diff --git a/ansible/roles/traefik/files/docker-compose.yml b/ansible/roles/traefik/files/docker-compose.yml
index bd7b03b..dbca10c 100644
--- a/ansible/roles/traefik/files/docker-compose.yml
+++ b/ansible/roles/traefik/files/docker-compose.yml
@@ -3,7 +3,7 @@ services:
     image: traefik:v3
     user: "{{ docker_user.id }}"
     environment:
-      - GANDIV5_PERSONAL_ACCESS_TOKEN={{ vault_gandi_personal_access_token if traefik_tls_challenge else "" }}
+      - DESEC_TOKEN={{ vault_desec_api_token if traefik_tls_challenge else "" }}
     volumes:
       - ./traefik:/etc/traefik
     restart: unless-stopped
diff --git a/ansible/roles/traefik/files/traefik.yml b/ansible/roles/traefik/files/traefik.yml
index 15adeef..be68893 100644
--- a/ansible/roles/traefik/files/traefik.yml
+++ b/ansible/roles/traefik/files/traefik.yml
@@ -68,7 +68,7 @@ certificatesResolvers:
       email: "{{ vault_letsencrypt_email }}"
       storage: /etc/traefik/acme.json
       dnsChallenge:
-        provider: gandiv5
+        provider: desec
         delayBeforeCheck: 0s
         resolvers:
           - 9.9.9.9:53
diff --git a/ansible/roles/traefik/vars/vault.yml b/ansible/roles/traefik/vars/vault.yml
index 377f974..1daad4b 100644
--- a/ansible/roles/traefik/vars/vault.yml
+++ b/ansible/roles/traefik/vars/vault.yml
@@ -1,11 +1,10 @@
 $ANSIBLE_VAULT;1.1;AES256
-30386663383635396466373834626430626462383133646239616665323761383466336662663362
-3732373963343133633833376330336432353734656566620a366637623761626635383365396637
-61656634303235373864623431313735633665616633363531313564666230313831386236363430
-6163613365393863620a336364653838633037333062336335303863623064616465313935633039
-37653066386164616634633065656639343637333266356234396163623539386430653232323036
-64666230396330353263383536346532333564303438346564376266653237313737386130386264
-32656566643339666663616539373865613466313731363663613766653832613961313336663938
-30626663663034336466626635663366333162326636363362393437383932306233326531373937
-35316362366539353336336536666431363039393562633665303561363636336364393264613638
-3033643736373566613838316162383739626463303532313865
+37396663623335333737663732353637333533363237653532633865663063343933373566383565
+6434663864643236616564623062306135326333346533620a663864326137653563656134316639
+64623865656164373337626231656638386363376133666366323738386639616530353937336338
+3764333064323231310a373463353764633562316233656366373561373731653836316136333730
+31373734326665666462363330326161303038646363326165653366666663333836313137633161
+33316130303539616337633262303731326562663932343139646463653034306562313065613137
+65346539346464303438653838643939313362313437623938623938636562366561623264646538
+32383432616566326466336336336537356539366563653765323039363236363738363234633633
+32613330646132346364343234613765313365616230623061353764363662303236
diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
index 29147db..69450e1 100644
--- a/terraform/.terraform.lock.hcl
+++ b/terraform/.terraform.lock.hcl
@@ -18,37 +18,6 @@ provider "registry.terraform.io/backblaze/b2" {
   ]
 }
 
