Kuuko / Build it yourself

Build it yourself · Part 1Checked: 30 October 2026

Chapter 1: A domain of your own

Why

Your devices will reach your resolver by a name, dns.<your-domain>. Encrypted DNS needs that name: it's what the certificate proves (chapter 5), and it's how your devices know they're talking to your server and nobody else. A name you own also stays yours if you change server or provider later.

What you need

  • A registrar: a company that sells domains. We use Spaceship; any registrar that offers two-factor login and a transfer lock will do.
  • About 15 minutes (our estimate).

Steps

  1. Pick a name and an ending you'll keep. A short name is easier to type when you set up a device. The resolver will live on a subdomain of it, dns.<your-domain>, so the main name stays free for anything else.
  2. Check the renewal price before you buy. Many registrars sell the first year cheaply and charge much more from the second year on. In May 2026, a .com renewed for about $10 at the cheapest registrars and $23 or more at some well-known ones.
  3. Buy the domain.
  4. Turn on two-factor login for your registrar account. Whoever controls this account controls your domain, and with it where your devices send their questions.
  5. Turn on the transfer lock (sometimes called "registrar lock"). It stops anyone from moving the domain to another registrar without you unlocking it first.
  6. Turn on WHOIS privacy, if your registrar offers it, so your name and address aren't published with the domain.
  7. Note the renewal date in your calendar, or turn on auto-renew. An expired domain means your devices can't find your resolver.

How you know it worked

  • In your registrar account, the domain shows as active, with the transfer lock on and two-factor login enabled.

  • In a terminal on your Mac:

    whois <your-domain>

    The status lines include clientTransferProhibited, the transfer lock. The exact output differs between endings and registrars.

Pitfalls

  • Endings like .io carry extra uncertainty. Some country endings depend on decisions you have no say in. Prefer a common ending you expect to keep for years, and buy only what you need.
  • The first-year price isn't the price. Compare renewals, not offers.

Time and cost

  • About 15 minutes (our estimate).
  • A .com renews for about $10–23 a year at common registrars (May 2026); some charge more.

Next: Chapter 2: DNS hosting with DNSSEC

Text: CC BY-SA 4.0 · Commands and configs: CC0