deSEC – Free Secure DNS

deSEC offers a free, secure, and open-source DNS hosting service, prioritizing DNSSEC adoption and privacy from its non-profit base in Berlin. It touts modern features like cloud integration, extensive record types, and global anycast, aiming to make advanced DNS security accessible. However, the Hacker News community probes its sustainability as a free service, debates DNSSEC's true value, and points out specific usability quirks and feature limitations.

Score

Comments

Highest Rank

12h

on Front Page

First Seen

Sep 4, 5:00 PM

Last Seen

Sep 5, 4:00 AM

Rank Over Time

The Lowdown

deSEC positions itself as a free, secure, and open-source DNS hosting service, operated by a non-profit organization based in Berlin. Its core mission revolves around enhancing internet security by promoting the widespread adoption of DNSSEC, which is always enabled for domains hosted on their platform. The service highlights its commitment to open standards and privacy, claiming to operate without business interests compromising user data.

Key features and aspects of deSEC include:

Mandatory DNSSEC: All hosted DNS information is signed with DNSSEC using state-of-the-art elliptic-curve cryptography.
Cloud Integration & APIs: Offers seamless integration with cloud environments via Terraform providers and language bindings (Go, Python, JavaScript), along with a robust REST API for full control and automation.
Modern Record Types: Supports a broad array of contemporary record types, including HTTPS/SVCB, CDNSKEY/CDS, OPENPGPKEY, SMIMEA, and TLSA.
User Interfaces: Provides a web interface with real-time record validation and a well-documented API for advanced features.
Security & Reliability: Features Multi-Factor Authentication (TOTP, WebAuthn in development), fast global updates, and low-latency Anycast via a globally distributed network.
DANE & Let's Encrypt: Facilitates DANE (DNS-based Authentication of Named Entities) via TLSA and OPENPGPKEY records, and offers easy integration with Let's Encrypt for certificate management.
Non-profit & Open Source: Operates as a non-profit, running 100% on free and open-source software, with support from organizations like ICANN, NLnet Foundation, and RIPE NCC.

In essence, deSEC aims to provide a technologically advanced, privacy-focused, and accessible DNS hosting solution, underpinned by open-source principles and a non-profit structure to ensure its security and integrity are not swayed by commercial pressures.

The Gossip

Funding Freebies: Fiscal Fitness & Five Eyes Follies

A significant thread explored the financial viability of a free, non-profit DNS service and the implications of its funding and jurisdiction. Skepticism arose regarding how deSEC sustains itself without revenue, with some users questioning its independence from 'Five Eyes' nations, despite its Berlin-based non-profit status. Conversely, supporters lauded it as a rare, affordable EU-based option for secure DNSSEC, implying its non-profit model might be an advantage for privacy.

Operational Obstacles & API Annoyances

Users recounted various practical challenges and limitations encountered with deSEC. Past experiences cited a 'rough' web UI, API, and slow propagation, particularly hindering ACME DNS-01 challenges. Specific feature gaps were noted, such as the lack of AXFR support, though the project's openness to contributions was acknowledged. Other pain points included hitting API rate limits for bulk domain operations and strict, 'minuscule' restrictions on subdomain counts for DDNS, leading some to seek alternatives.

DNSSEC's Doomed or Desired Destiny

The discussion dove into the perennial debate surrounding DNSSEC itself. While deSEC champions DNSSEC adoption as a cornerstone of internet security, some commenters voiced strong opinions that DNSSEC is an 'anti-feature' or 'dead/dying,' citing historical criticisms of its complexity and limited real-world benefits. In contrast, others enthusiastically recommended deSEC precisely because it makes state-of-the-art secure DNSSEC both accessible and affordable within the EU.

Distinguishing DNS Deployments

A subset of the conversation focused on clarifying deSEC's role as an authoritative DNS service, which hosts and publishes DNS records for domains. This clarification was necessary as some users initially suggested using recursive resolvers like Unbound as alternatives. Commenters explained the fundamental difference between an authoritative server (like deSEC, or BIND) that provides the 'source of truth' for DNS records, and a recursive resolver that fetches and caches these records for clients.