Thesis: Cloudflare’s free DNS tier gives you unmetered queries and a complete, documented API for USD 0/month — the constraints that actually matter are a 200-record quota on newer zones, primary (full) setup only, and no uptime SLA at zero cost, plus a DNSSEC migration trap that can black-hole your domain if you get the order wrong.
DNS is the least glamorous line item in your stack and the one most likely to take everything down when it’s wrong. If you’re assembling a free-tier stack from scratch — see our best free web hosting for 2026 hub — the zone you point your nameservers at is the foundation everything else hangs from.
Who This Guide Is For and How We Know
This guide is for indie hackers and bootstrappers who want a numbers-first DNS foundation with zero cost, not a marketing tour. It reflects desk research only: official documentation and pricing pages read on 2026-10-05, with every figure quoted from those pages and vendor performance claims labeled as vendor-reported.
Cloudflare DNS Free Tier at a Glance: What You Actually Get
Cloudflare’s free plan costs USD 0/month and includes “Fast, Easy-to-use DNS”, unmetered DDoS protection, a CDN, Universal SSL certificate, a free managed ruleset, and WAF — with no uptime SLA on Free, whereas Business carries 100%, per the Cloudflare plans page. Context for the upgrade ladder: Pro runs USD 20/mo billed annually (USD 25/mo monthly), Business USD 200/mo annually (USD 250/mo monthly), Enterprise custom.
The important structural point: there is no DNS query cap on the free plan. Queries are unmetered. The countable limit is the record quota, which we’ll get to. DNS itself is free and “completely controllable via a rich, well-documented API” with no API charge, and it supports Infrastructure-as-Code via Terraform and Ansible, running on an anycast network — all from the Cloudflare DNS product page, which headlines “The world’s fastest and most reliable DNS — for free”. That page reports vendor figures from BigScoots of an average lookup at 11 ms and global propagation under 5 seconds — vendor-reported, not independently measured here. If you’re new to the fundamentals, Cloudflare’s own What is DNS? learning page is a clean primer.
Practically, the free tier is the same DNS infrastructure the paid tiers run on. The zone setup and record management you get at USD 0 are what most single-domain side projects need indefinitely. It pairs naturally with our Cloudflare Workers free tier guide and Cloudflare Pages free tier guide if your app lives on the same account.
The 3 Real Free-Plan Limits That Force an Upgrade
Cloudflare’s free DNS has three limits worth memorizing: a 200-record quota for zones created on or after 2024-09-01 00:00:00 UTC, primary (full) zone setup only, and no uptime SLA — all documented on the DNS record quota page and the zone setups reference.
1. Record quota, not query quota. Free zones created before 2024-09-01 00:00:00 UTC: 1,000 records. Free zones created on or after 2024-09-01 00:00:00 UTC: 200 records. Pro and Business both give 3,500. Enterprise has no per-zone limit, using an account quota instead (public and internal zones counted separately, 1,000,000 records each by default). Note that records other Cloudflare services create — TXT or MX records added by Email Routing, for example — also count toward your quota, with a small buffer applied. Usage is retrievable via the API, so you can poll it in a script rather than watching the dashboard.
200 sounds tight until you count a realistic side project: apex A/AAAA, a www CNAME, a few verification TXTs, MX, SPF, DMARC, and a dozen service subdomains lands you somewhere in the 20–40 range. You hit 200 when you automate record creation carelessly.
2. Primary (full) setup only. Free and Pro support only the “primary setup (full)” — you change your nameservers to Cloudflare and manage all records there. CNAME setup (partial), which keeps your own provider and proxies only some subdomains, is Business/Enterprise. Zone transfers and Secondary DNS are Enterprise, as is subdomain setup. So “keep DNS where it is and just proxy through Cloudflare” is not a free-tier option.
3. No uptime SLA on Free. Business carries a 100% SLA; Free has none. That’s a contractual limit, not an outage claim.
Setting Up Your First Zone: Step-by-Step
Setting up a Cloudflare zone on the free plan is a five-step, no-cost process: add the domain, pick the Free plan, review the auto-imported records, change your nameservers at the registrar, then wait for the change to be detected and verify. The canonical walkthrough is Cloudflare’s Get started docs.
- Add the domain. Create an account, enter your hostname, and Cloudflare scans existing records.
- Pick the Free plan. You’ll see Pro and Business presented; Free is a valid selection, USD 0/month.
- Review imported records. The scan pulls whatever your current DNS host has. Delete stale entries — every one of them counts against your 200-record quota if your zone is new.
- Change nameservers at your registrar. Cloudflare shows you two (occasionally more) nameservers to set at your registrar. This is the only change you make at the registrar for setup itself.
- Wait and verify. Once the change is detected, the zone activates. Then confirm resolution and turn on DNSSEC (covered below).
