# I built my own root DNS so I could stop renting names > Source: > Published: 2026-08-16 13:07:34+00:00 # I built my own root DNS so I could stop renting names *2026-08-16, by Anthony “chovy” Ettinger.* **How this was written:** drafted with an AI assistant from my own notes, then edited by me. ## I got tired of renting names Every idea I have costs twelve dollars a year before it exists. Not hosting — the *name*. I pay a registrar, who pays a registry, who operates a top-level domain under a contract with ICANN, and at the end of that chain I get a string of text that I do not own and never will. I lease it. Miss a renewal notice in a spam folder and somebody who has never heard of my project owns my namespace and wants four figures for it back. Multiply that by the number of half-finished things in my home directory and it is a subscription to my own imagination. So I stopped paying it and started building the other end of the stack. It is called the **Moshpit**. It is a root. Not a registrar, not a reseller, not a wrapper over somebody else's TLD — an actual name authority with its own root and its own resolver, and you can claim `.anything` in it right now: ## What you actually get The namespace is one level deep and first come, first served. You claim an ending — `.eggs` , `.hacker` , `.rank` , whatever nobody took yet — and from that moment every name under it is yours to mint. Not for a dollar each. For nothing. `scrambled.eggs` , `over-easy.eggs` , four hundred more at 2am because you felt like it. Holding the ending *is* the ownership; the names under it are just rows you write. You can point one ending at another, too. Alias `.agentic` to `.agent` and the whole namespace follows — `foo.agentic` resolves to `foo.agent` — while any name you specifically exempt stays exactly where it is. That is a thing the real DNS root cannot do for you at any price. As I write this the registry has **5,679 endings** claimed. I am holding most of them, which is either land-grabbing or bootstrapping depending on how charitable you feel, and I have listed the ones I am sitting on for a couple of dollars so they are not just parked forever in my account. Anything nobody has claimed is still free and still first come, first served. ## How it resolves, honestly Here is the part most “alternative DNS” projects are cagey about, so let me be blunt: **a Moshpit ending is not in the public DNS root, so nothing resolves it until you turn the resolver on.** There is no magic. Your laptop asks a root server about `.eggs` and gets told no such thing exists, because as far as the thirteen root servers are concerned, that is true. So you run the bridge: ``` sudo moshcode dns enable ``` That installs a local resolver that answers Moshpit names out of the registry and forwards every other lookup untouched. Your `github.com` still goes where it always went. There is also a DNS-over-HTTPS endpoint at `https://dns.moshcode.sh/dns-query` , standard RFC 8484, both the GET and POST forms, if you would rather point a client at it than change your system resolver. It is opt-in and it stays opt-in. It is not in the installer, it does not happen on upgrade, and no other command turns it on as a side effect. That rule exists because I once let something enable it automatically and handed a colleague a machine whose resolver had been rewritten without being asked, which is a spectacular way to ruin somebody's morning. Rewriting how a computer resolves names is a thing a human types on purpose or not at all. ## The tradeoffs I am not going to hide Living outside the public root has real costs and you should know them before you move anything you care about: **No public CA will issue you a certificate.** Not Let's Encrypt, not anyone — they can only validate names in the DNS root, and yours is not. So it is`http://` on port 80. In Caddy you must write the scheme explicitly or it will try to get a cert and fail forever. There is a local CA and a pinned-TLS proxy for real HTTPS on these names, and that is a whole post of its own.**Targets are IPv6 or a hostname.** IPv4 literals are refused on purpose: an A record on a small box is usually leased or behind NAT, and it goes stale without telling anybody. A dead name that looks alive is worse than no name.**DNS carries an address, not a port.** The browser goes to 80 no matter what you wish. If your thing lives on 3000, put a web server in front of it. ## Standing a site up Put your server's IPv6 address in the name's target field — just the address. Then serve the name on port 80. Nothing proxies and nothing redirects; the browser connects straight to your box with `Host: seo.rank` , so your web server needs a block that answers to it. ``` http://seo.rank { root * /var/www/seo.rank file_server } ``` Or in nginx: ``` server { listen [::]:80; server_name seo.rank; root /var/www/seo.rank; } ``` Then check your work: ``` moshcode dns resolve seo.rank curl -6 http://seo.rank/ ``` If you would rather not type any of that, ``` moshcode template install bun-caddy-sqlite ``` writes the Caddyfile, the systemd units and a Bun + SQLite service already wired up correctly. `moshcode template list` shows the rest. ## No server? The name can still be a site This is my favourite part and it was almost an afterthought. Paste an RSS or Atom URL into the feed box on any name you hold and the pit draws the site for you. A blog feed renders as posts — date, headline, opening lines, link out to the real article. A podcast feed renders as episodes with cover art and a player on each one, from the same URL you already submit to Apple and Spotify. It is hosted nowhere and it updates whenever your feed does. A name with both a target and a feed serves the target — a server you stood up beats a page I drew for you. Clear the target and the feed takes back over, which quietly makes the feed a soft landing for a site that has fallen down. The pit fetches and caches it for a few minutes, so getting linked somewhere busy does not turn into a traffic bill on your feed host. ## Build on it Names are the boring half. The interesting half is that you can develop and ship applications on this network with the Moshpit dev stack — the templates, the resolver, the local certificate story and the deploy path, all of it assuming from the first line that your app lives at a name nobody rented you. That lives at [dev.moshcode.sh](https://dev.moshcode.sh), and the CLI that drives all of it installs the usual way: ``` curl -fsSL https://moshcoding.com/install.sh | sh ``` ## Why I think this matters I am not pretending this replaces ICANN or that your bank should move to `.money` . Names outside the root will not work for someone who has not opted in, and that is a permanent, structural property of what I built, not a beta limitation I will fix in version two. But there is something worth having in a namespace with no landlord in it. Nobody invoices me. Nobody can take `.hacker` away because a trademark lawyer sent a letter, or because a registry got acquired, or because I was on a plane the day a renewal failed. The naming layer of the internet has been a rent-collection business for thirty years and most of us just accepted it as physics. It is not physics. It is a file that says who is authoritative for what, and anybody can write one. So I wrote one. Go take `.anything` — [app.moshcode.sh/pit](https://app.moshcode.sh/pit). It is free, and the only thing I ask is that you build something on it.