Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- After recent US shenanigans why would you spend effort to migrate to yet another Five Eyes controlled service, especially if they do the full "privacy from Germany" circus.
What kind of security threat does a migration to such a service actually mitigate?
If they were truly a "sovereign EU" kind of project then they'd be on .eu domain, not have security advisors from Virginia, and so on.
Nevertheless it's good to see that the decoupling-from-your-allies movement that US citizens have initiated is so scary that they have to set up these kind of fake EU alternatives with some local figureheads.
by bflesch - Is this somehow related to the other post about another service shutting down its encrypted DNS?
https://news.ycombinator.com/item?id=49568579
Weird timing?
by lacoolj - These are completely different types of services. One is a DoH recursive DNS resolver for use by clients. The other is a DNSSEC enabled DNS hosting provider for domain owners. The encryption in use is completely different with different goals.by Arrowmaster
- I have been using deSEC for a couple of years without any issues. I mostly just do not want my DNS handled by my registrar so that I can easily transfer domains without worrying about DNS as well, and I do not like how centralized the internet is becoming around Cloudflare.
- Happy deSec user, use them for all my domains. Had quick thoughtful replies from Peter if I had any questions.by 8by3
- Homepage looks busted on Orion iOS. Signup form has you entering your email address within the yellow “Create Account” button.by iAMkenough
- I was pleased to discover that a Terraform/OpenTofu provider is available.
https://registry.terraform.io/providers/Valodim/desec/latest
by chaz6 - I literally just switched away from Hurricane Electric to deSEC. The only real issue that I had with HE, but it's a big one, is that they don't allow wildcard CNAMEs. I consider that important for the security of some sensitive endpoints that I have no choice but to expose publicly. Those endpoints are well protected with 2FA and heavily monitored, but I wanted to be able to use randomized subdomains to at least have some obfuscation on top.by TheBozzCL
- Recently migrated to deSEC, great experience so far, except for hitting the API rate limit when using Tofu to plan and apply changes with around a 100 domains. For now I'm using `-parallelism=1` which seems to work.by aequitas
- How did you get access to 100 domains on there?by hexfish
- We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.by Stitch4223
- > We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC.
I mean, if your definition of "affordable" is free, then sure.
But for the record there are other affordable EU suppliers who do DNSSEC:
[0] https://bunny.net/dns/ [1] https://www.rcodezero.at/solutions/enterprise [2] https://www.netnod.se/dns/find-a-partner- Bunny DNS[0] is "free" – i.e. only subject to their minimum $1/month account spend fee. - RcodeZero is very affordable[1] plus added bonus it is run by the `.at` registry so the infrastructure is solid – business customers only, no private individuals - Netnod (only via resellers[2] unless you are a big company or government) – Netnod host the I Root Servers and their public hosting DNSSEC service will soon feature HSM-bound DNSSEC keysby traceroute66 - DNSSEC support is an anti-feature, it is dead/dying and the faster we can unburden ourselves from it the faster we can move on to better solutions.by dsl
- When I last tried deSEC, the service was reliable and well worth the price of admission, but the web UI and API were both quite rough, and propagation tended to be quite slow. It was annoying to do an ACME DNS01 challenge on it, for example. IIRC, the API didn't have a complete set of replace/edit endpoints, so even DNSControl (https://github.com/DNSControl/dnscontrol) would leave records nonexistent for a while while during updates.
As an aside (though this certainly applies to deSEC) it's strange to me how so many DNS services (free or paid) struggle to import simple Bind zone files, often either giving a vague error ("one or more records could not be imported"), mangling records, or even just silently omitting records. Parsing a zone file has some gotchas, but it doesn't seem like it should be that hard.
by zetanor - I wrote a little cli to import a zone file into deSEC: https://git.sr.ht/~whynothugo/zone2desec
I can also show a delta when you've made changes and asks for confirmation before applying.
by WhyNotHugo - > well worth the price of admission
A strange thing to say about something that is free
by dzogchen - > though this certainly applies to deSEC) it's strange to me how so many DNS services (free or paid) struggle to import simple Bind zone files,
In deSEC's GUI, when you add a domain, you can expand an "Advanced" section and paste your zonefile.
You can do the same via the REST API using the "zonefile" parameter in your request.
> often either giving a vague error ("one or more records could not be imported"),
When there's an issue, the response will tell you which line it was. Perhaps that can be improved - we'd appreciate feature requests about that.
> just silently omitting records
We omit records that we manage ourselves, that is: SOA, NS, DNSKEY, RRSIG. Everything else is retained, and in fact deSEC has unusually broad record type support (see https://desec.readthedocs.io/en/latest/dns/rrsets.html#recor...).
(Disclosure: I'm CTO at deSEC.)
- I signed up and saw they only allowed a single subdomain for DDNS, with docs saying to contact support if you needed more. I emailed asking for just 1 more subdomain and support told me that for my usecase I should just use CloudFlare.
So I did. No silly miniscule restrictions.
by awill - Similar story: asked for an increase and got told
> […] our mission is to improve Internet security by increasing the adoption of DNSSEC. [We therefore expect users to enable DNSSEC for their domains.
> Would you be willing to do that?
Wanting to increase the adoption of DNSSEC is fair, but couldn’t this be all self-serve? It’s almost as if they don’t want people to use them.
by boramalper - > support told me that for my usecase I should just use CloudFlare
Not true. When users ask for multiple domains under .dedyn.io, we send them the following text:
> Unfortunately, deSEC accounts are limited to 1 .dedyn.io domain. > > However, you can create additional subdomains under your existing domain, by creating a record in our web interface and putting the subdomain name into the "subname" field. For example, if you have domain.dedyn.io, and you create a record with "subname: internal", then the record will apply to internal.domain.dedyn.io. > > You can also purchase another domain elsewhere, and then bring it to deSEC for DNS hosting. Please let me know if you would like to go that route. > > Does that help?
(Disclosure: I'm CTO at deSEC.)
- I had this issue with cloudns and a single record with an IPv4 and IPv6 address. They only allowed one free ddns record which covered exactly one protocol. On top of that, they added records to resolve unknown names for advertising purposes.
I get that it costs money to run a DNS service but it seems like it should be a lot cheaper at scale than a lot of companies are providing.
- I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain. This means I have a VM running "service1.foo.example.com" which is not publicly available but can still get certs from letsencrypt, but with a token that can't be used to issue certs for other domains.
It works great!
by dmm