deSEC – Free Secure DNS (desec.io)

122 pointsby gurjeet13 hours ago42 comments

dmm 6 hours ago

I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain. This means I have a VM running "service1.foo.example.com" which is not publicly available but can still get certs from letsencrypt, but with a token that can't be used to issue certs for other domains.

It works great!

awill 11 hours ago

I signed up and saw they only allowed a single subdomain for DDNS, with docs saying to contact support if you needed more. I emailed asking for just 1 more subdomain and support told me that for my usecase I should just use CloudFlare.

So I did. No silly miniscule restrictions.

boramalper 11 hours ago

Similar story: asked for an increase and got told

> […] our mission is to improve Internet security by increasing the adoption of DNSSEC. [We therefore expect users to enable DNSSEC for their domains.

> Would you be willing to do that?

Wanting to increase the adoption of DNSSEC is fair, but couldn’t this be all self-serve? It’s almost as if they don’t want people to use them.

8by3 10 hours ago

They've actually just done that, your limit automatically gets increased if all your domains are secured.

boramalper 9 hours ago

That’s good to know! I was actually very excited when I first found them; I was surprised that there aren’t many free/open public DNS hosting services.

imoverclocked 7 hours ago

I had this issue with cloudns and a single record with an IPv4 and IPv6 address. They only allowed one free ddns record which covered exactly one protocol. On top of that, they added records to resolve unknown names for advertising purposes.

I get that it costs money to run a DNS service but it seems like it should be a lot cheaper at scale than a lot of companies are providing.

zetanor 10 hours ago

When I last tried deSEC, the service was reliable and well worth the price of admission, but the web UI and API were both quite rough, and propagation tended to be quite slow. It was annoying to do an ACME DNS01 challenge on it, for example. IIRC, the API didn't have a complete set of replace/edit endpoints, so even DNSControl (https://github.com/DNSControl/dnscontrol) would leave records nonexistent for a while while during updates.

As an aside (though this certainly applies to deSEC) it's strange to me how so many DNS services (free or paid) struggle to import simple Bind zone files, often either giving a vague error ("one or more records could not be imported"), mangling records, or even just silently omitting records. Parsing a zone file has some gotchas, but it doesn't seem like it should be that hard.

dzogchen 6 hours ago

> well worth the price of admission

A strange thing to say about something that is free

WhyNotHugo 5 hours ago

I wrote a little cli to import a zone file into deSEC: https://git.sr.ht/~whynothugo/zone2desec

I can also show a delta when you've made changes and asks for confirmation before applying.

Stitch4223 11 hours ago

We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.

traceroute66 11 hours ago

> We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC.

I mean, if your definition of "affordable" is free, then sure.

But for the record there are other affordable EU suppliers who do DNSSEC:

    - Bunny DNS[0] is "free" – i.e. only subject to their minimum $1/month account spend fee.
    - RcodeZero is very affordable[1] plus added bonus it is run by the `.at` registry so the infrastructure is solid – business customers only, no private individuals
    - Netnod (only via resellers[2] unless you are a big company or government) – Netnod host the I Root Servers and their public hosting DNSSEC service will soon feature HSM-bound DNSSEC keys

[0] https://bunny.net/dns/ [1] https://www.rcodezero.at/solutions/enterprise [2] https://www.netnod.se/dns/find-a-partner

amaccuish 10 hours ago

One who doesn't is frustratingly Hetzner.

quicksilver03 10 hours ago

I happen to run an affordable EU supplier who does DNSSEC, and also AXFR (incoming and outgoing). I offer a free plan from time to time, but not at the moment to preserve resources for paying customer.

https://www.ptrdns.net/

andreaso 9 hours ago

Are you aware that the child zone A(AAAA) records for danube.ns.ptrdns.net differs from the parent zone A(AAA) glue records for danube.ns.ptrdns.net?

Looks like it's the glue records that point to the actual server?

Stitch4223 7 hours ago

We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider, as we have a deadline to comply with at the end of this month. I don’t know what the issue is off the top of my head.

Netnod.se uses a DNSKEY that is too small on their main domain.

Rcodezero.at might indeed be something. Thanks.

We donate to deSEC, so it’s not free for us.

traceroute66 6 hours ago

> Netnod.se uses a DNSKEY that is too small on their main domain.

Interesting, could you expand on that ?

