Myra CDN vs UncensoredDNS

Comparez Myra CDN et UncensoredDNS sur les capacités, la juridiction, les garanties et l'adéquation pour les acheteurs européens.

Tous deux listés comme alternatives à: Cloudflare

Myra CDN

Germany· Web Hosting and Cloud Computing

Needs review

Shortlist Myra CDN when you need a German-operated Anycast edge with DDoS/WAF and a written Germany-only TLS termination option for KRITIS, banking, or public-sector sites. Skip it when you need Cloudflare-scale self-serve PoPs, Workers-class edge compute, or a free global cache. Consider Hetzner, IONOS, or OVHcloud when you only need EU origin hosting, not a certified WAAP edge.

EU-operated (Munich GmbH)ISO 27001 IT-Grundschutz (BSI, verified)BSI C5 Type 2 (claimed)Anycast CDN + Layer 7 DDoSGermany TLS termination (on request)PCI DSS Level 1 (claimed)

Voir la fiche Visiter le site web

UncensoredDNS

Denmark· Web Hosting and Cloud Computing

Needs review

Shortlist when you want an unfiltered, encrypt-only public resolver run by a named Danish operator and you can configure DoT, DoH, or DoQ. Skip when you need a DPA, malware blocking, EU-only anycast, or a staffed SLA. Use unicast for Denmark-local queries. Consider Quad9 when you want resolver-side threat blocking, or Cloudflare / Google Public DNS when you need a mass-market anycast default.

Danish-operatedEncrypted DNS onlyNo filter listsNo-logs (claimed)Free public resolver

Voir la fiche Visiter le site web

Les lignes surlignées diffèrent entre les deux produits.

Myra CDN vs UncensoredDNS: Aperçu
Caractéristique	Myra CDN	UncensoredDNS
Pays d'origine	Germany	Denmark
Catégorie	Web Hosting and Cloud Computing	Web Hosting and Cloud Computing
Open source	Non	Non
Auto-hébergé	Non	Non
Siège	Germany	Denmark
Entité légale	Myra Security GmbH, Landsberger Str. 187, 80687 Munich, HRB 202428	No company published. Operator: Thomas Steen Rasmussen (private individual).
Maison mère / contrôle US	Aucune maison mère US connue	Aucune maison mère US connue
Exposition CLOUD Act (indicative)	Faible	Moyen
Hébergement / résidence	Vendor-operated Anycast filter/CDN plane. BSI cert describes six outsourced data-centre sites (operators not named) with Myra staff running the IT. Marketing describes globally placed PoPs. Germany-only TLS termination and exclusive German processing are available on request. Product subprocessor list not published. Marketing website uses US SaaS (GA4, Clarity, Mailjet/Mailgun, Storylane, and others).	Unicast at AS9167 (Høje Tåstrup, Denmark, sponsor tyktech). Anycast nodes: two at DeiC in Lyngby, Denmark (AS1835) and one at rgnet in Washington, USA (AS3927). No public backup, email, or analytics subprocessor list.
Résumé	Munich-operated Anycast CDN and Security-as-a-Service edge (DDoS, WAF, bot management) with optional Germany-only TLS termination.	Danish volunteer public DNS resolver with encrypted-only DoT, DoH, and DoQ. Unfiltered lookups, unicast in the Copenhagen area, anycast that includes a US node.
Tags	cdn ddos waf bot-management germany gdpr bsi kritis anycast	dns public-dns privacy no-logs doh dot doq denmark encrypted-dns

En un coup d'œil: Myra CDN vs UncensoredDNS
En un coup d'œil	Myra CDN	UncensoredDNS
HQ	Munich, Germany (Landsberger Str. 187)	Non indiqué
Legal entity	Myra Security GmbH, HRB 202428	No company imprint found
Founded	2012 (vendor about/contact pages)	Non indiqué
Product type	SaaS Anycast CDN + Security-as-a-Service (not self-hosted)	Non indiqué
Onboarding	DNS cutover + TLS upload; APIv2 at apiv2.myracloud.com	Non indiqué
Commercial model	B2B subscription or quote (monthly/annual prepay); no consumer terms	Free public service; optional GitHub Sponsors donations
ISO 27001	BSI-IGZ-0667-2024, DDoS-Schutz scope, valid to 2027-12-17	Non indiqué
Operator	Non indiqué	Thomas Steen Rasmussen, private individual, Denmark
Started	Non indiqué	November 2009 (censurfridns.dk registered 15 November 2009)
Protocols	Non indiqué	DoT :853, DoH /dns-query, DoQ UDP/853, DoH3 UDP/443; no port 53
Anycast	Non indiqué	91.239.100.100 / 2001:67c:28a4:: (DeiC Lyngby + rgnet Washington)
Unicast	Non indiqué	89.233.43.71 / 2a01:3a0:53:53:: at AS9167, Høje Tåstrup
Independent audit	Non indiqué	None found