-provider "registry.terraform.io/go-gandi/gandi" {
-  version     = "2.3.0"
-  constraints = "2.3.0"
-  hashes = [
-    "h1:+QRivNRiQfXbOzSJwIKOmpqRLjfSbgGTVIot5HHaxzU=",
-    "h1:9kqWL+eFk/ogrQSltL9zVqjMcOqbvs3EgIJEeyNPb8U=",
-    "h1:Fv/rdRU74oVDL6Tmu63qNl3fUrlOfMVPUFeLaPfWAGY=",
-    "h1:GC+kfSRx3FdF0dhh0LZrWXV+hLSFQd3cQ3mjQ3lBloU=",
-    "h1:M6MNub0wFKc/2MKOns9uWsgkFEjqNx1oucz+wGemBRM=",
-    "h1:Os/cyXb2LCyYLvaQ7inZPBdgjR7Ie5AsyIIHvYaMZB4=",
-    "h1:PH6KI61eli5OL/aN3Oi7NV9qkNbjGLoOYjJK3gvULj4=",
-    "h1:ZYWkA1hdIjQySftM5bWAQjiH50V5qMl9nJroYzCoqb0=",
-    "h1:aRZN5KmJwfLJ+sSYo4xd6MHS2oNk3Zlk417md3e9ry0=",
-    "h1:iTw/xbYXtScXLdhbjzF15Bf9wWu/r41ZertHYl9vDec=",
-    "h1:q/JXh50l2WZKxRpVTXzWp7nToqaU4TXD883k6Xi+8Jk=",
-    "h1:sSjatD9sHwGI8jJYF7Ps7BTBbmmCmLAdlUPDs3i/vQA=",
-    "zh:0936d011cf75bb5162c6027d00575a586807adc9008f4152def157b6ad22bae9",
-    "zh:2170e671f04d3346ea416fcc404be6d05f637eab7df77e289a6898a928885f0b",
-    "zh:250329baae3cb09cfb88dd004d45f003ba76fbe7b8daf9d18fd640b93a2b7252",
-    "zh:2ccd9f253424738ca5fbbcb2127bf3713c20e87bfb3829f8c4565569424fd0bd",
-    "zh:3607b48bc4691cd209528f9ffe16a6cc666bd284b0d0bdfe8c4e1d538559a408",
-    "zh:3bc1d2b770fe0f50027da59c405b2468d1322243235367014f75f765124f458d",
-    "zh:6c8a9092847ee2e2890825432b54424c456638d494e49b7d1845f055214714f5",
-    "zh:8e0b62a330876005d52bcd65d7b1d9a679a7ac79c626e0f86661519e8f9b5698",
-    "zh:8f44f4d52583ff249e2001ea2a8b8841010489dd43e1a01a9ec3a6813d121c28",
-    "zh:9a617927d4a3a2897ff10999a19a6d1f0ef634b8c6b8fc3be12cf53948cfd9cf",
-    "zh:cab3c82c54e38e6001eed5b80a2d16b7824921f8f8b3909049e174c48e6e8804",
-    "zh:f78cc685aa4ba5056ea53a7f8ce585f87a911f0a8a387a44a33d7dfb69db7663",
-  ]
-}
-
 provider "registry.terraform.io/hashicorp/aws" {
   version     = "4.67.0"
   constraints = "4.67.0"
@@ -173,3 +142,22 @@ provider "registry.terraform.io/linode/linode" {
     "zh:ee653d5d08cb331ce2d8dc1010e68d363470ae87be62c0515e5d2418727cd02b",
   ]
 }
+
+provider "registry.terraform.io/valodim/desec" {
+  version     = "0.6.1"
+  constraints = "0.6.1"
+  hashes = [
+    "h1:cXLLxqkdJoiW+p/aDEBH6KK+laPM+RtWyYxd8IZBBN8=",
+    "zh:08fb06d0654d638ada1e2be948ff1070ff73314d65416a8c50775f6faa3c4730",
+    "zh:141baab7ef9c63dae9fa8edadfae19fcede4bde0132d576d26010dfddeac3fa3",
+    "zh:2f41c0ef69de1d75efb567bb54b132ce238dd0cca9f42fd71a67db44b0927d5a",
+    "zh:305d5137b7003701792a92242dd6010ad61db4fe69d94c9e00a1ae37332a0543",
+    "zh:70c86277d8929e6af2400fead92f5998f9b1dabddf7e57c85d9c5ccd29fcfe92",
+    "zh:79163bb3b16df4ebafc2128a2d65daf1f5d85d0d3831577e243094cb34e4fa67",
+    "zh:8dc0b89e311ca1c7a3c0621b265274b1590fbc0839a66677e0232a61c3ffb78e",
+    "zh:bc57f2f11a0f8e29387ba852474fe48f2a739d86dcd8f2aad545881e9d763912",
+    "zh:c0a3cab6728d52fdf5e3147c9033d838f4cd5873aae2b16a12c7027d825737f1",
+    "zh:dac69febd0e4b7a0aa78ab926a10f8c550f3d85fe180c255912308d2a484b3af",
+    "zh:ff517fd13df0a539c1e41615daea66fa56ac0e46250bf20a423a36e459cf13be",
+  ]
+}
diff --git a/terraform/0rng.one.tf b/terraform/0rng.one.tf
index 93ca722..6fd660e 100644
--- a/terraform/0rng.one.tf
+++ b/terraform/0rng.one.tf
@@ -1,34 +1,35 @@
-resource "gandi_livedns_domain" "orngone" {
+resource "desec_domain" "orngone" {
   name = "0rng.one"
 }
 
