Skip to main content
← back to home FR

Security

Controls stated with their deployment status

Last verified production boundary

At the last verified production snapshot on 2026-08-29, the three European nodes still used the legacy dnsdist, BIND and secondary-DNS stack for recursive DNS, encrypted resolver transports and existing secondary-zone service. That dated evidence is not proof of current live state; reverify the deployed service before making a current claim. The v2 controls below are implemented in the rebuild but are not production claims until cutover is proved.

Current availability belongs on the status service. le_dns provides no security or uptime guarantee merely because a control is described here.

Resolver protections

The current and planned stacks use bounded per-client controls to reduce amplification and denial-of-service abuse. The v2 edge applies limits before recursion and keeps its cache bounded. BIND response-rate limiting is currently configured for observation rather than enforcement, so it is not represented as an active protection.

The resolver performs recursive resolution through its local BIND backend rather than forwarding all customer traffic to a public third-party resolver. Authoritative servers contacted during recursion see the le_dns resolver address, not the original client address.

Encrypted DNS

At the last verified 2026-08-29 snapshot, the public resolver published:

DoH over HTTP/3 uses the same HTTPS URI when the client and server negotiate HTTP/3; there is no separate h3:// resolver URL. ODoH is a v2 target; repository support is not evidence that it is deployed.

v2 authoritative controls

At v2 launch, managed zones use server-side plan and access checks:

API keys are stored as SHA-256 token hashes and their raw value is shown once. Portal sessions use Secure, HttpOnly, SameSite=Strict cookies with an eight-hour default lifetime.

DNSSEC key custody

The v2 signer runs separately and wraps SoftHSM through PKCS#11. SoftHSM is software, not dedicated HSM hardware. Generated or imported RSA/SHA-256 and ECDSA P-256 private keys are configured as non-extractable. P-384 and Ed25519 imports are not currently supported.

At the last verified 2026-08-29 snapshot, the le_dns service zones were unsigned. That dated evidence is not proof of current live state. DNSSEC signing must not be advertised as active until the deployed signer and parent DS records are verified.

Resolver analytics

The v2 analytics path is designed to avoid persistent full source addresses for ordinary resolver analytics. It releases only closed aggregate rows that reach 100 queries by default. Network detail is capped at /24 for IPv4 or /48 for IPv6 and can include ASN, organisation, country and subdivision. ODoH rows omit network attribution.

That design does not retroactively describe the legacy logging pipeline observed on 2026-08-29. Until cutover is proved, the Privacy Policy discloses that broader dated operational-log boundary and requires live reverification.

Billing safety

Subscription state is a control-plane entitlement, never a DNS answer policy. Cancellation or payment failure does not park a domain, insert advertising, rewrite answers or delete a zone. A failed renewal receives a seven-day grace period before the account returns to Free limits; new paid-only objects, authority, automation and scheduled monitoring pause when grace begins, while existing DNS and recovery continue.

Reporting a vulnerability

Send security reports to security@ledns.eu. Include the affected endpoint, impact, reproduction steps and any safe proof of concept. Do not access other customers’ data or degrade the public service while testing.

The canonical disclosure contact and encryption-key details are published in security.txt.