# deSEC privacy rating

Free authoritative DNS hosting from the Berlin non-profit deSEC e.V., with automatic DNSSEC signing, a full REST API and open-source software.

## Summary

deSEC scores 77 out of 100 (grade B) on the DNS hosting criteria. It meets 8 of 11 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, security headers, DNSSEC, API access and two-factor login. It does not meet independent audit, transparency report and tells users about requests. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://desec.io
- Source code: https://github.com/desec-io/desec-stack
- License: MIT
- Jurisdiction: Germany. Fourteen Eyes member. EU member (GDPR).
- Home page trackers: none found
- Category: [DNS hosting](https://privacyratings.com/dns-hosting/)
- Grade: B (77/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | MIT. | https://github.com/desec-io/desec-stack/blob/main/LICENSE |
| No trackers or telemetry | Yes | The privacy policy states no tracking, behavioral analytics or externally hosted dependencies are used. | https://desec.io/privacy-policy |
| No ads or data sales | Yes | Run by a non-profit association funded by donations and grants. No ads. | https://desec.io/about |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=desec.io&hideResults=on |
| Security headers | Yes | Grade A+ (105/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=desec.io |
| Modern web standards | Not tested yet | Not tested yet. |  |
| DNSSEC | Yes | Every hosted zone is signed with DNSSEC automatically. The DS record is added at the registrar. | https://desec.io/ |
| API access | Yes | All records are managed through the REST API, which every free account can use. | https://desec.readthedocs.io/en/latest/ |
| Two-factor login | Yes | TOTP authenticator apps are supported for login. | https://desec.io/ |

Source: https://privacyratings.com/dns-hosting/desec/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/dns-hosting/desec.md