-resource "gandi_livedns_record" "orngone_apex" {
-  zone = gandi_livedns_domain.orngone.id
-  name = "@"
-  type = "ALIAS" # Gandi doesn't support CNAME-flattening
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}."
-  ]
+resource "desec_rrset" "orngone_apex" {
+  domain  = desec_domain.orngone.name
+  subname = ""
+  type    = "A"
+  records = desec_rrset.sys_domain_walker.records
+  ttl     = local.dns_ttl_default
 }
 
-resource "gandi_livedns_record" "orngone_caa" {
-  zone = gandi_livedns_domain.orngone.id
-  name = "@"
-  type = "CAA"
-  ttl  = 3600
-  values = [
-    "0 issue \"letsencrypt.org\""
-  ]
+resource "desec_rrset" "orngone_apex_v6" {
+  domain  = desec_domain.orngone.name
+  subname = ""
+  type    = "AAAA"
+  records = desec_rrset.sys_domain_walker_v6.records
+  ttl     = local.dns_ttl_default
 }
 
-
-resource "gandi_livedns_record" "orngone_who" {
-  zone = gandi_livedns_domain.orngone.id
-  name = "who"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
-  ]
+resource "desec_rrset" "orngone_caa" {
+  domain  = desec_domain.orngone.name
+  subname = ""
+  type    = "CAA"
+  records = ["0 issue \"letsencrypt.org\""]
+  ttl     = local.dns_ttl_default
+}
+
+resource "desec_rrset" "orngone_who" {
+  domain  = desec_domain.orngone.name
+  subname = "who"
+  type    = "CNAME"
+  records = ["${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."]
+  ttl     = local.dns_ttl_default
 }
diff --git a/terraform/casey_vps.tf b/terraform/casey_vps.tf
index eb129a4..65d7df5 100644
--- a/terraform/casey_vps.tf
+++ b/terraform/casey_vps.tf
@@ -96,10 +96,10 @@ resource "linode_firewall" "casey" {
 
 resource "linode_rdns" "casey_reverse_ipv4" {
   address = linode_instance.casey.ip_address
-  rdns    = "${gandi_livedns_record.sys_domain_casey.name}.${gandi_livedns_record.sys_domain_casey.zone}"
+  rdns    = "${desec_rrset.sys_domain_casey.subname}.${desec_rrset.sys_domain_casey.domain}"
 }
 
 resource "linode_rdns" "casey_reverse_ipv6" {
   address = split("/", linode_instance.casey.ipv6)[0]
-  rdns    = "${gandi_livedns_record.sys_domain_casey.name}.${gandi_livedns_record.sys_domain_casey.zone}"
+  rdns    = "${desec_rrset.sys_domain_casey.subname}.${desec_rrset.sys_domain_casey.domain}"
 }
diff --git a/terraform/desec.tf b/terraform/desec.tf
new file mode 100644
index 0000000..190552c
--- /dev/null
+++ b/terraform/desec.tf
@@ -0,0 +1,28 @@
+# NOTE: Tokens must be created manually and imported, otherwise there's no way to access the token
+resource "desec_token" "traefik" {
+  name               = "traefik"
+  perm_create_domain = false
+  perm_delete_domain = false
+  perm_manage_tokens = false
+}
+
+resource "desec_token" "terraform" {
+  name               = "Terraform"
+  perm_create_domain = true
+  perm_delete_domain = false
+  perm_manage_tokens = true
+}
+
+resource "desec_token_policy" "traefik_default" {
+  token_id   = desec_token.traefik.id
+  perm_write = false
+}
+
+resource "desec_token_policy" "traefik" {
+  token_id   = desec_token.traefik.id
+  perm_write = true
+  subname    = "_acme_challenge"
+  type       = "TXT"
+
+  depends_on = [desec_token_policy.traefik_default]
+}
diff --git a/terraform/grimes_vps.tf b/terraform/grimes_vps.tf
index 239d92f..d183023 100644
--- a/terraform/grimes_vps.tf
+++ b/terraform/grimes_vps.tf
@@ -16,11 +16,11 @@ resource "hcloud_server" "grimes" {
 resource "hcloud_rdns" "grimes_reverse_ipv4" {
   server_id  = hcloud_server.grimes.id
   ip_address = hcloud_server.grimes.ipv4_address
-  dns_ptr    = "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}"
+  dns_ptr    = "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}"
 }
 
