deSEC
Free, open-source DNS hosting with automatic DNSSEC, REST API, and strong security defaults. A non-profit initiative backed by the Sovereign European Cloud (SSE).
Use Cases
Free Tier
Unlimited domains, unlimited records, DNSSEC enabled by default, full REST API access
How to Maximize the Free Tier
Maximize deSEC by leaning into its API-first design — manage DNS records via curl or Terraform instead of the dashboard. DNSSEC is always-on, so you get cryptographic domain authentication at zero cost. Watch the DynDNS rate limit (1/min per domain) if you're updating IPs dynamically. For high-frequency updates, use the main REST API with a personal token instead of the DynDNS endpoint. Pair deSEC with Cloudflare (for CDN/DDoS) if you need more than just DNS.
Getting Started
Sign up at desec.io → verify email → create a domain (you'll get deSEC nameservers) → update nameservers at your registrar → add DNS records via dashboard or REST API → DNSSEC is automatic. For automation: generate an API token in account settings → use the REST API to manage records.
Pros
- DNSSEC by default: Every domain gets DNSSEC signed automatically — no manual key management or DS record setup required
- Clean API: Full REST API with token-based auth — easy to integrate with CI/CD pipelines and infrastructure-as-code
- Non-profit: No upsell, no premium tier, no bait-and-switch — completely free with open-source codebase
Cons
- Small team: Run by a small non-profit team — support response times can be slow compared to commercial providers
- No CDN or proxy: DNS only — no CDN, DDoS protection at the network layer, or SSL termination like Cloudflare
- Conservative rate limits: DynDNS API limited to 1 request/minute per domain — not suitable for high-frequency IP updates across many domains