why le_dns?
our own engine
The v2 target implements a hand-written Go edge and authoritative engine for modern resolver transports and hosted zones, backed by a self-operated BIND recursive resolver. Its separately deployable signer guards DNSSEC keys in a software-backed PKCS#11 SoftHSM store. The v2 implementation includes multi-core query handling and opt-in dynamic DNS with scoped TSIG credentials; repository presence is not cutover evidence. Details
privacy
The planned v2 path is designed to use your full source IP only in RAM to answer and protect ordinary resolver traffic. It retains thresholded hourly domain and network totals, not individual query histories; ODoH statistics have no source-network attribution. The legacy path observed on 2026-08-29 had a broader operational-log boundary, disclosed in the privacy policy.
no filtering
No censorship. No "family-friendly" restrictions. Just DNS as it should be.
self-operated recursion
The v2 target uses our own BIND recursive backend to resolve from the DNS root rather than forward requests to a third-party public resolver. Verify the deployed path before treating that target as current.
hosted in Europe
In the production snapshot inspected on 2026-08-29, the project used a European server fleet. Reverify the deployed inventory and contracts before treating that as current. Legal compliance depends on the final service, contracts and operating controls; it is not inferred from server geography alone.
high availability
The target uses a multi-server architecture with DNS round-robin and public per-location status. Deployment, failover and capacity still require verification; no uptime SLA is promised for this cost-recovery project.
secure by design
Implemented abuse controls include bounded rate limiting, refusal of public ANY queries, response-rate limiting and amplification mitigation. Capacity and resilience remain operational properties to verify, not a blanket DDoS guarantee. Details
the engine
Go edge, proven recursion
The v2 Go engine implements encrypted ingress, caching, abuse controls and authoritative zones; the target BIND backend handles recursive resolution. Both are intended to remain under project operations after a verified cutover.
modern transports, native
UDP, TCP, DoT (RFC 7858), DoH (RFC 8484), DoQ (RFC 9250), DoH/3, same binary, no plug-in stack.
DNSSEC, ours
After a verified v2 cutover, managed primary zones use ECDSA P-256 signing through an isolated signer and software-backed PKCS#11 SoftHSM store. Secondary zones serve DNSSEC material transferred from their upstream primary; le_dns does not locally re-sign them.
DDNS for actual humans
The v2 target implements RFC 2136 with TSIG for compatible clients such as Synology, routers and ddclient. It is opt-in per zone, rate-limited and audited; public interoperability still requires cutover evidence.
open by default
No black boxes. A release may ship only after its reviewed gates pass; source availability and the AGPLv3 licence are documented in the repository.
Free DNS Zone Hosting
Host your domain with us, or back up the one you already run. Both modes, free to start.
2 + 5
authoritative + secondary zones on Free
2 modes
primary or secondary
Multi-geo
ns-gra/ns-lim/ns-waw
€0
free to start
After a verified v2 cutover, run up to two authoritative primary zones on our nameservers with managed DNSSEC signing and optional scoped DDNS, or keep your own primary and mirror up to five secondary zones using TSIG-authenticated DNS transfers. Those transfers are authenticated, not encrypted. Secondary zones serve the DNSSEC records and signatures received from the upstream primary; le_dns does not locally re-sign them.
servers
All servers are accessible via ledns.fr,
ledns.eu,
ledns.tech,
ledns.cloud