Authoritative DNS Hosting Is Not Private DNS Resolution
“Private DNS” often means encrypted recursive resolution on a phone or browser. Authoritative DNS hosting is a different role: it publishes the records for a domain. Confusing them can lead a domain owner to believe DNSSEC or a privacy-branded host conceals queries, ownership, or zone data when it does not. Resolver setup is covered separately in the private DNS setup guide.
DNSSEC is authentication, not confidentiality. RFC 4033 says DNSSEC provides origin authentication and integrity protection and does not provide confidentiality. Signed records remain public, and a recursive resolver can still observe the names a client asks it to resolve.
Follow one lookup through the system
| Role | Job | What it can observe | What it does not solve |
|---|---|---|---|
| Stub resolver | Sends the device query | Application request and configured resolver | Does not validate the whole chain by itself in many deployments |
| Recursive resolver | Finds and caches the answer | Client address or account, queried name, timing, response | Does not control the domain zone |
| Authoritative host | Publishes the domain zone | Zone records, changes, API account, query traffic reaching its servers | Does not hide resolver queries or registration data |
| Registrar and registry | Maintain registration and delegation | Registrant or customer records, nameservers, payment and legal requests | Do not become private because DNSSEC is enabled |
| DNSSEC chain | Authenticates signed DNS data | Public keys, signatures, denial proofs, delegation state | Does not encrypt names or answers |
RFC 8499 defines an authoritative server as one that answers authoritatively for a zone and a recursive resolver as a system that receives queries and obtains final answers by following referrals or using cached data. One organisation may operate both services, but the protocol roles and evidence remain distinct.
What an authoritative host receives
A hosted zone contains public records by design: addresses, mail exchangers, verification tokens, nameservers, and other data the owner publishes. The operator also needs an account or API control plane to change those records. That layer can create registration, authentication, token, timestamp, source-address, abuse, support, and donation records even though it never sees the user's ordinary browsing history.
deSEC is a useful limited example. Its official materials describe free, donation-funded authoritative DNS hosting with automatic DNSSEC and an API. Its terms say service is provided without an availability guarantee, permit throttling or disabling accounts that cause extraordinary load or cost, and say dynamic DNS domains not updated for six months may be deleted after four weeks' warning. These facts describe hosting operations, not private recursive resolution.
Evidence limit: deSEC's current privacy-policy route returned only its client application shell during this review. Full account fields, operational log retention, processors, and deletion behavior could not be independently captured. deSEC is therefore an example in this worksheet, not a Cunicula directory recommendation.
Provider evidence worksheet
Domain privacy also depends on the registrar and registration model. The domain registration guide covers WHOIS or RDAP exposure, payment records, and registrar trust, none of which an authoritative DNS host can erase.
Sources
- RFC 8499: DNS terminology for authoritative servers and recursive resolvers, retrieved 17 August 2026
- RFC 4033: DNSSEC introduction, guarantees, and confidentiality limit, retrieved 17 August 2026
- deSEC: terms, availability, load, and inactivity rules, retrieved 17 August 2026
- deSEC: organisation and service purpose, retrieved 17 August 2026
- deSEC Stack: authoritative-server and API architecture, MIT licence, retrieved 17 August 2026
- deSEC API documentation, retrieved 17 August 2026
Frequently Asked Questions
Is authoritative DNS hosting the same as private DNS?
No. Authoritative hosting publishes records for a domain. Recursive resolution looks up names for users. A private recursive resolver changes who handles lookup traffic; it does not host or conceal the domain’s authoritative zone.
Does DNSSEC encrypt DNS queries?
No. DNSSEC authenticates DNS data and denial-of-existence responses. RFC 4033 explicitly states that it does not provide confidentiality for DNS data.
Does using deSEC make domain ownership anonymous?
No. deSEC is an authoritative DNS host, not an anonymity service or registrar shield. Registrar and registry records, account data, zone contents, API activity, donations, and abuse handling remain separate evidence questions.