Can I use the Red.es DNS on my computer or router?

No. The Red.es platform is authoritative DNS: it only answers for .es domains, it does not resolve arbitrary names. To browse you need a public resolver like the ones compared on this site. Whichever resolver you use queries the Red.es servers every time it looks up a .es domain it does not have cached.

How many DNS servers does the .es domain have?

Four names delegated in the root zone: a.nic.es, c.nic.es, g.nic.es and h.nic.es. The first is run by Red.es in Spain on two load-balanced servers; the other three are anycast networks operated by specialised DNS providers that together add up to more than 120 nodes on every continent.

Is the .es domain DNSSEC-signed?

Yes. The .es zone is signed and its KSK is published as a DS record in the root zone (key tag 54404, algorithm 8, RSA/SHA-256). A .es domain holder can sign their own zone and submit the DS record through their registrar to complete the chain of trust.

How many .es domains are there?

2,155,756 in January 2026 according to Red.es statistics: 2,062,183 directly under .es, 80,086 under com.es, 8,911 under org.es, 2,790 under nom.es, 1,243 under gob.es and 497 under edu.es. In 1998 there were 12,887.

What happens if the .es servers go down?

Every .es domain would stop resolving as soon as resolver caches expired. To prevent that, the platform spreads the zone over four servers running different software (BIND and Knot), three of them anycast, with anti-DoS protection and rate limiting; losing several nodes does not affect the service.

The DNS platform behind .es domains: how it works and who runs it

When you type a domain ending in .es, your resolver (your ISP’s, Cloudflare, Quad9, whichever you use) has to ask someone who manages that name. That someone is the DNS platform run by Red.es, the Spanish public body in charge of the .es registry. It is a piece of infrastructure almost nobody talks about, and every query for a Spanish domain that is not already cached goes through it. This is how it is built, from the data Red.es publishes and from what you see when you query it directly.

What it is and what it is not

The .es DNS platform is authoritative DNS: it holds the .es zone (the list of which servers answer for each registered domain) and answers whoever asks about it. It is not a recursive resolver like the ones compared on this site, so you cannot configure it on your router or phone. Its audience is the world’s resolvers, not end users.

The full chain for a domain like example.es goes like this: your resolver asks a root server who manages .es; the root returns the four Red.es servers; your resolver asks one of them who manages example.es; and with that answer it goes to the domain’s own server for the IP address. The DNS guide covers this in more detail.

The platform covers .es and its second-level domains: com.es, nom.es, org.es, gob.es and edu.es. It is classed as an essential Internet service under the EU NIS2 directive, which imposes security and incident-reporting obligations.

The four .es servers

The root zone delegates .es to four names. This is what they answer today, queried from Madrid (median of five direct SOA queries):

Server	IPv4	IPv6	Operator	Latency
`a.nic.es`	194.69.254.1	2001:67c:21cc:2000::64:41	Red.es (Spain), two load-balanced servers	40 ms
`c.nic.es`	194.0.34.53	2001:678:44::53	Anycast provider (identifies itself as CIRA)	58 ms
`g.nic.es`	204.61.217.1	2001:500:14:7001:ad::1	Packet Clearing House (PCH), anycast	54 ms
`h.nic.es`	194.0.33.53	2001:678:40::53	Anycast provider	231 ms

a.nic.es is the in-house server: Red.es hosts it in Spain on two machines behind a load balancer. The other three are anycast networks from specialised DNS providers: the same IP address is announced from dozens of locations and each resolver reaches the nearest node. According to Red.es, the three together add up to more than 120 nodes on every continent.

One detail in the table deserves a note: h.nic.es answered from Madrid in 231 ms, five times slower than the others. With anycast, the node that serves you is chosen by your ISP’s routing, not by geographic distance, and sometimes it sends you far away. This is not a problem for the service, because resolvers measure which server answers fastest and prefer it; it is exactly why the zone is spread over four servers instead of one.

There is also software diversity: the Red.es servers run BIND and the external providers combine BIND and Knot. If a serious bug appears in one, the other keeps answering.

DNSSEC: how the zone is signed

The .es zone is DNSSEC-signed and the chain of trust reaches the root. What you can verify from outside:

The DS record for .es in the root zone has key tag 54404, algorithm 8 (RSA/SHA-256) and a SHA-256 digest.
The zone publishes two DNSKEY records: a KSK (the one the root DS authorises) and a ZSK (the one that signs the day-to-day records).
Signatures (RRSIG) are valid for 14 days and are renewed continuously.

Red.es rolls the ZSK frequently and the KSK every two years, which is when the DS in the root has to change. Orchestration is done by OpenDNSSEC and the private keys live in an HSM, a cryptographic module they cannot be extracted from.

For a .es domain holder this means they can sign their own zone: generate the keys in their DNS (or have their provider do it), obtain the DS record and submit it through their registrar. From then on a validating resolver such as Quad9, Cloudflare or Google rejects any tampered answer for that domain. This site’s DNSSEC checker shows whether the chain is complete.

Protection against attacks

A ccTLD’s authoritative DNS is a classic denial-of-service target, because taking it down takes down every domain in a country. Red.es lists three layers:

Anti-DoS agreements with network operators to filter traffic before it reaches the servers.
Rate limiting on the DNS servers themselves, which stops them being used as amplifiers.
Scrubbing centres at the anycast providers, which absorb the attack inside their networks.

On top of that come the service certifications: ISO 9001, ISO 27001, Spain’s National Security Framework (ENS) and the AENOR responsible-AI seal. Changes are rolled out through three environments (pre-production, demo and production) with centralised monitoring, for which Red.es cites ENTRADA, the DNS traffic analysis tool created by the Dutch registry.

The .es numbers

From the Red.es statistics report for January 2026:

Extension	Domains
.es	2,062,183
com.es	80,086
org.es	8,911
nom.es	2,790
gob.es	1,243
edu.es	497
Total	2,155,756

The history shows the growth: 12,887 domains in 1998, 298,600 in 2005 (the year registration was liberalised and you no longer had to justify a request), 1,082,757 in 2008, 2,002,058 in 2022 and 2,155,756 in January 2026. Over the last twelve months around 34,000 domains were registered per month and around 30,000 were deleted or not renewed, so net growth is slow.

What is coming

Red.es lists three lines of work: RDAP, the protocol replacing WHOIS, which already answers for .es (this site’s WHOIS/RDAP checker uses it); a secondary DNS service for .es domains, which would let a holder keep a copy of their zone on Red.es infrastructure; and more anycast nodes of its own, to depend less on external providers.

Check it yourself

Everything above can be seen from any terminal with dig:

dig NS es.                  # the four delegated servers
dig DS es. @1.1.1.1         # the DS published in the root (54404 8 2 …)
dig DNSKEY es. @a.nic.es    # the KSK (257) and ZSK (256) keys
dig +norec SOA es. @h.nic.es  # latency to one specific server

Without a terminal, the DNS lookup shows the NS records of any .es domain and the DNSSEC checker walks the chain of trust from the root.

Sources

Red.es, “Plataforma DNS” on dominios.es: architecture, DNSSEC, protection and certifications.
Red.es, “.es domain statistics, January 2026” (PDF).
Addresses, DS, DNSKEY, signatures and latencies: our own dig queries from Madrid on 17 September 2026.