For most of my internal services that are sitting behind Traefik I use step-ca which basically gives you a Let’s Encrypt style certificate while working over the local network. The root CA has a long expiry (so might not be what you want if your goal Is a short lived root CA) but the actual certificates for each service are short lived (a touch over 24 hours from memory?)

We had a system at work that generated 4 character alphanumeric reference numbers. Originally to avoid this they just excluded vowels from the letters but eventually they grew enough they ran out of available reference numbers so they added the vowels back in and I had to built the blacklist to avoid stuff like this happening. I reckon I probably tripped every IT filter known to man in a week long period looking for swear words in a variety of languages 😂

The part where people share asterisks when they talk about their passwords? Just seems like good security honestly 😂 Glad Lemmy is keeping up with this pinnacle of security best practices.

I’d second afraid.org, have been using them for years and they’ve always been great. They also support dynamic DNS so if you’re on a dynamic IP address you can have the address be updated automatically when your IP address does.

More relevant to the question, I’m pretty sure you can create NS records for a subdomain as well. I was experimenting once a few years back with a DNS tunnel service and was able to get the DNS side of it configured. Never did get the service itself working but it was more of a curiosity at the time so didn’t spend a massive amount of time on it.