 resource "hcloud_rdns" "grimes_reverse_ipv6" {
   server_id  = hcloud_server.grimes.id
   ip_address = hcloud_server.grimes.ipv6_address
-  dns_ptr    = "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}"
+  dns_ptr    = "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}"
 }
diff --git a/terraform/jakehoward.tech.tf b/terraform/jakehoward.tech.tf
index 39f039e..22ee45c 100644
--- a/terraform/jakehoward.tech.tf
+++ b/terraform/jakehoward.tech.tf
@@ -1,344 +1,350 @@
-data "gandi_livedns_domain" "jakehowardtech" {
+resource "desec_domain" "jakehowardtech" {
   name = "jakehoward.tech"
 }
 
-resource "gandi_livedns_record" "jakehowardtech_mx" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "@"
-  type = "MX"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_mx" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = ""
+  type    = "MX"
+  ttl     = local.dns_ttl_default
+  records = [
     "10 in1-smtp.messagingengine.com.",
     "20 in2-smtp.messagingengine.com.",
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_dkim_fm1" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "fm1._domainkey"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_dkim_fm1" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "fm1._domainkey"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
     "fm1.jakehoward.tech.dkim.fmhosted.com."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_dkim_fm2" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "fm2._domainkey"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_dkim_fm2" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "fm2._domainkey"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
     "fm2.jakehoward.tech.dkim.fmhosted.com."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_dkim_fm3" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "fm3._domainkey"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_dkim_fm3" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "fm3._domainkey"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
     "fm3.jakehoward.tech.dkim.fmhosted.com."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_dmarc" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "_dmarc"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_dmarc" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "_dmarc"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_txt" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "@"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_txt" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = ""
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"v=spf1 include:spf.messagingengine.com -all\""
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_speed" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "speed"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_speed" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "speed"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_media" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "media"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_media" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "media"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_matrix" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "matrix"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}."
+resource "desec_rrset" "jakehowardtech_matrix" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "matrix"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_intersect" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "intersect"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_intersect" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "intersect"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_calibre" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "calibre"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_calibre" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "calibre"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_homeassistant" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "homeassistant"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}."
+resource "desec_rrset" "jakehowardtech_homeassistant" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "homeassistant"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_grafana" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "grafana"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_grafana" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "grafana"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_vaultwarden" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "vaultwarden"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}."
+resource "desec_rrset" "jakehowardtech_vaultwarden" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "vaultwarden"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_recipes" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "recipes"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_recipes" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "recipes"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_mailgun_spf" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "mg"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_mailgun_spf" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "mg"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"v=spf1 include:mailgun.org -all\""
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_mailgun_dkim" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "s1._domainkey.mg"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_mailgun_dkim" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "s1._domainkey.mg"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4E4cv86U+sFUjgLys26ZLccTghzGfHiFpitWdFg68lGXG63aoG2/+9bgKVT0ZBG7bjPvj6Kyj4N3TIe4oCJo2saVvtsNK1pvZ\" \"kOadaBPgjzKeRvBaw48ZatUGKoV7q1NCa0kXAfiJleF7bMvbt8rYDmBljr/BG6TtZYPt6XgoZyh8HHXjv/1L6WT3JBVQ8q5UtqVRVujXNHf57FmJTOJpvs0bKn/6TUaXYZmt5z3jpDhc/HfmkzVV22\" \"AwRf9jn7kgKkgaKpkvfSL8gtYNn5oyfS0Y9W9x9ntqb4g72RCbynMppQb1uwxbIuWRVOp0un0koQDm3C8ZzhOOYAwe58BYQIDAQAB\""
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_mailgun_dmarc" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "_dmarc.mg"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_mailgun_dmarc" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "_dmarc.mg"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_synapse_admin" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "synapse-admin"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}."
