{"slug": "desec", "name": "deSEC", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 3, "commenters": 4, "warners": 0, "score": 3.183, "rising": 3.0, "first": "2026-09-04", "latest": "2026-09-05", "why": "I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 0, "compare": 1, "warn": 0}, "spark": [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain.", "icon": true, "domain": null, "github_repo": "github.com/desec-io/desec-stack", "official_url": "https://desec.io", "pricing": "", "aliases": ["deSEC"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 793135648, "item_id": 49570978, "url": "https://news.ycombinator.com/item?id=49570978", "by": "dmm", "date": "2026-09-04", "stance": "recommend", "quote": "I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain.", "excerpt": "I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain. This means I have a VM running \"service1.foo.example.com\" which is not publicly available but can still get certs from letsencrypt, but with a token that can't be used to issue certs for other domains. It works great!", "context": "", "use_case": "scoped DNS-01 certificate validation", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}, {"id": 793107488, "item_id": 49569218, "url": "https://news.ycombinator.com/item?id=49569218", "by": "MattTheRealOne", "date": "2026-09-04", "stance": "recommend", "quote": "I have been using deSEC for a couple of years without any issues.", "excerpt": "I have been using deSEC for a couple of years without any issues. I mostly just do not want my DNS handled by my registrar so that I can easily transfer domains without worrying about DNS as well, and I do not like how centralized the internet is becoming around Cloudflare.", "context": "", "use_case": "DNS hosting separate from registrar", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}, {"id": 793081680, "item_id": 49567605, "url": "https://news.ycombinator.com/item?id=49567605", "by": "Stitch4223", "date": "2026-09-04", "stance": "recommend", "quote": "the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.", "excerpt": "We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.", "context": "", "use_case": "DNSSEC-compliant DNS hosting", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["managed dns", "scoped dns-01 certificate validation", "dns hosting separate from registrar", "dns hosting", "dnssec-compliant dns hosting"], "compared": [{"slug": "dnscontrol", "name": "DNSControl", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 793476832, "item_id": 49592302, "url": "https://news.ycombinator.com/item?id=49592302", "by": "peterthomassen", "date": "2026-09-07", "stance": "recommend", "quote": "We use dnspython for zone parsing", "excerpt": "First, I guess it would be a good idea to report discontent about things feeling \"deeply incorrect\" to our issue tracker. Just lamenting about the state of things won't change it. Unless I happen to swing by. -- We use dnspython for zone parsing, and it turns out that this is legacy (pre RFC 2308) behavior implemented there. You could say it's a bug there. We've created a patch: https://github.com/rthalley/dnspython/", "context": "deSEC maintainer", "use_case": "DNS hosting", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49566193", "title": "deSEC \u2013 Free Secure DNS", "mentions": 6}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {"recommend": 3, "compare": 1}, "2026-10": {}}, "quotes": [{"id": 793220944, "item_id": 49576309, "url": "https://news.ycombinator.com/item?id=49576309", "by": "zetanor", "date": "2026-09-05", "stance": "neutral", "quote": "the parser does work better than it used to, but TTL inheritance is still spotty", "excerpt": "A problem there is needing to temporarily delete the entire domain just to update using a zone file. I don't manage the DNS for anything remotely critical, but if I did, it would be unacceptable. Either way, the workflow feels deeply incorrect (though most users likely will use the record editor or the API instead; even I'd use the API through DNSControl, now). Logging back into deSEC right now, it seems like the par", "context": "", "use_case": "managed DNS", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}, {"id": 793135648, "item_id": 49570978, "url": "https://news.ycombinator.com/item?id=49570978", "by": "dmm", "date": "2026-09-04", "stance": "recommend", "quote": "I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain.", "excerpt": "I switched to deSEC because they allow you to create tokens for DNS-01 validation which are tightly scoped to a single subdomain. This means I have a VM running \"service1.foo.example.com\" which is not publicly available but can still get certs from letsencrypt, but with a token that can't be used to issue certs for other domains. It works great!", "context": "", "use_case": "scoped DNS-01 certificate validation", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}, {"id": 793107488, "item_id": 49569218, "url": "https://news.ycombinator.com/item?id=49569218", "by": "MattTheRealOne", "date": "2026-09-04", "stance": "recommend", "quote": "I have been using deSEC for a couple of years without any issues.", "excerpt": "I have been using deSEC for a couple of years without any issues. I mostly just do not want my DNS handled by my registrar so that I can easily transfer domains without worrying about DNS as well, and I do not like how centralized the internet is becoming around Cloudflare.", "context": "", "use_case": "DNS hosting separate from registrar", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}, {"id": 793094176, "item_id": 49568386, "url": "https://news.ycombinator.com/item?id=49568386", "by": "zetanor", "date": "2026-09-04", "stance": "compare", "quote": "the service was reliable and well worth the price of admission, but the web UI and API were both quite rough, and propagation tended to be quite slow", "excerpt": "When I last tried deSEC, the service was reliable and well worth the price of admission, but the web UI and API were both quite rough, and propagation tended to be quite slow. It was annoying to do an ACME DNS01 challenge on it, for example. IIRC, the API didn't have a complete set of replace/edit endpoints, so even DNSControl (https://github.com/DNSControl/dnscontrol) would leave records nonexistent for a while whil", "context": "", "use_case": "DNS hosting", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}, {"id": 793081680, "item_id": 49567605, "url": "https://news.ycombinator.com/item?id=49567605", "by": "Stitch4223", "date": "2026-09-04", "stance": "recommend", "quote": "the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.", "excerpt": "We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.", "context": "", "use_case": "DNSSEC-compliant DNS hosting", "switched_from": "", "story": "deSEC \u2013 Free Secure DNS"}]}