whichdevtool?
Menu
StacksDirectory Pricing changes Glossary
VPS and cloud servers App hosting and PaaS Managed databases Transactional email APIs Email marketing and newsletters Domain registrars CDN, DNS and edge security Monitoring, uptime and error tracking Auth and identity Frontend and full-stack frameworks Backend frameworks UI component libraries AI model APIs File and object storage Payments and billing Background jobs, queues and workflows ORMs and database toolkits

Free DNSSEC-signed DNS hosting · by deSEC e.V.

deSEC

Free, open-source DNS hosting run by a Berlin non-profit, with DNSSEC signing always on, a REST API, Terraform provider and global anycast.

Visit desec.io ↗ Alternatives Free Open source EU region
deSEC homepage
§1

Overview

deSEC is a free authoritative DNS host run by a non-profit organisation in Berlin. All of its software is open source, and every zone is signed with DNSSEC using elliptic-curve keys, with CDS/CDNSKEY support so registries can automate DS updates.

You can manage records in a web interface with live validation, or through a REST API with bulk operations, token permissions and bindings for Go, Python and JavaScript. A Terraform provider and Let's Encrypt integrations (certbot, acme.sh, lego) make it practical for DNS-01 certificate automation. deSEC also offers free dynDNS subdomains.

Because it is free and donation-funded, there is no SLA, no traffic steering (geo, failover, weighted) and the API has rate limits per domain. It is a DNS host only: no CDN, proxy or WAF.

deSEC is also part of the EU's DNS4EU consortium and has received funding from NLnet (NGI Assure), the ICANN Grant Program and RIPE NCC. Users with many domains, such as web hosts, are asked to contact support about their use case.

§2

Pricing and plans

Free tier · no card

Everything is free: managed domains and dynDNS, DNSSEC, API, anycast name servers; API rate limits apply.

At the limit Not stated The vendor does not say what happens at the limit, or we have not found it yet.

Plan Price What you get
Free $0 Managed domains, dynDNS, DNSSEC, REST API, 2FA

deSEC is free for everyone and funded by grants and donations (SSE, ICANN Grant Program, NLnet/NGI Assure, RIPE NCC, DNS4EU). Large users are asked to contact support. API requests are rate-limited, for example 2 record changes per second and 300 per day per domain; minimum TTLs are set by the server, with lower values on request.

Source: desec.io/ · prices as published, excluding tax.

§3

What it does

Always-on DNSSEC
Every zone is signed automatically with modern elliptic-curve cryptography.
Modern record types
HTTPS/SVCB for apex aliasing, TLSA, OPENPGPKEY, SMIMEA, CDS and CDNSKEY.
REST API
Documented API with bulk operations, zonefile import/export and scoped tokens.
Automation
Terraform provider, language bindings and certbot, acme.sh and lego integrations.
Anycast
Global anycast frontend networks with full IPv6 support.
Account security
TOTP multi-factor authentication.
§4

Strengths and limitations

Strengths

  • Completely free, with no upsell.
  • DNSSEC on by default for every zone.
  • Open-source software and a non-profit operator in the EU.
  • Good fit for DNS-01 certificate automation.

Limitations

  • No SLA or paid support tier.
  • No geo, latency, weighted or failover routing.
  • API rate limits, such as 300 record changes per domain per day.
  • Minimum TTLs are enforced; lower values need approval.
§5

Who it suits

Good for

  • Hobby and indie projects wanting free DNSSEC
  • EU-based or privacy-focused teams
  • Automated certificate issuance via DNS-01

Look elsewhere if

  • Businesses needing an uptime SLA
  • Apps needing traffic steering or failover
§6

Alternatives to deSEC

Tool From Free option Stages
jsDelivr Free public CDN for open source
— Free tier
Hetzner DNS Free DNS hosting in Hetzner Console
— Free tier
DNSimple DNS hosting and domain management
$0.5/mo Paid
Namecheap Domain registrar
$10.98/yr Paid
Porkbun Domain registrar
$11.08/yr Paid
easyDNS Managed anycast DNS and registrar
$20/yr Paid

All CDN, DNS and edge security →

§7

Questions

Is deSEC free?

Yes. deSEC is run by a non-profit and funded by grants and donations; there are no paid plans.

Does deSEC support DNSSEC?

Yes. Every zone hosted at deSEC is signed with DNSSEC, always.

Does deSEC have a Terraform provider?

Yes, deSEC lists Terraform providers alongside Go, Python and JavaScript bindings.

Does deSEC have API rate limits?

Yes, for example RRset changes are limited to 2 per second and 300 per day per domain; bulk requests help.

Sources read for this page