HACKER Q&A
📣 NTroy

Does truly private DNS hosting exist?


I've spent a long time attempting to find any managed DNS/DNS hosting providers that also guarantee privacy.

Does anyone on here know of any DNS hosting provider that can meet the following criteria?

Mandatory:

- The provider allows for the creation of all, standard DNS records

- The provider can guarantee no logging of DNS queries or a short retention period for those logs (or, if logs are kept, then they must not include the IP address from which the request originated)

- The provider allows DNS hosting for domains not necessarily registered through that same provider

Bonus Points:

- The provider has a large network of fast servers (potentially anycast DNS)

- The provider allows for some advanced options (for example "POOL Records," "Round Robin" DNS, or "Geo" DNS)

- The provider is relatively cost effective

Note: I'm not looking for private DNS providers. There are plenty of providers who offer DNS services for free or cheap, and have great privacy guarantees. I'm specifically looking for providers that will host your custom DNS records, and guarantee that all queries to those records are not logged. The few providers that I found who ran private DNS services and allowed for managed DNS still collected analytics when you hosted custom records, and did not allow for those analytics to be disabled.

If you know of any such services, I'd be super grateful if you could link them below, and/or share any experience you have with them. Thanks!

  👤 samgaw Accepted Answer ✓
Tbh I think it's beyond reasonable to expect when you're paying for a service that your data (or your clients') isn't funneled into another sideline. And this particular question is great timing for me, so I hope you don't mind me doing a bit of market research and get your feedback on a few things.

- Is this for personal domains or commercial?

- Are the clients 'sensitive' or do you want to protect PII out of principle?

- Do you expect to pay a premium (compared to larger providers) for client privacy?

- For records that have a distribution strategy like round robin or balanced by load, do you expect a client to receive the same result on subsequent requests?

- Is it acceptable to keep (for a record's TTL) a hash the client's subnet and the response for the purposes of only returning consistent records, or do you consider this another flavour of tracking client IPs?

- How valuable are metrics/reporting do you? Is reporting query volume at the ASN or country level enough? Too much?

Thanks.

👤 eqvinox
Installing a DNS server (personal preference: nsd) on a virtual or dedicated rented box seems to fulfill your mandatory conditions. Did you mean to include something like "web interface" or "managed" in the criteria? What exactly is it that you expect of the "provider" here?
👤 LinuxBender
Anycast, gslb behavior, standard records, short logging, probably UltraDNS or maybe Dyn if you don't mind that Oracle purchased them. I don't know what you mean by cost effective. All the commercial providers can get expensive depending on how heavily requested your DNS records are. You would need to negotiate pricing. As for log retention, regardless of vendor that is something you would have to get them to put in writing in a mutually signed / counter-signed contract reviewed by your lawyers. Companies can say anything but it means nothing until it is in legal documents.
👤 parliament32
Get a cheap VPS for a few bucks a months and "apt install bind9". You can create any kind of records you want, and have whatever logging you want.
👤 imdsm
Out of interest, what do you consider "relatively cost effective"?