deSEC – Free Secure DNS(desec.io) |
deSEC – Free Secure DNS(desec.io) |
It works great!
So I did. No silly miniscule restrictions.
Not true. When users ask for multiple domains under .dedyn.io, we send them the following text:
> Unfortunately, deSEC accounts are limited to 1 .dedyn.io domain. > > However, you can create additional subdomains under your existing domain, by creating a record in our web interface and putting the subdomain name into the "subname" field. For example, if you have domain.dedyn.io, and you create a record with "subname: internal", then the record will apply to internal.domain.dedyn.io. > > You can also purchase another domain elsewhere, and then bring it to deSEC for DNS hosting. Please let me know if you would like to go that route. > > Does that help?
(Disclosure: I'm CTO at deSEC.)
I get that it costs money to run a DNS service but it seems like it should be a lot cheaper at scale than a lot of companies are providing.
doubt
> […] our mission is to improve Internet security by increasing the adoption of DNSSEC. [We therefore expect users to enable DNSSEC for their domains.
> Would you be willing to do that?
Wanting to increase the adoption of DNSSEC is fair, but couldn’t this be all self-serve? It’s almost as if they don’t want people to use them.
https://registry.terraform.io/providers/Valodim/desec/latest
As an aside (though this certainly applies to deSEC) it's strange to me how so many DNS services (free or paid) struggle to import simple Bind zone files, often either giving a vague error ("one or more records could not be imported"), mangling records, or even just silently omitting records. Parsing a zone file has some gotchas, but it doesn't seem like it should be that hard.
In deSEC's GUI, when you add a domain, you can expand an "Advanced" section and paste your zonefile.
You can do the same via the REST API using the "zonefile" parameter in your request.
> often either giving a vague error ("one or more records could not be imported"),
When there's an issue, the response will tell you which line it was. Perhaps that can be improved - we'd appreciate feature requests about that.
> just silently omitting records
We omit records that we manage ourselves, that is: SOA, NS, DNSKEY, RRSIG. Everything else is retained, and in fact deSEC has unusually broad record type support (see https://desec.readthedocs.io/en/latest/dns/rrsets.html#recor...).
(Disclosure: I'm CTO at deSEC.)
A strange thing to say about something that is free
I can also show a delta when you've made changes and asks for confirmation before applying.
https://news.ycombinator.com/item?id=49568579
Weird timing?
It looks like they are open to adding the feature and open to outside contributions: https://github.com/desec-io/desec-stack/issues/579
What kind of security threat does a migration to such a service actually mitigate?
If they were truly a "sovereign EU" kind of project then they'd be on .eu domain, not have security advisors from Virginia, and so on.
Nevertheless it's good to see that the decoupling-from-your-allies movement that US citizens have initiated is so scary that they have to set up these kind of fake EU alternatives with some local figureheads.
I mean, if your definition of "affordable" is free, then sure.
But for the record there are other affordable EU suppliers who do DNSSEC:
- Bunny DNS[0] is "free" – i.e. only subject to their minimum $1/month account spend fee.
- RcodeZero is very affordable[1] plus added bonus it is run by the `.at` registry so the infrastructure is solid – business customers only, no private individuals
- Netnod (only via resellers[2] unless you are a big company or government) – Netnod host the I Root Servers and their public hosting DNSSEC service will soon feature HSM-bound DNSSEC keys
Netnod.se uses a DNSKEY that is too small on their main domain.
Rcodezero.at might indeed be something. Thanks.
We donate to deSEC, so it’s not free for us.
Looks like it's the glue records that point to the actual server?
This is fixed now, I'll look into why the monitoring tools didn't catch this one as they should have.
Interesting, could you expand on that ?
I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ?
[1] https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se
Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength.
Verisign does check for key validity but not for key strength / length as seen in your link.
[1] https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176
DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents.
We have since committed entirely to transport security in the form of DoH and friends. It solves the vast majority of problems we actually have.