

I just self-host my own DNS server. Works like a charm. Setting up DNSSEC was a tad fiddly tho.
Long story short:
- Set up Knot, teach it to serve your zone
- Test via resolving names in your server (
dig
can use a specific server) - Disable DNSSEC
- Tell your registrar to “use my own DNS server”
- Generate the DNSSEC keys, upload only the pubkey to registrar, reenable
Are you sure you need DYNDNS? My ‘dynamic’ IP address changes so rarely that I just update my DNS entries manually when it does.
Could you elaborate on the “non-spying” bit? There’s not much they can infer from people looking up your IP. Unless you run their daemon that updates the IP, as opposed to curl in cron.