Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

deSEC – Free Secure DNS

desec.io

Post reply on HN
Print view View original

51–59 of 59 posts

Re: deSEC – Free Secure DNS

#51

Post by alexdns »

imoverclocked wrote: post #38
awill wrote: post #11

I signed up and saw they only allowed a single subdomain for DDNS, with docs saying to contact support if you needed more. I emailed asking for just 1 more subdomain and support told me that for my usecase I should just use CloudFlare. So I did. No silly miniscule restrictions.

I had this issue with cloudns and a single record with an IPv4 and IPv6 address. They only allowed one free ddns record which covered exactly one protocol. On top of that, they added records to resolve unknown names for advertising purposes. I get that it costs money to run a DNS service but it seems like it should be a lot cheaper at scale than a lot of companies are providing.

> On top of that, they added records to resolve unknown names for advertising purposes.

doubt

Re: deSEC – Free Secure DNS

#53

Post by peterthomassen »

awill wrote: post #11

I signed up and saw they only allowed a single subdomain for DDNS, with docs saying to contact support if you needed more. I emailed asking for just 1 more subdomain and support told me that for my usecase I should just use CloudFlare. So I did. No silly miniscule restrictions.

> support told me that for my usecase I should just use CloudFlare

Not true. When users ask for multiple domains under .dedyn.io, we send them the following text:

> Unfortunately, deSEC accounts are limited to 1 .dedyn.io domain. > > However, you can create additional subdomains under your existing domain, by creating a record in our web interface and putting the subdomain name into the "subname" field. For example, if you have domain.dedyn.io, and you create a record with "subname: internal", then the record will apply to internal.domain.dedyn.io. > > You can also purchase another domain elsewhere, and then bring it to deSEC for DNS hosting. Please let me know if you would like to go that route. > > Does that help?

(Disclosure: I'm CTO at deSEC.)

Re: deSEC – Free Secure DNS

#54

Post by peterthomassen »

zetanor wrote: post #19

When I last tried deSEC, the service was reliable and well worth the price of admission, but the web UI and API were both quite rough, and propagation tended to be quite slow. It was annoying to do an ACME DNS01 challenge on it, for example. IIRC, the API didn't have a complete set of replace/edit endpoints, so even DNSControl ( https://github.com/DNSControl/dnscontrol ) would leave records nonexistent for a while wh…

> though this certainly applies to deSEC) it's strange to me how so many DNS services (free or paid) struggle to import simple Bind zone files,

In deSEC's GUI, when you add a domain, you can expand an "Advanced" section and paste your zonefile.

You can do the same via the REST API using the "zonefile" parameter in your request.

> often either giving a vague error ("one or more records could not be imported"),

When there's an issue, the response will tell you which line it was. Perhaps that can be improved - we'd appreciate feature requests about that.

> just silently omitting records

We omit records that we manage ourselves, that is: SOA, NS, DNSKEY, RRSIG. Everything else is retained, and in fact deSEC has unusually broad record type support (see https://desec.readthedocs.io/en/latest/dns/rrsets.html#recor...).

(Disclosure: I'm CTO at deSEC.)

Re: deSEC – Free Secure DNS

#55

Post by zetanor »

peterthomassen wrote: post #54
zetanor wrote: post #19

When I last tried deSEC, the service was reliable and well worth the price of admission, but the web UI and API were both quite rough, and propagation tended to be quite slow. It was annoying to do an ACME DNS01 challenge on it, for example. IIRC, the API didn't have a complete set of replace/edit endpoints, so even DNSControl ( https://github.com/DNSControl/dnscontrol ) would leave records nonexistent for a while wh…

> though this certainly applies to deSEC) it's strange to me how so many DNS services (free or paid) struggle to import simple Bind zone files, In deSEC's GUI, when you add a domain, you can expand an "Advanced" section and paste your zonefile. You can do the same via the REST API using the "zonefile" parameter in your request. > often either giving a vague error ("one or more records could not be imported"), When th…

A problem there is needing to temporarily delete the entire domain just to update using a zone file. I don't manage the DNS for anything remotely critical, but if I did, it would be unacceptable. Either way, the workflow feels deeply incorrect (though most users likely will use the record editor or the API instead; even I'd use the API through DNSControl, now).

Logging back into deSEC right now, it seems like the parser does work better than it used to, but TTL inheritance is still spotty. As an extreme example, the following input:

    @   7777 IN SOA  x. x. 1 9999 9999 9999 9999
                A    203.0.113.1
        4444    AAAA 2001:db8::1
    www         A 203.0.113.1
... correctly gets parsed by BIND (with the addition of a dummy NS record) as:

    @   7777 IN A    203.0.113.1
    @   4444 IN AAAA 2001:db8::1
    www 4444 IN A    203.0.113.1
... but deSEC parses:

    @   9999 IN A    203.0.113.1
    @   4444 IN AAAA 2001:db8::1
    www 9999 IN A    203.0.113.1
... where 9999 is a $TTL value from a different zone file, from a different domain, that I'd imported in a completely different session. The value is permanently (?) stuck to the entire account. This is ultimately almost a squabble since there's simple workarounds, but it did affect me when I used deSEC, and it's the sort of problem that I constantly run into with other managed DNS services too.

Hopefully this helps in some way.

Re: deSEC – Free Secure DNS

#56

Post by thayne »

wildylion wrote: post #50
thayne wrote: post #48

Earlier quoted context omitted.

DoH only secures the connection between the DoH provider and the client, not the response from the authoritative DNS server. It also isn't sufficient for DANE or similar. So DoH doesn't completely solve the problems DNSSEC tried to.

Exactly. And now there's https://datatracker.ietf.org/doc/html/rfc9539 > that allows encrypted DNS between authoritative and recursive servers as well.

That provides privacy, but not authentication.

Re: deSEC – Free Secure DNS

#57

Post by pawal »

traceroute66 wrote: post #49
Stitch4223 wrote: post #43

Earlier quoted context omitted.

Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3] Internet.nl does not look at DNSSEC that extensively, allowing poorer…

Super, thanks. zonemaster added to my bookmarks !

Also have a look at gonemaster, the modern replacement: https://gonemaster.evilbit.de/

Re: deSEC – Free Secure DNS

#58

Post by miniBill »

dsl wrote: post #14
Stitch4223 wrote: post #2

We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.

DNSSEC support is an anti-feature, it is dead/dying and the faster we can unburden ourselves from it the faster we can move on to better solutions. https://sockpuppet.org/blog/2015/01/15/against-dnssec/

> Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys. Yupp. Which is why using bit.ly is a terrible idea unless you live in Lybia

Re: deSEC – Free Secure DNS

#59

Post by Arrowmaster »

lacoolj wrote: post #32

Is this somehow related to the other post about another service shutting down its encrypted DNS? https://news.ycombinator.com/item?id=49568579 Weird timing?

These are completely different types of services. One is a DoH recursive DNS resolver for use by clients. The other is a DNSSEC enabled DNS hosting provider for domain owners. The encryption in use is completely different with different goals.
Post reply on HN