Order matters for one scenario only — migrating a domain that already has DNSSEC. Disable DNSSEC at the registrar before you change nameservers, never after. More on why in the DNSSEC section.
If your app is hosted elsewhere — our Vercel free tier guide and Netlify free tier guide both walk through the records those platforms expect — add those records after the zone activates.
DNS Record Types and TTL Rules You Need to Know
Cloudflare requires at least one IP-address-resolution record (A or AAAA) per domain, and only A, AAAA, and CNAME can be proxied, according to the DNS record types reference and TTL reference.
Supported types: A, AAAA, CNAME, MX, TXT, SRV, CAA, NS, DS, DNSKEY, email-auth records (DKIM, SPF, DMARC), plus less common URI, NAPTR, SSHFP, TLSA, SMIMEA, CERT. Two constraints worth flagging: NS records are capped at 10 per delegation name, and anything more than 10 is rejected — best practice is 7 or fewer, per RFC 1912. SOA defaults are Record TTL 3600 (range 1800–3600) and Minimum TTL (negative caching) 1800 (range 60–86400).
TTL behavior splits on the proxy status:
- Proxied records: TTL is forced to Auto = 300 seconds (5 minutes) and cannot be edited.
- DNS-only (unproxied) records: TTL between 60 seconds and 1 day for non-Enterprise (30 seconds is Enterprise only); Auto = 300 seconds.
The practical consequence: if you’re comparing TTL behavior while troubleshooting, a proxied record’s 300-second value isn’t a bug. Flip it to DNS-only if you need to control TTL — but then you lose the proxy, CDN, and Universal SSL in front of that record.
One free-plan nicety: CNAME flattening at the zone apex is available on the free plan, so you can point example.com itself at a platform hostname. Paid accounts can choose to flatten all CNAME records (CNAME flattening docs). This is exactly what you need when a host like Vercel or Netlify gives you a CNAME target for the apex.
DNSSEC on Free: Enable It Without Breaking Migration
DNSSEC is free on all Cloudflare plans, and the migration rule is absolute: DNSSEC must be disabled at the registrar before you change nameservers, because a stale DS record with new nameservers produces connectivity errors for the whole domain. Enabling it in the dashboard is the easy half — the ordering is the half that bites (DNSSEC docs).
Workflow for a fresh domain: in the dashboard, go to DNS Settings and select Enable DNSSEC. Cloudflare signs the zone and generates a DS record for you to paste at your registrar. Preferred algorithm: Algorithm 13 = ECDSA Curve P-256 with SHA-256. After publishing, verify with dig DS example.com — DS TTL is commonly 24–48 hours for most TLDs.
Workflow for an existing domain migrating to Cloudflare: remove the DS record at your current registrar first, wait for that change to propagate, then change nameservers, then add the new DS. If you skip the removal, resolvers keep validating against a DS that no longer matches the authoritative zone, and you get servfail responses while visitors see connection errors.
Rollback is the mirror image: remove the DS at the registrar, keep zone signing enabled in Cloudflare until the DS TTL expires, then you can safely disable signing. If your current provider supports external DNSKEY records, a zero-downtime path exists via multi-signer DNSSEC (active migration) — that’s the option to evaluate if you can’t afford a validation gap at all.
Automating DNS with the Free API
The Cloudflare API is free on the free plan, with record creation done by POSTing to the zones DNS records endpoint using a Bearer API token scoped DNS Write, and the main ceiling is rate limiting rather than price. Per-user/account tokens allow 1,200 requests per 5 minutes and 200 requests per second per IP (API rate limits).
POST https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records
Authorization: Bearer $API_TOKEN
Content-Type: application/json
{"type":"A","name":"app","content":"203.0.113.10","ttl":1,"proxied":true}Token limits worth knowing before you build automation: 50 user API tokens per user and 500 account API tokens per account. GraphQL is capped at 320 requests per 5 minutes. A ttl of 1 means automatic; for a proxied record Cloudflare pins it to the 300-second auto value. Because DNS record usage is itself retrievable via the API, a script can check your 200-record headroom before appending anything — which is how you avoid discovering the quota the hard way.
If you’d rather stay declarative, Cloudflare supports Terraform and Ansible for DNS on the free plan, so your zone can live in a repo alongside your app. That’s a natural extension of the pattern in our Cloudflare D1 free tier guide — treat DNS as code, version it, and roll it back like anything else.
