deSEC – Free Secure DNS

Here's the thing about DNS: it's the plumbing of the internet that nobody thinks about until it's leaking. Most people rent their domain management from whatever registrar they bought it from, and those registrars are increasingly happy to sell your query data, push upsells, and generally treat your DNS zone like a billboard. deSEC comes at this from the opposite direction—a project out of Germany, where privacy isn't just a marketing bullet point but a legal requirement. They run on donated infrastructure, they're transparent about their operations, and they've built DNSSEC support in from day one, which is more than you can say for most commercial providers. The technical chops here matter. DNSSEC is one of those protocols everyone agrees we should have and almost nobody actually deploys because it's fiddly and the payoffs are invisible until someone hijacks your domain. deSEC makes it the default, not the afterthought. They've got a clean REST API, dynamic DNS support for homelab nerds, and they don't lock you into their ecosystem—you can take your zone and walk. That's the kind of infrastructure philosophy that used to be standard in open source and now feels almost radical. What's genuinely interesting about the Hacker News reception (130 points, 46 comments at time of writing) is that nobody's shouting about a killer feature. The praise is all "it just works" and "I've been running this for years without issues." In an era where every DNS provider is trying to be a platform, deSEC is content to be a service. That's not flashy, but it's the kind of boring reliability that keeps the internet from falling apart. The real question is sustainability. Free services have a nasty habit of dying when the maintainer gets a job offer or the hosting bill comes due. deSEC is backed by a non-profit and seems to have reasonable funding, but the open source graveyard is full of projects that were great until they weren't. If you're going to bet your domain's DNS on a free service, you should have an exit plan—and deSEC's API-first approach means you can automate that exit if it ever comes to it. Source: https://desec.io/ | Discussion: https://news.ycombinator.com/item?id=49566193