5 ms·

We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.

traceroute66 24d ago
> We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. I mean, if your definition of "affordable" is free, then sure. But for the record there are other affordable EU suppliers who do DNSSEC: - Bunny DNS[0] is "free" – i.e. only subject to their minimum $1/month account spend fee. - RcodeZero is very affordable[1] plus added bonus it is run by the `.at` registry so the infrastructure is solid – business customers only, no private individuals - Netnod (only via resellers[2] unless you are a big company or government) – Netnod host the I Root Servers and their public hosting DNSSEC service will soon feature HSM-bound DNSSEC keys [0] https://bunny.net/dns/ https://bunny.net/dns/ [1] https://www.rcodezero.at/solutions/enterprise https://www.rcodezero.at/solutions/enterprise [2] https://www.netnod.se/dns/find-a-partner https://www.netnod.se/dns/find-a-partner
- amaccuish 24d ago
  One who doesn't is frustratingly Hetzner.
- quicksilver03 24d ago
  I happen to run an affordable EU supplier who does DNSSEC, and also AXFR (incoming and outgoing). I offer a free plan from time to time, but not at the moment to preserve resources for paying customer. https://www.ptrdns.net/ https://www.ptrdns.net/
  - andreaso 24d ago
    Are you aware that the child zone A(AAAA) records for danube.ns.ptrdns.net differs from the parent zone A(AAA) glue records for danube.ns.ptrdns.net? Looks like it's the glue records that point to the actual server?
    - quicksilver03 24d ago
      Thanks for letting me know! This is fixed now, I'll look into why the monitoring tools didn't catch this one as they should have.
- Stitch4223 24d ago
  We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider, as we have a deadline to comply with at the end of this month. I don’t know what the issue is off the top of my head. Netnod.se uses a DNSKEY that is too small on their main domain. Rcodezero.at might indeed be something. Thanks. We donate to deSEC, so it’s not free for us.
  - traceroute66 24d ago
    > Netnod.se uses a DNSKEY that is too small on their main domain. Interesting, could you expand on that ? I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ? [1] https://dnssec-analyzer.verisignlabs.com/netnod.se https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se https://internet.nl/site/netnod.se
    - Stitch4223 24d ago
      Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength. Verisign does check for key validity but not for key strength / length as seen in your link. [1] https://zonemaster.se https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnssec-meting-vooraankondiging-meting-robuustheid-dns/ https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-5 https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176 https://github.com/internetstandards/Internet.nl/issues/1176
      - 23d ago
dsl 24d ago
DNSSEC support is an anti-feature, it is dead/dying and the faster we can unburden ourselves from it the faster we can move on to better solutions. https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/
- apefulsin 24d ago
  So DNS should be open to MITM attackers?
  - icedchai 24d ago
    Even with DNSSEC, it still is. Example: https://blog.cloudflare.com/de-tld-outage-dnssec/ https://blog.cloudflare.com/de-tld-outage-dnssec/
  - digitalPhonix 24d ago
    Did you read the article? It's saying that DNSSEC as an implementation to prevent MITM is flawed; other solutions that protect against MITM are proposed.
- teddyh 24d ago
  Rebuttal: <https://easydns.com/blog/2015/08/06/for-dnssec/ https://easydns.com/blog/2015/08/06/for-dnssec/>
  - dsl 24d ago
    That rebuttal held water 10 years ago, but fortunately we have made a lot of advancements since then. DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents. We have since committed entirely to transport security in the form of DoH and friends. It solves the vast majority of problems we actually have.
    - thayne 24d ago

traceroute66 24d ago

> We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. I mean, if your definition of "affordable" is free, then sure. But for the record there are other affordable EU suppliers who do DNSSEC: - Bunny DNS[0] is "free" – i.e. only subject to their minimum $1/month account spend fee. - RcodeZero is very affordable[1] plus added bonus it is run by the `.at` registry so the infrastructure is solid – business customers only, no private individuals - Netnod (only via resellers[2] unless you are a big company or government) – Netnod host the I Root Servers and their public hosting DNSSEC service will soon feature HSM-bound DNSSEC keys [0] https://bunny.net/dns/ https://bunny.net/dns/ [1] https://www.rcodezero.at/solutions/enterprise https://www.rcodezero.at/solutions/enterprise [2] https://www.netnod.se/dns/find-a-partner https://www.netnod.se/dns/find-a-partner

amaccuish 24d ago
One who doesn't is frustratingly Hetzner.
quicksilver03 24d ago
I happen to run an affordable EU supplier who does DNSSEC, and also AXFR (incoming and outgoing). I offer a free plan from time to time, but not at the moment to preserve resources for paying customer. https://www.ptrdns.net/ https://www.ptrdns.net/
- andreaso 24d ago
  Are you aware that the child zone A(AAAA) records for danube.ns.ptrdns.net differs from the parent zone A(AAA) glue records for danube.ns.ptrdns.net? Looks like it's the glue records that point to the actual server?
  - quicksilver03 24d ago
    Thanks for letting me know! This is fixed now, I'll look into why the monitoring tools didn't catch this one as they should have.
Stitch4223 24d ago
We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider, as we have a deadline to comply with at the end of this month. I don’t know what the issue is off the top of my head. Netnod.se uses a DNSKEY that is too small on their main domain. Rcodezero.at might indeed be something. Thanks. We donate to deSEC, so it’s not free for us.
- traceroute66 24d ago
  > Netnod.se uses a DNSKEY that is too small on their main domain. Interesting, could you expand on that ? I ran netnod.se through the Verisign[1] and internet.nl[2] and it passes DNSSEC tests ? [1] https://dnssec-analyzer.verisignlabs.com/netnod.se https://dnssec-analyzer.verisignlabs.com/netnod.se [2] https://internet.nl/site/netnod.se https://internet.nl/site/netnod.se
  - Stitch4223 24d ago
    Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength. Verisign does check for key validity but not for key strength / length as seen in your link. [1] https://zonemaster.se https://zonemaster.se [2] https://internetcleanup.foundation/2026/04/bijgewerkte-dnssec-meting-vooraankondiging-meting-robuustheid-dns/ https://internetcleanup.foundation/2026/04/bijgewerkte-dnsse... [3] https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ https://zonemaster.se/en/result/cf3ef2fc83f27eb6/ [4] https://internet.nl/site/internet.nl/4280424/#control-panel-5 https://internet.nl/site/internet.nl/4280424/#control-panel-... [5] https://github.com/internetstandards/Internet.nl/issues/1176 https://github.com/internetstandards/Internet.nl/issues/1176
    - 23d ago

dsl 24d ago

DNSSEC support is an anti-feature, it is dead/dying and the faster we can unburden ourselves from it the faster we can move on to better solutions. https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/

apefulsin 24d ago
So DNS should be open to MITM attackers?
- icedchai 24d ago
  Even with DNSSEC, it still is. Example: https://blog.cloudflare.com/de-tld-outage-dnssec/ https://blog.cloudflare.com/de-tld-outage-dnssec/
- digitalPhonix 24d ago
  Did you read the article? It's saying that DNSSEC as an implementation to prevent MITM is flawed; other solutions that protect against MITM are proposed.
teddyh 24d ago
Rebuttal: <https://easydns.com/blog/2015/08/06/for-dnssec/ https://easydns.com/blog/2015/08/06/for-dnssec/>
- dsl 24d ago
  That rebuttal held water 10 years ago, but fortunately we have made a lot of advancements since then. DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents. We have since committed entirely to transport security in the form of DoH and friends. It solves the vast majority of problems we actually have.
  - thayne 24d ago