Hetzner & deSEC

Managed DNS Hosting DNSSEC Setup Guides
1

Hi,

I have used Hetzner for quite some time for domain registration and server hosting.

However, having read up on DNS security, I would now like to switch to deSEC for all my DNS needs.

Unfortunately, I cannot delete the Hetzner NS records and deSEC does not seem to support AXFR/IXFR.

This means that I cannot implement the setup described here: https://docs.hetzner.com/networking/dns/faq/nameservers.

Is there any other way to set up Hetzner and deSEC together?

Thank you!

2

Hi f75dti7m,

Thanks for your message, and welcome to deSEC! :slight_smile:

That seems like a Hetzner problem, as you should be able to set custom NS records (according to the docs you linked).

Note that Hetzner only sometimes allows setting DS records to enable DNSSEC, which is required when using deSEC. It’s therefore recommended to use a different registrar where this is not a problem.

Stay secure,
Peter

1 Like
3

It is possible to add new NS records, but it is not possible to delete the Hetzner records :person_shrugging:

An SOA record and the assigned authoritative Hetzner name servers as NS records must be present.

This is why I opted for the secondary zone approach, but then I learned that deSEC does not support AXFR/IXFR.

4

The message sounds like you’re trying to add the NS records inside your DNS zone at Hetzner. That is not the correct approach. Instead, you need to adjust your domain’s delegation (which would be somewhere around the domain configuration, not where the DNS records are configured).

Does that help?

Stay secure,
Peter

2 Likes
5

Thank you :folded_hands: I have now updated my NS records.

Using the recommended DNSSEC Analyser, the results are good, except for one issue:

No DS records found for frede.me in the me zone

Is this because I haven’t completed step 2, Enable DNSSEC, yet?

It says that I need to forward the provided DNSSEC information to my domain provider.

I’m wondering how to do this.

Since changing the NS records, changes made in Hetzner’s DNS tool are now ignored.

I also read that Hetzner does not support DNSSEC.

I’ve tried reading up on it, but unfortunately this is a bit out of my comfort zone, and I’m still a little confused about what to do and where to do it.

Therefore, any help would be much appreciated!