+resource "desec_rrset" "jakehowardtech_synapse_admin" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "synapse-admin"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_apex" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "@"
-  type = "ALIAS"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}."
+resource "desec_rrset" "jakehowardtech_apex" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = ""
+  type    = "A"
+  ttl     = local.dns_ttl_default
+  records = desec_rrset.sys_domain_walker.records
+}
+
+resource "desec_rrset" "jakehowardtech_apex_v6" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = ""
+  type    = "AAAA"
+  ttl     = local.dns_ttl_default
+  records = desec_rrset.sys_domain_walker_v6.records
+}
+
+resource "desec_rrset" "jakehowardtech_collabora" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "collabora"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_collabora" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "collabora"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_tasks" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "tasks"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_tasks" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "tasks"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_auth" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "auth"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_auth" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "auth"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_ntfy" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "ntfy"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_ntfy" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "ntfy"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_headscale" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "headscale"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_casey.subname}.${desec_rrset.sys_domain_casey.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_headscale" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "headscale"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_casey.name}.${gandi_livedns_record.sys_domain_casey.zone}."
+resource "desec_rrset" "jakehowardtech_slides" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "slides"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_slides" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "slides"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}."
+resource "desec_rrset" "jakehowardtech_uptime" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "uptime"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_uptime" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "uptime"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_baby-buddy" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "baby-buddy"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_baby-buddy" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "baby-buddy"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}."
+resource "desec_rrset" "jakehowardtech_immich" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "immich"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_immich" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "immich"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}."
+resource "desec_rrset" "jakehowardtech_photos" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "photos"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_photos" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "photos"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "jakehowardtech_freshrss" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "freshrss"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_freshrss" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "freshrss"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}."
+resource "desec_rrset" "jakehowardtech_atuin" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "atuin"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_atuin" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "atuin"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}."
+resource "desec_rrset" "jakehowardtech_karakeep" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = "karakeep"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve_private.subname}.${desec_rrset.sys_domain_pve_private.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "jakehowardtech_karakeep" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "karakeep"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve_private.name}.${gandi_livedns_record.sys_domain_pve_private.zone}."
-  ]
-}
-
-resource "gandi_livedns_record" "jakehowardtech_caa" {
-  zone = data.gandi_livedns_domain.jakehowardtech.id
-  name = "@"
-  type = "CAA"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "jakehowardtech_caa" {
+  domain  = desec_domain.jakehowardtech.name
+  subname = ""
+  type    = "CAA"
+  ttl     = local.dns_ttl_default
+  records = [
     "0 issue \"letsencrypt.org\"",
     "0 wildissue \"letsencrypt.org\"",
   ]
diff --git a/terraform/providers.tf b/terraform/providers.tf
index ac91539..51f218b 100644
--- a/terraform/providers.tf
+++ b/terraform/providers.tf
@@ -6,10 +6,6 @@ provider "linode" {
   token = var.linode_personal_access_token
 }
 
-provider "gandi" {
-  personal_access_token = var.gandi_personal_access_token
-}
-
 provider "b2" {
   application_key    = var.backblaze_application_key
   application_key_id = var.backblaze_application_key_id
@@ -18,3 +14,7 @@ provider "b2" {
 provider "hcloud" {
   token = var.hetzner_token
 }
+
+provider "desec" {
+  api_token = var.desec_api_token
+}
diff --git a/terraform/sys_domains.tf b/terraform/sys_domains.tf
index 156fa22..140767d 100644
--- a/terraform/sys_domains.tf
+++ b/terraform/sys_domains.tf
@@ -1,79 +1,79 @@
-resource "gandi_livedns_record" "sys_domain_casey" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "casey.sys"
-  type = "A"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "sys_domain_casey" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "casey.sys"
+  type    = "A"
+  ttl     = local.dns_ttl_default
+  records = [
     linode_instance.casey.ip_address
   ]
 }
 
