Your DNS server stays private. We answer the internet for it.
You keep running your own nameserver — behind a firewall, in a rack, at home. It hands us a copy of each zone, and from then on the public talks to us: multiple nameservers in several countries, around the clock, whether your machine is reachable or not.
Where this fits
The setups people usually arrive with.
The primary is public
Teams running their own authoritative nameserver
The machine that holds your zone files is also the machine answering the whole internet. Every security update turns into a reboot of the server you can least afford to restart. Behind us, only two of our hosts ever reach it: the one that signs and serves your zones, and the standby that takes over if that host goes down. That is a short allow-list in your firewall, and you can require a shared key on top of it.
Two nameservers, one rack
Operators whose ns1 and ns2 share infrastructure
ns1 and ns2 often turn out to be two machines in the same building, on the same uplink. If it fails, DNS does not get slower — it stops, and mail delivery and certificate renewals stop with it. We answer from four nameservers on three hosts in Germany and Switzerland, over IPv4 and IPv6, and we keep answering from the copy we already hold.
Signatures expire on Sunday
Anyone doing their own DNSSEC signing
An RRSIG that ran out, or a KSK rolled without updating the DS at the registrar, does not degrade gradually: every validating resolver SERVFAILs the whole zone at once. We sign inline and keep signatures current, or serve your pre-signed zone untouched — and re-check hourly that the DS at the parent still matches what we actually answer with.
DNS on a home connection
Homelab and self-hosted setups
Your DNS server runs at home, on a connection whose address changes and that you would rather not expose to the internet. We handle changing addresses ourselves — no dynamic DNS provider, no update script, nothing extra to keep running. Your server simply announces a change the way it already does, and we follow it. Tick one box when you add the zone and give it a shared key; that key is what proves the new address is still you.
Zones generated, not typed
IPAM, Ansible or Windows DNS pipelines
Records come out of Active Directory, an IPAM or a config-management run, so retyping them into a web UI is not an option. AXFR is already your export path — point it at us, drive zones from the REST API or the Terraform provider, or upload the zonefile if you would rather not run a primary at all.
How it works
Point transfers at us
Allow AXFR/IXFR from our transfer addresses on your hidden primary. Optional TSIG authentication.
allow-transfer { 159.69.29.118; 2a01:4f8:1c0c:63c4::118; 45.131.252.44; 2a11:8b80:1000:1::18; };
We pull & serve
Zones sync automatically via AXFR/IXFR on NOTIFY. Your origin stays hidden — we serve the public copy.
NOTIFY → AXFR → zones live in seconds
Update your NS records
Point NS records at our nameservers. Zones are served across Switzerland and Europe — reachable worldwide. Your origin stays hidden.
@ NS ns1.hiddenprimary.ch.
@ NS ns2.hiddenprimary.ch.
@ NS ns3.hiddenprimary.ch.
@ NS ns4.hiddenprimary.ch.
What you get
Your primary never answers a public query.
Only two of our hosts ever connect to it: the signer and its standby. That is a short allow-list in your firewall, not the open internet.
We keep answering for your zones when your primary does not.
Your server being offline, rebooting or unreachable does not affect your availability.
DNSSEC you do not have to maintain.
We sign your zones and roll the keys. You publish one DS record at your registrar, and we check every hour that it still matches.
We check every zone we receive.
A zone that will not parse, or nameservers that do not point to us, shows up in your portal instead of in your inbox — and from Business up, the record semantics too: a CNAME at the apex, SPF, DMARC.
You can see what your zones are doing.
A log of every transfer, on every plan. Per-zone query analytics — by month, day and hour — and a health check against each of our nameservers need a higher plan; see the plans below.
Every zone operation in the portal is also an API call.
Scoped keys and a Terraform provider on every plan. Signed webhooks into your own tools need a higher plan — see the plans below.
Your own nameserver names work on every plan.
Name our servers ns1.yourdomain in your zone and point the glue at our
addresses — DNS does not care which plan you are on. What Business adds is the
registration: we then recognise those names as ours, check the glue every 15 minutes,
and stop warning you on every zone that your delegation does not reach us
(NS_MISSING_OURS).
One login per account.
A plan without team access is one user with full rights. Inviting colleagues with their own roles needs a higher plan — see the plans below.
No lock-in.
Standard zone transfer in both directions — the same thing that gets you in gets you out.
Plans
14-day free trial · No credit card required · Cancel anytime
- AXFR/IXFR + Push upload
- DNSSEC inline signing
- Zone validation (syntax)
- Zone transfer history
- REST API + scoped keys
- One login — team access from Max
- Everything in Professional
- Query Analytics
- Vanity nameserver registration
- Advanced Zone Validation
- One login — team access from Max
- Everything in Business
- Multi-User / Team Access
- Webhook Notifications
- SSL/Domain Monitoring
- NS Health Dashboard
- Priority Support
REST API
Every zone operation is an API call
Manage zones, DNSSEC, and transfers programmatically. Scoped API keys for granular access control.
- GET/v1/zones
- POST/v1/zones
- POST/v1/zones/{id}/transfer
- POST/v1/zones/{id}/dnssec/enable
- GET/v1/zones/{id}/stats
- DEL/v1/zones/{id}
Portal Preview
Frequently asked questions
What happens if my hidden primary goes down?
Nothing, for your users. Our nameservers keep answering from the last transferred copy of your zone — resolution continues through your outage while you bring the primary back.
How does the 14-day trial work?
Register free, no card — full access for 14 days. To keep your zones serving past the trial, add a plan. Otherwise they go read-only: we stop pulling updates from your primary and keep answering from the last transferred copy. Zones we sign for you (inline DNSSEC) also stop being re-signed, so their signatures expire and validating resolvers start to fail them — well before the zones are removed after 45 days. Your configuration is kept, so you can resume anytime by subscribing.
Can I migrate without downtime?
Yes. Add your zone, let us pull and verify it, then add our nameservers at your registrar alongside your existing ones and remove the old set when you are confident. Resolution never stops. See the migration guide.
Which IP addresses do I need to allow?
You allow zone transfers from our transfer addresses on your primary — they are listed in the getting-started guide and in your portal. TSIG-authenticated transfers are supported on every plan.
Is there vendor lock-in?
No. Everything runs on standard DNS: AXFR/IXFR, NOTIFY, TSIG. Your primary keeps the source of truth — repoint your NS records at any time and you are out.
Do I need to run DNSSEC myself?
No. Enable inline signing in the portal — we sign your zone as we serve it and hand you the DS record for your registrar. ZSK rotation is automated.
Ready to hide your primary?
Set up in under 10 minutes. No credit card required.