This year, all owners of .ch domains need to switch from the DNS registry SWITCH to a new registrar. Getting an overview over these registrars is hard. Thankfully, Marc Wäckerlin has started the road to transparency with a price comparison of Swiss .ch domain registrars. Here, I extend his results with a survey of DNSSEC support.
Update: Information received after 2 April 2015 is only reflected in the German table!
Transparency is especially important in a market for digital goods, as many of their properties will only become known after having been paid for. For example, whether a registrar supports DNSSEC will only be known once you have transferred domains thereand tried to register the necessary DS or DNSKEY records. By then, you have already paid your fees or maybe even lost existing DNSSEC-related records.
As I wanted to be able to continue to use my DNS records containing SSHFP or TLSA entries (for DANE), I needed a registrar with DNSSEC support. Few of them had any information in their FAQ, so I started asking them on their support channels. I based my survey on the excellent price comparison by Marc Wäckerlin.
The result of the responses is shown below. The “DNSSEC” column and the underlined parts are mine, the rest is translated verbatim from Marc Wäckerlin’s table.
| Registrar | DNSSEC | Price (CHF) | Comments |
|---|---|---|---|
| Acribis (via INWX) | Web interface | 12.00 | |
| iway.ch | Web interface | 14.00 | |
| Netzone | Web interface | 12.90 | |
| Cyon | Web interface | 14.90 | |
| Hostpoint | Web interface | 15.00 | |
| Q-X | Manual* | 9.90 | |
| Firestorm | Manual (Web interface starting Easter) | 13.00 | First year 8.00 – lure, regular price hidden in footnote |
| switchplus.ch | Manual (Web interface starting 2016) | 15.50 | |
| Hosttech | in the works | 10.70 | |
| Centinated | planned (May)* | 12.20 | |
| Novatrend | planned (April) | 12.95 | |
| rhone.ch | planned (this week) | 13.80 | |
| Amenic | planned (in the next few weeks) | 14.90 | |
| Infomaniak | No | 8.90 | |
| Hoststar | No | 11.90 | |
| Kreativmedia | No | 11.90 | |
| Simplehosting | No | 14.50 | |
| webland.ch | No | 14.90 | |
| Hostfactory (OptimaNet) | Nein | 15.00 | First year free – properly declared |
| Exigo | No | 15.50 | |
| Metanet | ? | 10.75 | |
| schweizer-domains.ch | ? | 12.50 | |
| Green | (still in discussion with their support) | 14.50 | |
| domainpartner.ch | ? | 15.50 | |
| MHS | ? | 15.50 | Price hidden in FAQ |
| domainpartner.ch (ITF) | ? | 15.50 | Price well hidden |
| Hightechbits (Bighosting) | ? | 17.00 | redirect |
* Response within 30 minutes (and this after 10pm!)
I was astonished to learn that SWITCHplus does not support DNSSEC anytime soon, even though its parent company SWITCH has been offering this for years.
According to Marc Wäckerlin, webagentur.ch, ticino.com, IPS, Everyware, and Core do not publish any prices, they have not been included in this comparison.
Domain Marktplatz and Swisscenter seem to offer registrar services only to customers of their other services and therefore do not seem to be relevant for readers of this post.
I performed this survey on the evenings of 30th of March (between 10pm and 11pm) and 31st of March (between 5pm and 7pm). Two companies, namely Q-X and Centinated, responded within few minutes, even though my query arrived after 10pm! Companies without response after more than 48 hours can be identified by the question mark in the DNSSEC column. Of course, response times should be viewed as snapshots only and cannot be generalized to response time for other requests.
3 responses to “DNSSEC for .ch domains”
I can not recommend switchplus if you plan to deploy DNSSEC. Although “swichie” claims that by contacting switchplus support it should be possible to add DS entries to your domain, my request did not materialized in any zone change so far. That is after more than two weeks since I sent the request and two phone calls with the switchplus support team…
I am using Q-X, which did not have DNSSEC support when I did my original poll (updates are reflected only in the German table). Their DNSSEC interface is nothing fancy (copy/paste of DS record), but what do you need more?
[…] remains is to register the Zone Signing Key (ZSK, the one you created with -fk above) with your DNS registrar. The information you need is in Kexample.de.+007+62928.key, the file name printed as part of the […]