-resource "gandi_livedns_record" "sys_domain_casey_v6" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "casey.sys"
-  type = "AAAA"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "sys_domain_casey_v6" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "casey.sys"
+  type    = "AAAA"
+  ttl     = local.dns_ttl_default
+  records = [
     split("/", linode_instance.casey.ipv6)[0]
   ]
 }
 
-resource "gandi_livedns_record" "sys_domain_walker" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "walker.sys"
-  type = "A"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "sys_domain_walker" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "walker.sys"
+  type    = "A"
+  ttl     = local.dns_ttl_default
+  records = [
     hcloud_server.walker.ipv4_address
   ]
 }
 
-resource "gandi_livedns_record" "sys_domain_walker_v6" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "walker.sys"
-  type = "AAAA"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "sys_domain_walker_v6" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "walker.sys"
+  type    = "AAAA"
+  ttl     = local.dns_ttl_default
+  records = [
     hcloud_server.walker.ipv6_address
   ]
 }
 
-resource "gandi_livedns_record" "sys_domain_pve" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "pve.sys"
-  type = "A"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "sys_domain_pve" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "pve.sys"
+  type    = "A"
+  ttl     = local.dns_ttl_default
+  records = [
     linode_instance.casey.ip_address
   ]
 }
 
-resource "gandi_livedns_record" "sys_domain_pve_private" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "pve-private.sys"
-  type = "AAAA"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "sys_domain_pve_private" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "pve-private.sys"
+  type    = "AAAA"
+  ttl     = local.dns_ttl_default
+  records = [
     local.private_ipv6_marker
   ]
 }
 
-resource "gandi_livedns_record" "sys_domain_grimes" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "grimes.sys"
-  type = "A"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "sys_domain_grimes" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "grimes.sys"
+  type    = "A"
+  ttl     = local.dns_ttl_default
+  records = [
     hcloud_server.grimes.ipv4_address
   ]
 }
 
-resource "gandi_livedns_record" "sys_domain_grimes_v6" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "grimes.sys"
-  type = "AAAA"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "sys_domain_grimes_v6" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "grimes.sys"
+  type    = "AAAA"
+  ttl     = local.dns_ttl_default
+  records = [
     hcloud_server.grimes.ipv6_address
   ]
 }
diff --git a/terraform/terraform.tf b/terraform/terraform.tf
index 9b1d6c3..4966907 100644
--- a/terraform/terraform.tf
+++ b/terraform/terraform.tf
@@ -8,10 +8,6 @@ terraform {
       source  = "linode/linode"
       version = "1.30.0"
     }
-    gandi = {
-      source  = "go-gandi/gandi"
-      version = "2.3.0"
-    }
     b2 = {
       source  = "Backblaze/b2"
       version = "0.10.0"
@@ -20,5 +16,9 @@ terraform {
       source  = "hetznercloud/hcloud"
       version = "1.48.1"
     }
+    desec = {
+      source  = "Valodim/desec"
+      version = "0.6.1"
+    }
   }
 }
diff --git a/terraform/theorangeone.net.tf b/terraform/theorangeone.net.tf
index 2218e2a..232b187 100644
--- a/terraform/theorangeone.net.tf
+++ b/terraform/theorangeone.net.tf
@@ -1,253 +1,258 @@
-data "gandi_livedns_domain" "theorangeonenet" {
+resource "desec_domain" "theorangeonenet" {
   name = "theorangeone.net"
 }
 