Key capabilities: Myra CDN vs UncensoredDNS
Key capabilities	Myra CDN	UncensoredDNS
EU-operated (Munich GmbH)	Oui	Oui
ISO 27001 IT-Grundschutz (BSI, verified)	Oui	Non indiqué
BSI C5 Type 2 (claimed)	Oui	Non indiqué
Anycast CDN + Layer 7 DDoS	Oui	Non indiqué
Germany TLS termination (on request)	Oui	Non indiqué
PCI DSS Level 1 (claimed)	Oui	Non indiqué
Encrypted DNS only	Non indiqué	Oui
No filter lists	Non indiqué	Oui
No-logs (claimed)	Non indiqué	Oui
Free public resolver	Non indiqué	Oui

Myra CDN

Anycast CDN with RAM cache and HTTP/2
Content is cached in RAM with real-time invalidation and stale-object support, then delivered over Anycast IPv4/IPv6. Protocols on the CDN sheet are HTTP/1.1 and HTTP/2. Image optimisation includes WebP conversion and on-the-fly resizing via query string. Docs also mention HTTP, HTTPS, DNS, IMAP, and SMTP on the wider platform, plus automatic IPv4/IPv6 translation for IPv4-only origins.
Optional mTLS and signed URLs at the edge
Clients can authenticate to the CDN with a client certificate. The CDN can also present a client certificate to the origin so only Myra reaches origin. Signed URLs add a cryptographic signature and optional expiry. TLS 1.2/1.3 is stated. These controls are optional add-ons, not defaults for every domain.
Layer 7 DDoS on the same reverse proxy
Malicious HTTP is filtered in Myra's network before a redundant reverse proxy forwards clean traffic. Documented controls include GeoIP blocking, rate limits, attack notifications, post-mitigation reports, and upstream monitoring. Network-layer cloud scrubbing and on-prem BGP protection are separate products for IP prefixes. Vendor capacity claims (for example 1 Tbps class attacks) should be validated in an RFP, not treated as a measured SLA.
WAF, bot management, and EU CAPTCHA add-ons
The CDN is sold as a stack with Hyperscale WAF, deep bot management, and Myra EU CAPTCHA (cookie-free, hashed telemetry, optional dedicated DE/EU endpoints). A managed WAF service is offered as an add-on. This is useful for KRITIS and banking sites that want one German operator. It is not a reason to assume every module is included in a CDN-only quote.
Germany-only TLS termination on request
Because WAF and DDoS inspection decrypt HTTPS, Myra states it will terminate TLS exclusively in Germany when the customer requests it. Exclusive processing in German data centres is the same kind of option. If the contract is silent, marketing still describes globally placed PoPs. Write the region constraint into the order form.
REST APIv2, Myra App, and DNS cutover
Go-live is DNS (A/AAAA to Myra, CNAME, or moving authoritative DNS) plus certificate upload via the Myra App or API. APIv2 is documented at apiv2.myracloud.com and can create domains, change cache settings, and edit DNS. Docs also cover SSO, certificate management, waiting rooms, object storage, WebSockets, and maintenance pages. There is no official self-host of the filter plane.

UncensoredDNS

Encrypted-only recursive DNS
Since October 2022 the resolvers do not answer classic UDP/TCP port 53. Clients use DNS-over-TLS on 853, DNS-over-HTTPS at /dns-query on 443, and (from 23 October 2025) DNS-over-QUIC on UDP/853 plus DNS-over-HTTP/3 on UDP/443. Devices that can only speak cleartext DNS will fail.
Unfiltered public resolution
The service is built to skip ISP and court-style DNS blocklists that Danish providers apply. It does not offer malware, ad, or family filter modes. Choose it when you want NXDOMAIN to mean the name does not exist, not that a resolver policy hid it.
Anycast plus Danish unicast endpoints
anycast.uncensoreddns.org uses 91.239.100.100 and 2001:67c:28a4::. unicast.uncensoreddns.org uses 89.233.43.71 and 2a01:3a0:53:53:: at AS9167 in Høje Tåstrup. The operator says the anycast prefix is provider-independent and unlikely to change. Legacy names under censurfridns.dk still work.
Published TLS pins per node
Each listed node publishes RSA and ECDSA TLS public keys on the DNS Servers page. DoT originally shipped with TLSA records so clients such as Stubby can pin. Key rotation (ECDSA introduction in 2020) can break pinsets until operators update them.
Router and OS client notes
The censurfridns/client-configs GitHub repo documents Firefox, Edge, iOS profiles, systemd-resolved, pfSense, OPNsense, OpenWrt, and Unbound. This is community documentation for a public resolver, not a supported enterprise client.

