deSEC
- Free allowance
- Free managed DNS with anycast, a full REST API, DNSSEC and no published query cap; the number of domains an account may hold is a per-account limit_domains value that deSEC does not publish as a fixed number: unless set explicitly it grows with the domains delegated to deSEC with DNSSEC enabled
- Verdict
- ★ qualifiesusable as stated; the read path was probed
- Cost
- free tier
- Identity
- emailno card, no phone
- Binding limit
- write-gatedno fixed number is published: the per-account maximum is the read-only limit_domains field of the account object (the API reference example shows 15) and, unless deSEC has set a limit for the account explicitly, it grows with the...
- Evidence
- reported12 sources; a third party said so
- Freshness
- stale on 2026-11-19checked 2026-11-04 (live); stale on 2026-11-19
| Free tier | free managed DNS with anycast, a full REST API, DNSSEC and no published query cap; the number of domains an account may hold is a per-account limit_domains value that deSEC does not publish as a fixed number: unless set explicitly it grows with the domains delegated to deSEC with DNSSEC enabled unit objects; metered on request-count |
|---|---|
| Price | none stated |
| Limits |
DNS reads are 10/s and 50/min; domain creation and deletion are 10/s, 300/min and 1,000/h; account actions with external effects are 3/min; a 429 carries Retry-After and the windows slide |
| Binding | write-gated the change rate is generous for steady state. The domain counter is what stops a multi-zone scheme: it is not published, a new account is reported to begin at one domain, and raising it is a support request with a person in the queue. |
| Identity | email email signup; a token per account |
| Egress | no query cap is published; the metered quantity is API requests |
| Per-object cap | no published record count cap; the binding limits are the domain count per account and the RRset change rate per domain |
| Retention | zones persist while the account is active; a domain not renewed is deleted after a grace period |
| Interface | rest a REST API with token authentication; the API speaks RRsets rather than individual records, and an empty subname is the zone apex |
| Tooling | the deSEC API directly, DNSControl, certbot and acme.sh with a DNS-01 hook, Terraform |
| Composes with | one small zone with a real API, and a support request per additional domain; the domain counter is what constrains a multi-zone scheme, not the change rate |
| Reliability | no reliability event recorded |
| Notes | The 300 changes a day per domain is generous for steady state and painful for provisioning: a 500-record import takes two days. Bulk endpoints exist and the docs recommend them, which is the alternative route. The domain counter is the constraint that was recorded as 'no published cap', which is a different claim: deSEC publishes no number, and its own forum gives one. |
| Evidence note | reported the API, the rate table and the account reference are first-party. The account reference documents the per-account domain limit (limit_domains) and how it grows with DNSSEC-delegated domains, and the domains reference documents the 403 on reaching it, but neither states a fixed number; the initial value of one and the staff formula come from deSEC's forum and an independent write-up, at the reported rung. free_tier.unit is objects, not unlimited, because the domain count is capped. |
| Parsed numbers |
|
Evidence 12
| date | source | what it proved |
|---|---|---|
| 2026-10-22 | probe: https://desec.io/api/v1/domains/ | 401, 58 bytes, 'Authentication credentials were not provided.', with WWW-Authenticate: Token and Allow: GET, POST, HEAD, OPTIONS. The endpoint exists and is token-authenticated |
| 2026-10-22 | probe: https://desec.io/api/v1/auth/login/ | 400 with '{"email":["This field is required."],"password":["This field is required."]}', a live DRF login endpoint |
| 2026-10-22 | desec.readthedocs.io/en/latest/rate-limits.html | dns_api_per_domain_expensive 2/s 15/min 100/h 300/day for RRset creation, deletion and modification per domain; user 2,000/day; dyndns 2/2min per domain; throttled requests return 429 with Retry-After |
| 2026-10-22 | desec.readthedocs.io/en/latest/dns/rrsets.html | 'If subname is empty, this is equal to {name}.' so the apex is addressable; a wildcard component is allowed once at the beginning of the name |
| 2026-10-22 | talk.desec.io/t/feedback-about-recent-limit-changes/1834 | a deSEC staff reply: 'the limit is max(1, s + round(sqrt(s))), were s is the number of domains delegated to us with DNSSEC enabled', giving 6 for s=4 |
| 2026-10-22 | talk.desec.io/t/how-to-apply-for-a-spot/1370 | 'New accounts are limited to one domain and there is a note when you add a domain: Contact support to apply for a higher limit.' |
| 2026-10-22 | yepoleb.at/blog/2025/10/27/my-experience-with-desec/ | an independent account: 'there is an initial limit of 1 domain per account. Right below is the note Contact support to apply for a higher limit.' |
| 2026-10-22 | desec.io/signup | the signup form says only 'Your first domain (you can add more later)', which is the closest thing to a published statement and gives no number |
| 2026-11-03 | desec.readthedocs.io/en/latest/auth/account.html | the per-account domain limit (limit_domains) is not a fixed published number: it grows with the DNSSEC-delegated domains unless deSEC sets it explicitly |
| 2026-11-03 | desec.readthedocs.io/en/latest/auth/account.html | limit_domains is a read-only per-account field in the account object, the maximum number of domains the user can create |
| 2026-11-03 | desec.readthedocs.io/en/latest/dns/domains.html | the API enforces a per-account maximum and answers 403 when it is reached |
| 2026-11-03 | desec.readthedocs.io/en/latest/dns/domains.html | part of the text of Limits, above |
Unknown values 1
- reliability note: nothing of this kind was observed
Corrections
- 2026-10-22 deSEC was recorded as having no published cap and recommended for many zones, and a new account gets one domain