About

Why we built this

We run our own DNS, and we wanted two things at once. First, we wanted to keep our zones. Our records live in files that we version, review and deploy like the rest of our infrastructure. We did not want to click them into a hosting provider's web form, one record at a time, with no history and no way to script it.

Second, we did not want our nameserver on the public internet. It is one more machine to patch, and it becomes a target the moment it answers strangers.

Those two goals normally cancel each other out. Either you hand your zones to someone else's interface, or you keep them and expose the server that holds them.

So we built the service that gives you both. Your DNS server stays behind your firewall and stays the source of truth. We take a copy of each zone and answer the internet for you.

What is hiddenprimary.ch?

hiddenprimary.ch is a DNS proxy service. We mirror your DNS zones via AXFR/IXFR from a hidden primary server behind your firewall, optionally sign them with DNSSEC, and serve them through our distributed nameserver infrastructure across Switzerland and Europe.

Why hidden primary?

In a hidden primary setup, your authoritative DNS server is never exposed to the public internet. Only two of our hosts ever connect to it: the one that signs and serves your zones, and the standby that takes over if that host goes down. We publish their addresses for your allow-list, and you can require TSIG on top. Our nameservers handle all public queries. This reduces your attack surface and gives you full control over your zone data.

Infrastructure

Our nameservers run in Swiss and European data centres. All data is processed and stored in accordance with Swiss data protection law.

Technology

hiddenprimary.ch runs a high-performance authoritative nameserver on every node. We provide a REST API, a web portal, and a Terraform provider for managing zones programmatically.

Operator

hiddenprimary.ch is operated by Piremus Cross LLC, Albuquerque, New Mexico, USA.
See the Imprint for full contact details.