Assurance & compliance: Myra CDN vs UncensoredDNS
Assurance & compliance	Myra CDN	UncensoredDNS
Independent security / no-logs audit	Partial Vendor states regular external pen tests and audits. No public no-logs audit PDF. Independent C5 work in 2022 was described by usd AG. Ask for current pentest and attestation reports.	Not found FAQ claims no personal logs and aggregate graphs only. No third-party audit PDF found.
ISO 27001 (BSI IT-Grundschutz)	Verified BSI-IGZ-0667-2024, issued 2024-12-18, valid to 2027-12-17. Scope is Myra Security DDoS-Schutz at six outsourced DC sites, not automatically every CDN PoP.	Not found
SOC 2 / SOC 3	Not found No SOC 2 report published. Closest published control attestations are BSI C5 Type 2 (claimed) and IDW PS 951 Type 2 / ISAE 3402 (claimed).	Not found
GDPR / EU data protection	Vendor claimed German controller/processor, GDPR pages, optional Germany-only TLS termination. Confirm DPA and processing locations in contract.	Partial Danish individual operator and a no-logs claim on the FAQ. No formal privacy policy or DPA page found.
US CLOUD Act exposure (indicative)	Partial EU entity, no known US parent, self-operated filter plane. Partial because CDN PoPs are described as global, six DC sites are outsourced and unnamed, and no product subprocessor register was found. Not legal advice. Vendor claims it is not subject to CLOUD Act/FISA 702.	Partial No known US parent. Published anycast includes rgnet in Washington, USA (AS3927), so some queries can be answered on US soil. Not legal advice.
Data processing agreement (B2B)	Not found No public Art. 28 DPA PDF on legal/GDPR/terms pages. EU CAPTCHA FAQ asks whether a DPA must be signed, which implies one exists for that product. Request the current AVV.	Not found No company imprint or processor agreement found. Operator contact is admin@censurfridns.dk.
EU AI Act	Not applicable CDN/WAAP edge. Marketing mentions AI-powered DDoS detection. Not an AI-system product page.	Not applicable Public recursive DNS resolver, not an AI system.
BSI C5 Type 2	Vendor claimed Current Type 2 claimed on certifications page. usd AG publicly described a 2022 C5 audit with HKKG. Current-year attestation PDF not found.	Non indiqué
PCI DSS Level 1	Vendor claimed Vendor certifications page: PCI DSS Level 1 service provider. No public AOC in this research pass.	Non indiqué
IDW PS 951 Type 2 (ISAE 3402)	Vendor claimed Vendor claim of Type 2 over a twelve-month period. Report not published.	Non indiqué
KRITIS operator (BSIG section 8a(3))	Vendor claimed Vendor certifications page. Confirm current attestation in procurement.	Non indiqué

Considerations & known limitations: Myra CDN vs UncensoredDNS
Considerations & known limitations	Myra CDN	UncensoredDNS
Global PoPs unless Germany-only is contracted	Medium Marketing describes worldwide Anycast delivery. Germany-only TLS termination and exclusive German processing are request options. A silent contract can leave visitor IPs and cached objects on unpublished PoPs outside Germany.	Non indiqué
Outsourced DCs and no public subprocessor list	Medium BSI-IGZ-0667-2024 states six independent data-centre sites are outsourced. Operators are not named. No product subprocessor register was found. Procurement should demand the annex before treating the path as EU-only.	Non indiqué
ISO 27001 scope is DDoS-Schutz, not every SKU	Low The verified BSI certificate covers the DDoS-protection information network. CDN add-ons, object storage, EU CAPTCHA, and the marketing website are not automatically in that sentence. Align the statement of applicability with the ordered products.	Non indiqué
Smaller public footprint than Cloudflare	Medium No public worldwide PoP map comparable to large US CDNs. HTTP/3 is not listed on the CDN spec sheet. Poor fit if you need self-serve global scale or edge compute.	Non indiqué
Corporate website uses US processors	Low Privacy policy names Google Analytics, Clarity, Mailjet/Mailgun, Storylane, and other US-linked tools for the website. Separate this from product traffic, but do not treat the privacy policy as proof that the CDN path is US-free.	Non indiqué
Single-person operation	Non indiqué	High The service is run by one named individual with donated nodes. There is no published company, on-call roster, or SLA. Sponsor withdrawals have already removed anycast sites.
US anycast node on the public map	Non indiqué	Medium rgnet-iad.anycast.uncensoreddns.org is listed in Washington, USA. Anycast clients cannot pin Denmark. Use the unicast hostname if EU landing matters.
No public independent audit	Non indiqué	Medium No-logs is a first-party FAQ statement. No audit, ISO, or SOC package was found for a security review file.
No classic port 53	Non indiqué	Low Cleartext DNS has been off since October 2022. Guest devices, some IoT, and default DHCP resolvers will not work without a local forwarder that speaks DoT or DoH.

