HU.HN

01 / DNS

Authoritative DNS, worldwide

The base of the hu.hn network is our globally distributed, highly available and non-recursive nameserver infrastructure. Every name resolution ends on one of these three hosts:

• Signed zones by default. DNSSEC protects resolution against spoofing, cache poisoning and related attack patterns.
• Authoritative only. The nameservers answer for our zones and nothing else. No recursion means a smaller attack surface and no use as an open resolver in amplification attacks.
• Modern cryptography. Post-quantum protections are part of our cryptographic baseline, so today's traffic stays protected tomorrow.

02 / Mail

Highly redundant, modern mail

Mail is our next primary service. It runs on Stalwart, a modern mail and collaboration server written in memory-safe Rust, in a highly redundant cluster with direct delivery to all major mail providers. The Stalwart codebase has been independently security-audited.

Three servers, each handling mail. Two run the complete service stack. The third acts as the witness: it does not carry the full stack, its job is to cast the deciding vote. Cluster decisions follow majority voting (quorum): a failover only happens when more than half of the voters agree. With only two nodes, a network split leaves each side unable to tell whether its peer has failed or is merely unreachable, so both could carry on independently (split brain). With three voters, at most one side of any split can hold a majority, so there is always exactly one authoritative side. This is the principle behind consensus algorithms such as Paxos and Raft. Any node can serve any protocol, and the delivery queue is shared, so another node takes over if one fails.

03 / Platform security

Security from the silicon up

These are our baseline security requirements for every system we operate. They start at the hardware, long before any software, customer or workload comes into play.

04 / Compliance

Not a checkbox. A moving target we follow.

We are not joking around here. The rules for hosting, DNS and mail change constantly, so we track legal and regulatory changes worldwide on an ongoing basis instead of waking up when an audit date gets close. More than 45 laws and standards are on our radar, across the EU, Germany, the UK, Switzerland, North America and beyond. NIS2 is the baseline for us, not the finish line: we build well beyond what it defines as the minimum.

Laws and regulations listed here are tracked and mapped to our controls. Standards listed here serve as reference frameworks for our controls. This overview describes our approach and is not a certification statement.

05 / Beyond this overview

Beyond what is listed here

06 / Standards & sources

Standards, specifications & law

The RFCs, standards and legal texts behind this overview, for anyone who wants to check our work.

07 / Research

The research we stand on

The papers, write-ups and advisories below shaped our design. Several of them show exactly where hardware protections end, and we included them on purpose: our threat model starts from those limits, not from the marketing sheet. Quorum voting is defined in the distributed-systems literature rather than in an RFC, so it lives here too.