-    if (!all[redirect.to.hostname]) {
-      allMap[redirect.to.hostname] = true;
-      all.push(redirect.to.hostname);
-    }
-
-    return all;
-  }, []);
-  fs.readdirSync(path.join(__dirname, '..', 'vhosts')).forEach(function (node) {
-    if (/^\w.*\..*\w$/.test(node)) {
-      hostnames.push(node);
-    }
-  });
-
+module.exports.update = function (services, hostnames, ddnsToken) {
   return require('./ip-checker').getExternalAddresses().then(function (result) {
     //console.log(Object.keys(allMap), result);
     //console.log(hostnames)
     //console.log(result.addresses);
     console.log('[IP CHECKER] hostnames.length', hostnames.length);
     console.log('[IP CHECKER] result.addresses.length', result.addresses.length);
-    return update(hostnames, result.addresses);
+    return update(services, hostnames, result.addresses, ddnsToken);
   });
 };
 
diff --git a/lib/master.js b/lib/master.js
index 91b28f0..7ee2afb 100644
--- a/lib/master.js
+++ b/lib/master.js
@@ -4,12 +4,27 @@ var cluster = require('cluster');
 var PromiseA = require('bluebird');
 var memstore;
 var sqlstore;
+var config;
 // TODO
 // var rootMasterKey;
 
 function updateIps() {
   console.log('[UPDATE IP]');
-  require('./ddns-updater').update().then(function (results) {
+  var allMap = {};
+  var hostnames = config.redirects.reduce(function (all, redirect) {
+    if (redirect.ip && !allMap[redirect.id]) {
+      allMap[redirect.id] = true;
+      all.push(redirect.id);
+    }
+
+    return all;
+  }, []);
+
+  require('./ddns-updater').update(
+    config.ddns.services
+  , hostnames
+  , config.ddns.token
+  ).then(function (results) {
     results.forEach(function (result) {
       if (result.error) {
         console.error(result);
@@ -24,6 +39,7 @@ function updateIps() {
 }
 
 function init(conf/*, state*/) {
+  config = conf;
   if (!conf.ipcKey) {
     conf.ipcKey = require('crypto').randomBytes(16).toString('base64');
   }
@@ -68,7 +84,7 @@ function init(conf/*, state*/) {
     })
   , sqlite3.createServer({
       verbose: null
-    , sock: conf.sqlite3Sock 
+    , sock: conf.sqlite3Sock
     , ipcKey: conf.ipcKey
     }).then(function (_sqlstore) {
       sqlstore = _sqlstore;