Hi,
I have used Hetzner for quite some time for domain registration and server hosting.
However, having read up on DNS security, I would now like to switch to deSEC for all my DNS needs.
Unfortunately, I cannot delete the Hetzner NS records and deSEC does not seem to support AXFR/IXFR.
This means that I cannot implement the setup described here: https://docs.hetzner.com/networking/dns/faq/nameservers.
Is there any other way to set up Hetzner and deSEC together?
Thank you!
Hi f75dti7m,
Thanks for your message, and welcome to deSEC! 
That seems like a Hetzner problem, as you should be able to set custom NS records (according to the docs you linked).
Note that Hetzner only sometimes allows setting DS records to enable DNSSEC, which is required when using deSEC. It’s therefore recommended to use a different registrar where this is not a problem.
Stay secure,
Peter
It is possible to add new NS records, but it is not possible to delete the Hetzner records 
An SOA record and the assigned authoritative Hetzner name servers as NS records must be present.
This is why I opted for the secondary zone approach, but then I learned that deSEC does not support AXFR/IXFR.
The message sounds like you’re trying to add the NS records inside your DNS zone at Hetzner. That is not the correct approach. Instead, you need to adjust your domain’s delegation (which would be somewhere around the domain configuration, not where the DNS records are configured).
Does that help?
Stay secure,
Peter
Thank you 
I have now updated my NS records.
Using the recommended DNSSEC Analyser, the results are good, except for one issue:
No DS records found for frede.me in the me zone
Is this because I haven’t completed step 2, Enable DNSSEC, yet?
It says that I need to forward the provided DNSSEC information to my domain provider.
I’m wondering how to do this.
Since changing the NS records, changes made in Hetzner’s DNS tool are now ignored.
I also read that Hetzner does not support DNSSEC.
I’ve tried reading up on it, but unfortunately this is a bit out of my comfort zone, and I’m still a little confused about what to do and where to do it.
Therefore, any help would be much appreciated!
Yes.
I have never used Hetzner as domain registrar. Either they have a web UI for entering the DS or DNSKEY data (to be forwarded to the parent domain) or you will need to open a support ticket to get them to do this.
If you go the ticket route, don’t be discouraged by negative answers from 1st-level support. In my experience with other domain registrars they often tend to dismiss these requests at first. Be persistent and hopefully you’ll get someone who actually understands the issue to resolve your ticket.
They don’t need to support DNSSEC on their NS to handle setting the DS records in the parent domain.
Yes, this is often the most difficult step in setting up a DNSSEC secured domain. There are mechanisms in existence (or in the process of being specified) that would allow automating this step. People of deSEC e.V. have been very active in this area. But so far the list of domain registrars / registries using them is extremely small. See e.g.: Support for CDS/CDNSKEY/CSYNC updates
HTH
fiwswe
I have received a response to my support request:
wir sammeln aktuell die Anfragen bzgl. DNSSEC und beobachten deren Entwicklung.
Gerne leiten wir ihren Wunsch sozusagen als Feature Request entsprechend weiter.
Ob/wann DNSSEC schließlich verfügbar sein wird, können wir leider nicht beantworten.
Wir können aus Kulanz anbieten, für .de Domains die DNSKEYs und für .com/.net Domains die DS-Records zu hinterlegen. Dies kann jedoch nur bei Verwendung eigener Nameserver durchgeführt werden. Die Hetzner Nameserver unterstützen dies nicht.
Bitte beachten Sie, dass bei einem Domainupdate das SchlĂĽsselmaterial wieder ĂĽberschrieben werden wĂĽrde.
Bei größerer Anzahl an zu bearbeitenden Domains ist es möglich, dass wir hierfür
remoteHands (21,-€ pro angf. Viertel Stunde zzgl. Mwst.) berechnen müssen.
FĂĽr .me Domains kann aber leider kein DS Record gesetzt werden.
It seems that switching to a new domain registrar is the only option left.
Yes, looks that way. 
Like I mentioned before, the domain registrar does not have to support DNSSEC on their NS in order to set the DS records in the parent domain.
And it is obvious, that when the delegation changes (probably what they meant by “Domainupdate”), the DS records get clobbered.
I’m not sure “Kulanz” (Goodwill) is the correct term here? Aren’t domain registrars obliged to handle this service for all parent domains that support DNSSEC? OTOH .me is a ccTLD and the normal ICANN contracts don’t apply. So for .com/.net they’d have to do this service, but not for .de or .me.
Kind of sad state of affairs. If they can handle one TLD, handling all others shouldn’t be that much extra work. They can even handle .de which requires passing the DNSKEY, not the DS record. Does every ccTLD have a different API for registrars?
Especially for a large hosting company like Hetzner this is disappointing.