[rovr138]

I don’t see much issues with privacy or security with a service like this.

They don’t get traffic going through them. They mainly exist to point to an IP. With enough data they have information on how an ISP rotates IP’s and who they’ve gone to.

In your case, with a WireGuard VPS, all traffic goes through the server. That’s a very different setup.

In their case, a request goes to them at a regular interval and they update the IP the dns record points to. That’s it.

When someone requests the domain, they simply respond with an IP. At most, if there’s little caching, they could get frequency of usage.

[ignoramous]

> They don’t get traffic going through them.

A rouge DNS can reply to select queries with an IP of a middleware that can TLS proxy and/or MitM that traffic.

We built such a thing mostly for anti-censorship purposes (bypass IP blocks): https://github.com/celzero/midway#demo

[wink]

I use duckdns and the only service I'm accessing through that CNAME is ssh, which checks host keys, so it doesn't have to be a problem.

[drexlspivey]

wouldn’t that invalidate the cerificate?

[piperswe]

If they control the domain, they can get a new valid certificate