Adéquation

Myra CDN

Best fit when

German or EU public sector, KRITIS, banks, insurers, and healthcare portals that must show BSI-shaped evidence
Teams replacing Cloudflare primarily for jurisdiction, not for Workers or a free tier
Sites that will contract Germany-only TLS termination and want one operator for CDN, WAF, and DDoS
Origins that can cut over via DNS and certificate upload without installing an appliance
Buyers who need REST APIv2, SSO, and SIEM-oriented logs rather than a hobby CDN

Poor fit when

Buyers who need a large free tier or fully self-serve global CDN comparable to Cloudflare
Workloads that require published HTTP/3, Workers-style edge compute, or a public worldwide PoP map before RFP
Organisations that cannot accept unnamed colocation partners without a signed subprocessor annex
Consumer or hobby projects (terms exclude consumers)
Teams that only need EU VMs or object storage and do not need a WAAP edge

Consider instead when

When: You need maximum global PoP density, Workers-style compute, or a self-serve free CDN
Consider: Cloudflare
US parent and CLOUD Act exposure are the usual reason regulated EU buyers leave it.
When: You only need EU origin compute or hosting, not Anycast WAAP
Consider: Hetzner, IONOS, or OVHcloud
These are catalog infrastructure peers, not certified German DDoS/CDN edges.

UncensoredDNS

Best fit when

Households and labs leaving filtered Danish ISP DNS who can speak DoT, DoH, or DoQ
Admins who want NXDOMAIN to mean the name does not exist, not a resolver policy
Router and homelab setups (pfSense, OPNsense, OpenWrt, systemd-resolved) using the published client notes
Buyers who prefer a named European individual over sending every lookup to Google or Cloudflare
Teams that can pin TLS keys and accept a volunteer-run service without an SLA

Poor fit when

Procurement that requires a company imprint, signed DPA, or ISO/SOC package
Policies that require EU-only query landing (anycast includes Washington, USA)
Need for malware, ad, or family filtering at the resolver
Devices or DHCP that can only use cleartext UDP/TCP port 53
A regulated resolver dependency that needs staffed on-call and a status SLA

Consider instead when

When: You want resolver-side malware blocking with a European-adjacent operator
Consider: Quad9
Quad9 is a filtered secure resolver. UncensoredDNS will not apply those blocks.
When: You need configurable profiles, analytics, or family filters
Consider: NextDNS or AdGuard DNS
Those are policy platforms. UncensoredDNS has no per-user console.
When: You need a mass-market anycast default and OS-level presets
Consider: Cloudflare 1.1.1.1 or Google Public DNS
Larger footprint and still offer cleartext 53. They are US-group services.
When: Every query must stay inside your EU tenancy
Consider: Self-hosted Unbound or Knot Resolver on your own metal
UncensoredDNS anycast can land on the published US node.

Open questions for due diligence

Myra CDN

Will Myra sign an Art. 28 DPA for the CDN/WAF/DDoS order and attach a current subprocessor list that names the six certified DC operators?
Which PoP countries will serve our hostnames if we do not buy exclusive German processing?
Does BSI-IGZ-0667-2024 include the exact PoPs and products in our statement of work, and can we see the current C5 Type 2, PCI AOC, and IDW PS 951 reports?
Is HTTP/3, IPv6-only origins, or Workers-like edge compute on the roadmap, and what is the contracted SLA for our SKU?
Are there US-group transit, colocation, or support tools on the product data path that are not listed publicly?

UncensoredDNS

Will the operator form a legal entity or sign a DPA for organisational use?
Is there a way to pin anycast to EU nodes only, or should EU-only buyers use unicast exclusively?
Is an independent no-logs or infrastructure audit planned?
Does the recursor validate DNSSEC for all clients? (not stated as a current guarantee on the pages reviewed)
What subprocessors, if any, sit on the blog, email, or monitoring path?