mschae

The good thing about it is that all PHP applications run through a single service (unless you use containers for each of them individually, I guess), so it’s really easy to take them all down at the same time, and update them all at once.

As nice as DANE is, it just shifts the burden of trust to your DNS provider. Like if you hop on Wi-Fi at a coffee shop, said network can simply MITM connections and supply their own certs via re-writing the DNS.

It can’t, because DANE requires the use of DNSSEC. Unfortunately, there are still so many domains that do not have a proper DNSSEC configuration… so it’s unlikely to work out well in practice, anyway.

edit: not to mention the DNS is centralized too. It’s federated, at least (in the original sense of the word, not the way it is used on the fediverse), but ICANN is still the only central authority at the end.

Something like DANE, maybe? Only the websites actually using the compromised certificates would be compromised.

but I assume that it sets legal precedent for all.

Other courts might look at it for inspiration, but since Germany has a civil law system (as opposed to the common law system that is usual in English-speaking countries), prior rulings do not really have as much significance as “legal precedent” here.

They should fix their broken resolvers then, that’s not for me to work around. I don’t think it’s actually a big problem in practice though, because

1. my primary nameserver is actually fairly reliable, and
2. it looks like the nameservers in the NS query are in a randomized order (until the response is cached, of course)

That’s fair. Though you should consider that it’s really easy to set up secondary nameservers as a mirror (ns-global, for example, offers such a service). So your own reliability matters less in the end.

On the other hand, Cloudflare is kind of becoming the internet with all the centralization.

Yup. That’s the main reason I avoid using them.

deciding whom to choose for nameservers

This is tangential to your actual question, but why not host your own? I’ve had good experiences with self-hosting an authoritative nameserver for my domains. I personally use BIND (named), but I know someone who does the same with nsd and that also works very well.

edit: actually, might as well add the reasoning behind my choice of TLD, since it’s pretty simple. It’s a .de domain because I’m in Germany :)