IdeaWell

Project ideas from Hacker News discussions.

deSEC – Free Secure DNS

Original Article

Hacker News Discussion

📝 Discussion Summary (Click to expand)

Theme 1: deSEC’s strengths and weaknesses
Many commenters praised deSEC for being an affordable, DNSSEC‑compliant EU provider, but also pointed out practical limits.
- “We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC. Highly recommended.” – Stitch4223
- “When I last tried deSEC, the service was reliable and well worth the price of admission, but the web UI and API were both quite rough, and propagation tended to be quite slow.” – zetanor
- “I signed up and saw they only allowed a single subdomain for DDNS… support told me that for my usecase I should just use CloudFlare.” – awill

Theme 2: Alternatives and self‑hosting options
Several users highlighted other EU DNSSEC services or DIY setups as viable substitutes.
- “Bunny DNS is 'free' – i.e. only subject to their minimum $1/month account spend fee. RcodeZero is very affordable… Netnod … host the I Root Servers…” – traceroute66
- “My solution was to self‑host PowerDNS and then sign up for the free DNS mirroring from hurricane electric.” – craftkiller
- “Just use unbound … Unbound is caching, not authoritative. Zones with dns records are served from authoritative DNS servers such as bind.” – pategoria

Theme 3: Debate over DNSSEC’s usefulness and trust
Opinions split on whether DNSSEC is a necessary security improvement or an obsolete burden, with additional worries about provider sustainability and geopolitical trust.
- “DNSSEC support is an anti‑feature, it is dead/dying and the faster we can unburden ourselves from it the faster we can move on to better solutions.” – dsl
- “Why do you think DNS should be open to MITM attackers? Do you work for the NSA?” – apefulsin (challenging the anti‑DNSSEC view)
- “[Our mission is to improve Internet security by increasing the adoption of DNSSEC… Would you be willing to do that?” – boramalper (reflecting deSEC’s policy)
- “After recent US shenanigans why would you spend effort to migrate to yet another Five Eyes controlled service…?” – bflesch (sovereignty/trust concern)

🚀 Project Ideas

PowerDNS Manager with Integrated Secondary Mirroring

Summary

  • A self‑hosted dashboard that wraps PowerDNS (or BIND) to give an easy‑to‑use UI for zone management, AXFR enable/disable, and automatic secondary mirroring to free services like Hurricane Electric.
  • Core value: eliminates the need to juggle multiple providers, provides redundancy without manual zone transfers, and keeps DNSSEC signing under your control.
Key Value
Target Audience Sysadmins, indie developers, small businesses that want full DNS control but also reliable secondary backup
Core Feature Unified web UI + API to create/edit zones, toggle AXFR, schedule automatic sync to a secondary DNS provider, and manage DNSSEC keys
Tech Stack Go (backend with Gin), React (frontend), PowerDNS HTTP API, PostgreSQL, Docker‑Compose
Difficulty Medium
Monetization Revenue-ready: Hosted SaaS plan $5/mo per domain (self‑hosted version remains open source)

Notes

  • HN users praised self‑hosting PowerDNS + Hurricane Electric mirroring as a workaround for deSEC limits; this product packages that pattern into a click‑deploy solution.
  • Provides a clear path for users frustrated by deSEC’s API rate limits and DDNS sub‑domain caps while keeping data sovereign in the EU.
  • Potential for community contributions (plug‑in for other secondary providers like Cloudflare Secondary DNS).

ZoneSync: Universal DNS Zone Import/Export & Diff Tool

Summary

  • CLI and optional web UI that reads BIND‑style zone files, validates them, compares against a live DNS provider (deSEC, Cloudflare, etc.), and applies changes using the provider’s full API (including replace/edit endpoints).
  • Core value: solves the painful, error‑prone zone‑file import experience and gives confidence with dry‑run and interactive confirmation.
Key Value
Target Audience DevOps engineers, domain admins, anyone migrating zones between providers or version‑controlling DNS
Core Feature Import zone → diff → preview → apply (with optional DNSSEC re‑sign); supports multiple providers via adapter plugins
Tech Stack Python (Typer/Click), dnspython, requests, optional React/Vue for web UI; plugin system for provider APIs
Difficulty Low‑Medium
Monetization Hobby (open‑source) – could accept donations or sponsorships

Notes

  • Commenters noted deSEC’s API lacks replace/edit endpoints and that zone‑file imports often fail silently; ZoneSync would abstract those gaps.
  • Provides a tangible utility that could be shared in HN threads about DNS migration, encouraging discussion and practical adoption.
  • Enables version‑controlled DNS (GitOps) workflows, a need expressed by users wanting repeatable, auditable changes.

DDNS Proxy for deSEC with Auto‑Limit Scaling

Summary

  • A lightweight proxy service that accepts dynamic DNS updates (e.g., from routers or IoT devices), forwards them to deSEC using scoped tokens, and automatically requests a higher DDNS sub‑domain limit when usage approaches the current quota.
  • Core value: removes the manual support‑ticket process for increasing DDNS hosts and keeps updates within deSEC’s rate limits via batching and caching.
Key Value
Target Audience Home‑lab operators, IoT hobbyists, small businesses using deSEC for DDNS who need more than the default single sub‑domain
Core Feature DDNS update endpoint → token‑scoped API call → usage‑based limit increase request → rate‑limit‑safe batching; simple dashboard to view active hosts
Tech Stack Node.js (Express) or Python (Flask), Redis for rate‑limit caching, deSEC API, optional Vue dashboard
Difficulty Medium
Monetization Hobby (free tier) – optional “Supporter” donation for hosted instance; self‑hostable open source

Notes

  • Users reported having to email deSEC support to raise DDNS limits and being told to use Cloudflare instead; this proxy makes the increase self‑serve and automated.
  • Aligns with deSEC’s mission to boost DNSSEC adoption by removing friction for legitimate DDNS use‑cases.
  • Could spark discussion on HN about balancing open‑resource services with abuse prevention, while offering a pragmatic tool for the community.

Read Later