Largely because this is a toy-project which has no income behind it. (It was initially going to be commercialized, but in the end I found people pretended they

Largely because this is a toy-project which has no income behind it. (It was initially going to be commercialized, but in the end I found people pretended they'd pay, rather than actually wanted to do so for extras like more hostnames, MX records, etc. So in the end I went with a different project https://dns-api.com/ https://dns-api.com/) I could pretend I regard DNS data as public, but sniffing the update token could allow malicious users to change things in surprising fashions so it really does deserve SSL, but I'm not going to pay for it. I would hope that if users cared about security they'd deploy their own instance - and pay for the resulting Amazon traffic.