I built my own root DNS so I could stop renting names — Chovy's Blog

I built my own root DNS so I could stop renting names

2026-08-16, by Anthony “chovy” Ettinger.

How this was written: drafted with an AI assistant from my own notes,<br>then edited by me.

I got tired of renting names

Every idea I have costs twelve dollars a year before it exists. Not hosting — the<br>name. I pay a registrar, who pays a registry, who operates a top-level domain under a<br>contract with ICANN, and at the end of that chain I get a string of text that I do not own and<br>never will. I lease it. Miss a renewal notice in a spam folder and somebody who has never heard<br>of my project owns my namespace and wants four figures for it back.

Multiply that by the number of half-finished things in my home directory and it is a<br>subscription to my own imagination. So I stopped paying it and started building the other end of<br>the stack.

It is called the Moshpit . It is a root. Not a registrar, not a reseller, not<br>a wrapper over somebody else's TLD — an actual name authority with its own root and its own<br>resolver, and you can claim .anything in it right now:

app.moshcode.sh/pit

What you actually get

The namespace is one level deep and first come, first served. You claim an ending —<br>.eggs, .hacker, .rank, whatever nobody took yet — and<br>from that moment every name under it is yours to mint. Not for a dollar each. For nothing.<br>scrambled.eggs, over-easy.eggs, four hundred more at 2am because you<br>felt like it. Holding the ending is the ownership; the names under it are just rows you<br>write.

You can point one ending at another, too. Alias .agentic to .agent<br>and the whole namespace follows — foo.agentic resolves to<br>foo.agent — while any name you specifically exempt stays exactly where it is.<br>That is a thing the real DNS root cannot do for you at any price.

As I write this the registry has 5,679 endings claimed. I am holding most of<br>them, which is either land-grabbing or bootstrapping depending on how charitable you feel, and I<br>have listed the ones I am sitting on for a couple of dollars so they are not just parked forever<br>in my account. Anything nobody has claimed is still free and still first come, first served.

How it resolves, honestly

Here is the part most &ldquo;alternative DNS&rdquo; projects are cagey about, so let me be<br>blunt: a Moshpit ending is not in the public DNS root, so nothing resolves it until you<br>turn the resolver on. There is no magic. Your laptop asks a root server about<br>.eggs and gets told no such thing exists, because as far as the thirteen root<br>servers are concerned, that is true.

So you run the bridge:

sudo moshcode dns enable

That installs a local resolver that answers Moshpit names out of the registry and forwards<br>every other lookup untouched. Your github.com still goes where it always went. There<br>is also a DNS-over-HTTPS endpoint at https://dns.moshcode.sh/dns-query, standard<br>RFC 8484, both the GET and POST forms, if you would rather point a client at it than change your<br>system resolver.

It is opt-in and it stays opt-in. It is not in the installer, it does not happen on upgrade,<br>and no other command turns it on as a side effect. That rule exists because I once let something<br>enable it automatically and handed a colleague a machine whose resolver had been rewritten<br>without being asked, which is a spectacular way to ruin somebody's morning. Rewriting how a<br>computer resolves names is a thing a human types on purpose or not at all.

The tradeoffs I am not going to hide

Living outside the public root has real costs and you should know them before you move<br>anything you care about:

No public CA will issue you a certificate. Not Let's Encrypt, not anyone<br>— they can only validate names in the DNS root, and yours is not. So it is<br>http:// on port 80. In Caddy you must write the scheme explicitly or it will try<br>to get a cert and fail forever. There is a local CA and a pinned-TLS proxy for real HTTPS on<br>these names, and that is a whole post of its own.

Targets are IPv6 or a hostname. IPv4 literals are refused on purpose: an<br>A record on a small box is usually leased or behind NAT, and it goes stale without telling<br>anybody. A dead name that looks alive is worse than no name.

DNS carries an address, not a port. The browser goes to 80 no matter what<br>you wish. If your thing lives on 3000, put a web server in front of it.

Standing a site up

Put your server's IPv6 address in the name's target field — just the address. Then serve<br>the name on port 80. Nothing proxies and nothing redirects; the browser connects straight to your<br>box with Host: seo.rank, so your web server needs a block that answers to it.

http://seo.rank {<br>root * /var/www/seo.rank<br>file_server

Or in nginx:

server {<br>listen [::]:80;<br>server_name seo.rank;<br>root /var/www/seo.rank;

Then check your work:

moshcode dns resolve seo.rank<br>curl -6 http://seo.rank/

If you would rather not type any of that, moshcode template install<br>bun-caddy-sqlite writes the...