Why European DNS Matters
Server location is only one part of the privacy boundary
DNS infrastructure exposes sensitive metadata, so the operator’s establishment, processing locations, subprocessors and legal obligations all matter. A server physically located in Europe is not enough by itself.
What to verify
Ask a resolver operator:
- Which entity controls the service?
- In which countries is each processing purpose performed?
- Which infrastructure, payment, email and web providers receive data?
- Which resolver fields reach persistent storage?
- Are retention periods implemented or only promised?
- Can the claims be checked against code, configuration and an independent audit?
GDPR creates enforceable duties around lawful basis, minimization, purpose limitation, security and data-subject rights. It does not make a service private merely because the operator writes “GDPR compliant.”
le_dns operating boundary
le_dns is operated by a French individual business. In the production snapshot inspected on 2026-08-29, the public fleet had three nodes:
- Gravelines, France — OVHcloud;
- Limburg, Germany — OVHcloud; and
- Warsaw, Poland — Scaleway.
That dated snapshot is not proof of the current fleet; reverify the deployment and provider contracts before making a current claim. The homepage also embeds a GitHub Sponsors button. V2 paid checkout is being qualified with Paddle as reseller (Merchant of Record); live checkout is not open. These recipients and their payment-related processing must be included in privacy and transfer analysis. The European location of DNS servers does not establish the location of checkout processing; le_dns makes no absolute claim that every website or payment request stays inside the EU.
Current and planned data handling
At the last verified production snapshot on 2026-08-29, the service still used the legacy resolver and secondary-DNS stack. That dated evidence is not proof of current live state; reverify the deployed service and telemetry path before making a current claim.
The planned v2 resolver analytics path releases only closed rows that meet a 100-query threshold by default. Released dimensions can include qname or registered domain, masked source network, ASN and organisation, country and subdivision, transport and response data. Public-resolver aggregates expire after 30 days hourly and 90 days daily. Separately stored authoritative customer aggregates expire after 180 days hourly and 730 days daily; customer plans control only the bounded reporting-access window.
Legal caution
CLOUD Act, FISA, GDPR transfer and French disclosure questions depend on the provider, data, role and facts. This page is a technical purchasing checklist, not legal advice. Obtain qualified counsel for a transfer-impact or surveillance-law assessment.