fshy / Domains and DNS

deSEC

desec.io · Domains and DNS · 1 record · JSON

deSEC Domains and DNS

★ qualifiesemailno cardRwrite-gated

desec.io/ · managed authoritative DNS with a full REST API · domains-dns/desec · JSON · compare

Free tier	free managed DNS with anycast, a full REST API, DNSSEC and no published query cap; the number of domains an account may hold is not published and is capped by a support-visible counter unit objects; metered on request-count
Price	none stated
Per-object cap	no published record count cap; the binding limits are the domain count per account and the RRset change rate per domain
Retention	zones persist while the account is active; a domain not renewed is deleted after a grace period
Egress	no query cap is published; the metered quantity is API requests
Identity	email email signup; a token per account
Limits	request-rate RRset create, delete or modify: 2 per second, 15 per minute, 100 per hour, 300 per day, per domain source request-rate any authenticated or unauthenticated activity: 2,000 per day per account or per IP source request-rate dynDNS updates: 2 per 2 minutes per domain source write-gated the number of domains an account may hold is not published; a new account is reported to start at one and the message in the panel asks the user to contact support for a higher limit. A deSEC staff reply gives the current formula as max(1, s + round(sqrt(s))) for s DNSSEC-delegated domains source DNS reads are 10/s and 50/min; domain creation and deletion are 10/s, 300/min and 1,000/h; account actions with external effects are 3/min; a 429 carries Retry-After and the windows slide
Binding	write-gated the change rate is generous for steady state. The domain counter is what stops a multi-zone scheme: it is not published, a new account is reported to begin at one domain, and raising it is a support request with a person in the queue.
Interface	rest a REST API with token authentication; the API speaks RRsets rather than individual records, and an empty subname is the zone apex
Tooling	the deSEC API directly, DNSControl, certbot and acme.sh with a DNS-01 hook, Terraform
Composes with	one small zone with a real API, and a support request per additional domain; the domain counter is what constrains a multi-zone scheme, not the change rate
Reliability	no reliability event recorded
Notes	The 300 changes a day per domain is generous for steady state and painful for provisioning: a 500-record import takes two days. Bulk endpoints exist and the docs recommend them, which is the alternative route. The domain counter is the constraint that was recorded as 'no published cap', which is a different claim: deSEC publishes no number, and its own forum gives one. Provisioning one account and counting the domains would settle it for the cost of an email address.
Evidence rung	reported the API and the rate table are first-party and were read today: the API answered 401 with a Token challenge and the rate table is a documentation page. The domain-count limit is not published anywhere first-party, so it is recorded at the reported rung from deSEC's own forum and two independent write-ups.
Checked	2026-10-23 (live); stale on 2026-11-06
Parsed numbers	`$.limits[2].value` limit:request-rate 2.0 minutes

Evidence (8)

date	source	what it proved
2026-10-22	probe:https://desec.io/api/v1/domains/	401, 58 bytes, 'Authentication credentials were not provided.', with WWW-Authenticate: Token and Allow: GET, POST, HEAD, OPTIONS. The endpoint exists and is token-authenticated
2026-10-22	probe:https://desec.io/api/v1/auth/login/	400 with '{"email":["This field is required."],"password":["This field is required."]}', a live DRF login endpoint
2026-10-22	desec.readthedocs.io/en/latest/rate-limits.html	dns_api_per_domain_expensive 2/s 15/min 100/h 300/day for RRset creation, deletion and modification per domain; user 2,000/day; dyndns 2/2min per domain; throttled requests return 429 with Retry-After
2026-10-22	desec.readthedocs.io/en/latest/dns/rrsets.html	'If subname is empty, this is equal to {name}.' so the apex is addressable; a wildcard component is allowed once at the beginning of the name
2026-10-22	talk.desec.io/t/feedback-about-recent-limit-changes/1834	a deSEC staff reply: 'the limit is max(1, s + round(sqrt(s))), were s is the number of domains delegated to us with DNSSEC enabled', giving 6 for s=4
2026-10-22	talk.desec.io/t/how-to-apply-for-a-spot/1370	'New accounts are limited to one domain and there is a note when you add a domain: Contact support to apply for a higher limit.'
2026-10-22	yepoleb.at/blog/2025/10/27/my-experience-with-desec/	an independent account: 'there is an initial limit of 1 domain per account. Right below is the note Contact support to apply for a higher limit.'
2026-10-22	desec.io/signup	the signup form says only 'Your first domain (you can add more later)', which is the closest thing to a published statement and gives no number

Unknown or withheld values (1)

$.reliability_note none-observed

Corrections

2026-10-22 deSEC was recorded as having no published cap and recommended for many zones, and a new account gets one domain

Built from commit 872967ae41, data as of 2026-10-27. Every value links to its source; freshness badges are computed in your browser. How to read this.