-resource "gandi_livedns_record" "theorangeonenet_git" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "git"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "theorangeonenet_git" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "git"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_whoami" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "whoami"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "theorangeonenet_whoami" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "whoami"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_mx" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "@"
-  type = "MX"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_mx" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = ""
+  type    = "MX"
+  ttl     = local.dns_ttl_default
+  records = [
     "10 in1-smtp.messagingengine.com.",
     "20 in2-smtp.messagingengine.com.",
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_dkim_fm1" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "fm1._domainkey"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_dkim_fm1" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "fm1._domainkey"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
     "fm1.theorangeone.net.dkim.fmhosted.com."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_dkim_fm2" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "fm2._domainkey"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_dkim_fm2" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "fm2._domainkey"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
     "fm2.theorangeone.net.dkim.fmhosted.com."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_dkim_fm3" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "fm3._domainkey"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_dkim_fm3" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "fm3._domainkey"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
     "fm3.theorangeone.net.dkim.fmhosted.com."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_dmarc" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "_dmarc"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_dmarc" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "_dmarc"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_dmarc_report" {
+resource "desec_rrset" "theorangeonenet_dmarc_report" {
   for_each = toset([
-    data.gandi_livedns_domain.theorangeonenet.name,
-    data.gandi_livedns_domain.jakehowardtech.name,
-    "${gandi_livedns_record.theorangeonenet_mailgun_spf.name}.${gandi_livedns_record.theorangeonenet_mailgun_spf.zone}",
-    "${gandi_livedns_record.jakehowardtech_mailgun_spf.name}.${gandi_livedns_record.jakehowardtech_mailgun_spf.zone}"
+    desec_domain.theorangeonenet.name,
+    desec_domain.jakehowardtech.name,
+    "${desec_rrset.theorangeonenet_mailgun_spf.subname}.${desec_rrset.theorangeonenet_mailgun_spf.domain}",
+    "${desec_rrset.jakehowardtech_mailgun_spf.subname}.${desec_rrset.jakehowardtech_mailgun_spf.domain}"
   ])
 
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "${each.value}._report._dmarc"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+  domain  = desec_domain.theorangeonenet.name
+  subname = "${each.value}._report._dmarc"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"v=DMARC1\""
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_txt" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "@"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_txt" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = ""
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"google-site-verification=IXY4iSBN_vOcM3cp_f-BgVvEI_shz1GzXuY_8dqY61o\"",
     "\"v=spf1 include:spf.messagingengine.com -all\""
   ]
 }
 
+resource "desec_rrset" "theorangeonenet_apex" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = ""
+  type    = "A"
+  ttl     = local.dns_ttl_default
+  records = desec_rrset.sys_domain_walker.records
+}
 
-resource "gandi_livedns_record" "theorangeonenet_apex" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "@"
-  type = "ALIAS"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}."
+resource "desec_rrset" "theorangeonenet_apex_v6" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = ""
+  type    = "AAAA"
+  ttl     = local.dns_ttl_default
+  records = desec_rrset.sys_domain_walker_v6.records
+}
+
+resource "desec_rrset" "theorangeonenet_srv_matrix" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "_matrix._tcp"
+  type    = "SRV"
+  ttl     = local.dns_ttl_default
+  records = [
+    "10 0 8448 ${desec_rrset.theorangeonenet_matrix.subname}.${desec_rrset.theorangeonenet_matrix.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_srv_matrix" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "_matrix._tcp"
-  type = "SRV"
-  ttl  = 3600
-  values = [
-    "10 0 8448 ${gandi_livedns_record.theorangeonenet_matrix.name}.${gandi_livedns_record.theorangeonenet_matrix.zone}."
+resource "desec_rrset" "theorangeonenet_matrix" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "matrix"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_matrix" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "matrix"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}."
+resource "desec_rrset" "theorangeonenet_plausible" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "plausible"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_plausible" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "plausible"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}."
+resource "desec_rrset" "theorangeonenet_plausible_bare" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "elbisualp"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_plausible_bare" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "elbisualp"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}."
-  ]
-}
-
-resource "gandi_livedns_record" "theorangeonenet_notes" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "notes"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_notes" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "notes"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
     "realorangeone.github.io."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_bin" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "bin"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_pve.name}.${gandi_livedns_record.sys_domain_pve.zone}."
+resource "desec_rrset" "theorangeonenet_bin" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "bin"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_pve.subname}.${desec_rrset.sys_domain_pve.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_mailgun_spf" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "mg"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_mailgun_spf" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "mg"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"v=spf1 include:mailgun.org -all\""
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_mailgun_dkim" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "mta._domainkey.mg"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_mailgun_dkim" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "mta._domainkey.mg"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1Z/MHEzpbWm5EgMkyWb+Xkz44Xrzr4SA5i2u8M2H5yZ1PSb4DpGk3IAX+I05UWax02+WBW3CBb5wU9rH9flgxezBoCf/hiMS1\" \"Wjb9hKGIBa2jMCzpF+wa5fyqLkLoAJZF4bc/BJKyi/ET2c7+DAA/2KlWv/nv4MEjcUR4hNGLPEC9+6PhUp8z2PnUQLzPRWHpKc1oLrnROWaX3XxdDekCzwyOw7ygzZdThVevE+0CqXVOt5SUSUCnd2\" \"tjVbvblGi6DBiQY5Tl6+xLqkQHCRqks9187+EN4FdJXkjQodkFzzyiBH5cXVGiZLOhal4koEvxGirr596qM97bIXiJWArdQIDAQAB\""
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_mailgun_dmarc" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "_dmarc.mg"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_mailgun_dmarc" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "_dmarc.mg"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"v=DMARC1; p=quarantine; ruf=mailto:dmarc-report@jakehoward.tech;\""
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_mastodon" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "mastodon"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}."
+resource "desec_rrset" "theorangeonenet_mastodon" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "mastodon"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_comentario" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "comentario"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}."
+resource "desec_rrset" "theorangeonenet_comentario" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "comentario"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_bsky" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "bsky"
-  type = "CNAME"
-  ttl  = 3600
-  values = [
-    "${gandi_livedns_record.sys_domain_grimes.name}.${gandi_livedns_record.sys_domain_grimes.zone}."
+resource "desec_rrset" "theorangeonenet_bsky" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "bsky"
+  type    = "CNAME"
+  ttl     = local.dns_ttl_default
+  records = [
+    "${desec_rrset.sys_domain_grimes.subname}.${desec_rrset.sys_domain_grimes.domain}."
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_atproto" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "_atproto"
-  type = "TXT"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_atproto" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = "_atproto"
+  type    = "TXT"
+  ttl     = local.dns_ttl_default
+  records = [
     "\"did=did:plc:pgyg4ih7zsqkwdon34jqkbuz\""
   ]
 }
 