I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ?

[1] https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se

Stitch4223 3 hours ago

Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3]

Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength.

Verisign does check for key validity but not for key strength / length as seen in your link.

[1] https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176

dsl 11 hours ago

DNSSEC support is an anti-feature, it is dead/dying and the faster we can unburden ourselves from it the faster we can move on to better solutions.

https://sockpuppet.org/blog/2015/01/15/against-dnssec/

apefulsin 10 hours ago

So DNS should be open to MITM attackers?

icedchai 7 hours ago

Even with DNSSEC, it still is. Example: https://blog.cloudflare.com/de-tld-outage-dnssec/

digitalPhonix 2 hours ago

Did you read the article? It's saying that DNSSEC as an implementation to prevent MITM is flawed; other solutions that protect against MITM are proposed.

teddyh 9 hours ago

Rebuttal: <https://easydns.com/blog/2015/08/06/for-dnssec/>

dsl 7 hours ago

That rebuttal held water 10 years ago, but fortunately we have made a lot of advancements since then.

DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents.

We have since committed entirely to transport security in the form of DoH and friends. It solves the vast majority of problems we actually have.

Stitch4223 8 hours ago

Such as? And do those solve the same thing? The post lists 8 headlines why it should be abolished.

aequitas 11 hours ago

Recently migrated to deSEC, great experience so far, except for hitting the API rate limit when using Tofu to plan and apply changes with around a 100 domains. For now I'm using `-parallelism=1` which seems to work.

TheBozzCL 7 hours ago

I literally just switched away from Hurricane Electric to deSEC. The only real issue that I had with HE, but it's a big one, is that they don't allow wildcard CNAMEs. I consider that important for the security of some sensitive endpoints that I have no choice but to expose publicly. Those endpoints are well protected with 2FA and heavily monitored, but I wanted to be able to use randomized subdomains to at least have some obfuscation on top.

8by3 10 hours ago

Happy deSec user, use them for all my domains. Had quick thoughtful replies from Peter if I had any questions.

MattTheRealOne 9 hours ago

I have been using deSEC for a couple of years without any issues. I mostly just do not want my DNS handled by my registrar so that I can easily transfer domains without worrying about DNS as well, and I do not like how centralized the internet is becoming around Cloudflare.

lacoolj 9 hours ago

Is this somehow related to the other post about another service shutting down its encrypted DNS?

https://news.ycombinator.com/item?id=49568579

Weird timing?

anonymousiam 11 hours ago

Seems legit, but how can I trust them to survive if they're not collecting revenue?

bflesch 11 hours ago

Some of them are located in Virginia, don't worry they'll be funded forever.

iAMkenough 10 hours ago

Homepage looks busted on Orion iOS. Signup form has you entering your email address within the yellow “Create Account” button.

ak4153 11 hours ago

Just use unbound

0l 11 hours ago

Completely different thing

thesuitonym 11 hours ago

What is this if not a DNS service?

pacija 11 hours ago

Unbound is caching, not authoritative. Zones with dns records are served from authoritative DNS servers such as bind. Unbound asks authoritative servers for records and caches them locally, giving faster response and reducing load on authoritative servers.

pacija 11 hours ago

Just use bind :)

craftkiller 10 hours ago

My solution was to self-host PowerDNS and then sign up for the free DNS mirroring from hurricane electric. That way, I can administer my DNS records any way I want (these days I usually just manually edit PowerDNS's sqlite database) and if/when my PowerDNS server goes down, hurricane electric is still serving my records so the domain keeps resolving fine.

cyberax 11 hours ago

Does not support AXFR :(

8organicbits 11 hours ago

That's a bummer.

It looks like they are open to adding the feature and open to outside contributions: https://github.com/desec-io/desec-stack/issues/579

mhmdfromkarak 9 hours ago

do what's best.

bflesch 10 hours ago

After recent US shenanigans why would you spend effort to migrate to yet another Five Eyes controlled service, especially if they do the full "privacy from Germany" circus.

What kind of security threat does a migration to such a service actually mitigate?

If they were truly a "sovereign EU" kind of project then they'd be on .eu domain, not have security advisors from Virginia, and so on.

Nevertheless it's good to see that the decoupling-from-your-allies movement that US citizens have initiated is so scary that they have to set up these kind of fake EU alternatives with some local figureheads.