For most sites, Cloudflare’s free plan is the best free DNS host: it includes DNSSEC and does not cap queries, though newer free zones are limited to 200 records. Choose deSEC for automatic DNSSEC from a nonprofit, Hurricane Electric when you need secondary DNS, and ClouDNS only for one small zone. Limits and prices below were checked on 7 November 2026.
1. What Free DNS Plans Actually Limit#
Free DNS hosting rarely limits whether your domain resolves. It limits the number of zones, the number of records per zone, query volume, and which features sit behind a paid plan. The features that most often cost extra are DNSSEC, anycast servers, secondary DNS and uptime guarantees, so check those before the record count.
The provider you pick also does not change who controls your domain. Your registrar still holds the registration, and the DNS host only answers queries once the domain’s nameservers point to it. If you are still choosing a registrar, see Best Domain Registrars in 2026.
2. Free DNS Providers Compared#
| Cloudflare Free | Hurricane Electric | deSEC | ClouDNS Free | |
|---|---|---|---|---|
| Records per zone | 200 (zones created from 1 Sep 2024) or 1,000 (older zones) | Not published on its page | No cap found; API is rate-limited | 50, in 1 zone |
| Query limit | None | Not stated | Not stated | 500K per month |
| DNSSEC | Yes | Listed as under exploration on its page (last updated 2020) | Automatic on all domains | Paid plans only |
| Secondary DNS | No (Enterprise only) | Yes | Not verified | Not on the free plan |
| Zone transfers out | No (Enterprise only) | Not verified | Not verified | Not on the free plan |
| API and automation | API and official Terraform provider | Dynamic DNS updates, including TXT records | REST API; community Terraform providers | Not verified for the free plan |
| Network | Anycast | Geographically diverse servers | Two networks, 15 locations (per its founder) | 4 unicast servers; anycast is paid |
Sources
- Cloudflare DNS records
- Cloudflare DNS FAQ
- Cloudflare plan feature list
- Cloudflare Terraform provider
- Hurricane Electric
- deSEC (Nextcloud interview)
- deSEC (RIPE presentation)
- ClouDNS plans
- ClouDNS feature comparison
“Not verified” means we could not confirm the point from the provider’s own documentation.
3. Provider by Provider#
Cloudflare DNS#
Cloudflare says it never limits or caps DNS queries, and the free plan includes DNSSEC. The catch is the record cap: free zones created on or after 1 September 2024 are limited to 200 records, while older free zones keep 1,000. Pro and Business zones allow 3,500 (Cloudflare).
Free zones also use a full setup only. Partial setup, where you keep another DNS host and point a CNAME at Cloudflare, is a Business feature, and zone transfers are Enterprise only. That means a Cloudflare free zone cannot act as a secondary or feed one.
Hurricane Electric#
Hurricane Electric’s free DNS service supports a long list of record types, including A, AAAA, ALIAS, CAA, MX, TXT and SRV, plus slave zones, IPv6 and dynamic DNS (Hurricane Electric). Its dynamic DNS can update TXT records, which is useful for DNS-based certificate validation. Its page does not publish zone or record limits, and the DNSSEC line on it dates from 2020, so confirm current DNSSEC support in your account before relying on it.
deSEC#
deSEC is run by a German nonprofit and is designed around DNSSEC, which it enables automatically. Its founder describes it as aiming to do for DNS security what Let’s Encrypt did for certificates (Nextcloud). The limit to know about is the API. A deSEC staff reply on its forum describes a per-user cap of 2,000 requests per day and says that writing a record causes the domain to be re-signed, which is why heavy Terraform runs can hit rate limits (deSEC forum). The Terraform providers are community projects, not official.
ClouDNS Free#
The free plan gives you four unicast servers, one zone, 50 records, 500K queries a month, one mail forward and one dynamic DNS hostname, with live chat support (ClouDNS). DNSSEC and anycast are not included. The cheapest paid plan, Premium S at $2.95 a month, adds anycast servers, 5 zones, 200 records and 5M queries (ClouDNS). That makes ClouDNS a reasonable starter for a single personal site, not a home for several domains.
Dynamic DNS services#
If you only need to point a hostname at a changing home IP, FreeDNS (afraid.org) and Namecheap’s free DNS service are worth a look. IONOS reports that afraid.org’s free version offers up to five subdomains and is ad-free, and that Namecheap’s free service supports dynamic DNS for domains registered with any provider (IONOS). Treat them as dynamic DNS tools first and general DNS hosts second.
4. Paid Benchmarks: Route 53 and Google Cloud DNS#
Neither of these has a free tier, but both are cheap for a small site and make a useful yardstick.
| Amazon Route 53 | Google Cloud DNS | |
|---|---|---|
| Zone price | $0.50 per month for the first 25 zones | $0.20 per month for the first 25 zones |
| Standard queries | $0.40 per million (first billion) | $0.40 per million (first billion) |
| Records | Up to 10,000 per zone included | Not capped in the pricing page |
| Free tier | No | No |
| One zone, 5M queries a month | About $2.50 | About $2.20 |
Sources
The last row of the table is our estimate from those rates and excludes health checks and other add-ons.
For a business site, a few dollars a month buys contractual support and predictable limits. Free tiers are fine for personal and low-risk domains.
5. Reliability and Redundancy#
None of the free tiers above advertises an uptime guarantee comparable to a paid contract, so decide how much an outage would cost you. The standard protection is a second DNS provider that holds a copy of your zone.
Secondary DNS works through zone transfers, and Hurricane Electric supports slave zones that pull from a primary and respond to its change notifications (Hurricane Electric). Your primary must allow transfers out. Cloudflare’s free plan does not, so it cannot serve as that primary. Check both sides of the arrangement before you design around it.
6. Moving Between DNS Providers#
Moving DNS is low risk if you prepare:
- Export or copy every record before you start, including TXT records for email authentication.
- Lower record TTLs a day or two ahead, so changes take effect faster.
- Recreate the zone at the new provider and test it before changing nameservers at the registrar.
- If DNSSEC is on, plan the DS record change carefully. A mismatch can make validating resolvers reject your domain.
Some registrars restrict this. For example, Cloudflare Registrar requires its own nameservers on domains registered there, so you cannot move DNS elsewhere without transferring the domain out.
7. Which One to Choose#
- General website or small business: Cloudflare, if 200 records is enough.
- DNSSEC with minimal setup: deSEC, if its API limits suit your automation.
- Secondary DNS or reverse zones: Hurricane Electric.
- One tiny zone with live chat support: ClouDNS Free.
- Production with support and predictable terms: Route 53 or Google Cloud DNS.
DNS Hosting Does Not Protect You From Expiry#
Free DNS keeps your records answering, but it cannot keep your domain registered. If the registration lapses, resolution stops whichever provider you use, and forgotten records pointing at services you have stopped using are a separate risk. Use ExpiryHawk to track domain expiry independently of your registrar and DNS host, and confirm each provider’s current limits on its own pages before you migrate.