-resource "gandi_livedns_record" "theorangeonenet_caa" {
-  zone = data.gandi_livedns_domain.theorangeonenet.id
-  name = "@"
-  type = "CAA"
-  ttl  = 3600
-  values = [
+resource "desec_rrset" "theorangeonenet_caa" {
+  domain  = desec_domain.theorangeonenet.name
+  subname = ""
+  type    = "CAA"
+  ttl     = local.dns_ttl_default
+  records = [
     "0 issue \"letsencrypt.org\"",
     "0 wildissue \"letsencrypt.org\"",
   ]
diff --git a/terraform/variables.tf b/terraform/variables.tf
index b5bee7a..5cbed5a 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -1,8 +1,8 @@
-variable "linode_personal_access_token" {
-  sensitive = true
+locals {
+  dns_ttl_default = 60 * 60
 }
 
-variable "gandi_personal_access_token" {
+variable "linode_personal_access_token" {
   sensitive = true
 }
 
@@ -17,3 +17,7 @@ variable "backblaze_application_key_id" {
 variable "hetzner_token" {
   sensitive = true
 }
+
+variable "desec_api_token" {
+  sensitive = true
+}
diff --git a/terraform/walker_vps.tf b/terraform/walker_vps.tf
index 5691946..67d35a9 100644
--- a/terraform/walker_vps.tf
+++ b/terraform/walker_vps.tf
@@ -16,11 +16,11 @@ resource "hcloud_server" "walker" {
 resource "hcloud_rdns" "walker_reverse_ipv4" {
   server_id  = hcloud_server.walker.id
   ip_address = hcloud_server.walker.ipv4_address
-  dns_ptr    = "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}"
+  dns_ptr    = "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}"
 }
 
 resource "hcloud_rdns" "walker_reverse_ipv6" {
   server_id  = hcloud_server.walker.id
   ip_address = hcloud_server.walker.ipv6_address
-  dns_ptr    = "${gandi_livedns_record.sys_domain_walker.name}.${gandi_livedns_record.sys_domain_walker.zone}"
+  dns_ptr    = "${desec_rrset.sys_domain_walker.subname}.${desec_rrset.sys_domain_walker.domain}"
 }