Cloudflare vs Free DNS Alternatives
Cloudflare Free is the strongest default for an untethered anycast zone with unlimited queries, but free DNS alternatives exist with materially different limits — Bunny DNS and deSEC offer unlimited or always-signed DNS, while ClouDNS Free caps at 500K queries per month and Namecheap FreeDNS has no anycast on free (Bunny DNS pricing, ClouDNS Free, deSEC, Hurricane Electric Free DNS, Namecheap FreeDNS).
| Provider | Free price | DNS query limit | Zone/record limits | Anycast | DNSSEC | API/IaC | Notable caveat |
|---|---|---|---|---|---|---|---|
| Cloudflare Free | USD 0/month | None — unmetered | 1,000 records (zones before 2024-09-01); 200 records (on/after) | Yes | Yes, free on all plans | Full API; Terraform, Ansible | Primary (full) setup only; no uptime SLA on Free |
| Bunny DNS | Free ($1 Monthly Minimum tier adds all features) | Unlimited standard and unlimited smart queries | Up to 500 DNS zones | Not stated on reviewed pages | Not stated on reviewed pages | Not stated on reviewed pages | Free built-in monitoring; $1 monthly minimum tier |
| ClouDNS Free | Free (“Free Forever”) | 500K DNS queries/month | 1 zone, 50 DNS records, 4 unicast servers | No — unicast | Premium only (from USD 2.95/mo) | Not stated on reviewed pages | 1 mail forward, 1 Dynamic DNS hostname, 24/7 live chat |
| deSEC | Free | Not stated on reviewed pages | Not stated on reviewed pages | Yes — global anycast | Always on | REST API; Terraform, Go, Python, JS | “.dedyn.io registration is now suspended until further notice.” |
| Hurricane Electric Free DNS | Free | Not stated on reviewed pages | Not stated on reviewed pages | Not stated on reviewed pages | No — listed as “exploring” | Not stated on reviewed pages | Open Beta limited to IPv6 certification/tunnelbroker, colocation, transit customers |
| Namecheap FreeDNS | Free | Not stated on reviewed pages | Not stated on reviewed pages | No | No — PremiumDNS only | Not stated on reviewed pages | No anycast, DDoS protection or SLA on free; nameserver change, verification within 16 hours |
Reading the table: if you need unlimited queries plus anycast plus DNSSEC at zero cost, Cloudflare is the one that checks every box. Bunny DNS is the interesting runner-up for zone count — up to 500 zones — with unlimited queries. deSEC is the pick for people who want DNSSEC structurally non-optional and an open-source non-profit operator. Hurricane Electric’s free DNS is explicitly not for the general public — its Open Beta is limited to IPv6 certification/tunnelbroker account holders, colocation customers, and transit customers, and it has no DNSSEC. Namecheap FreeDNS works as a secondary DNS host but has no anycast, no DDoS protection, no DNSSEC, and no uptime SLA on free (those belong to PremiumDNS, under USD 5/yr).
Also worth separating: 1.1.1.1 is a different product from Cloudflare’s authoritative DNS. It’s a free public resolver that Cloudflare cites as the fastest public resolver per dnsperf (a vendor-reported benchmark, not independently measured here), supports DNS over HTTPS (DoH) and DNS over TLS (DoT), has a “1.1.1.1 for Families” mode for malware and adult filtering, is reachable as a Tor hidden service, and — per Cloudflare — does not sell user data to advertisers. You use it on your laptop or VPS; you don’t point your NS records at it.
The Bottom Line
Cloudflare DNS on the free plan is the right default for an indie stack: USD 0/month, unmetered queries, no API charge, anycast, DNSSEC included, CNAME flattening at the apex, and a record quota (200 on new zones, 1,000 on pre-2024-09-01 zones) that a real project will rarely touch. The two things to decide up front are whether primary (full) setup at your registrar is acceptable — partial CNAME setup is Business/Enterprise — and whether you can sequence a DNSSEC migration correctly. If both answers are yes, there’s no reason to pay for DNS until you need a contractual uptime SLA, a CNAME partial setup, secondary DNS, or a subdomain zone. Pair it with our Cloudflare Turnstile free tier guide and Cloudflare R2 free tier guide to round out the free tier.
How This Guide Was Built
This guide is based on official documentation and pricing pages fetched on 2026-10-05 — no account was created, no zone was added, no DNS record was changed and no query was measured hands-on. Every figure comes from Cloudflare’s plans, product, and developer documentation pages or from the providers’ own pricing pages, with performance numbers attributed to the vendor that published them.
FAQ
Is Cloudflare DNS really free? What’s the catch?
Yes — the free plan is USD 0/month and includes “Fast, Easy-to-use DNS”, unmetered DDoS protection, CDN, Universal SSL certificate, a free managed ruleset, and WAF per the Cloudflare plans page. The catch is scope, not billing: 200 records on zones created on or after 2024-09-01, primary (full) setup only, no uptime SLA on Free, and paid upgrades at Pro USD 20/mo annually and Business USD 200/mo annually.
Does the free plan cap how many DNS queries I can receive?
No. There is no DNS query cap on the free plan — queries are unmetered. The countable limit is the record quota, not traffic. Cloudflare publishes that quota on its DNS record quota page, and current usage is retrievable via the API so you can track it programmatically.
What happens if I forget to disable DNSSEC at my old registrar?
Resolvers continue validating your domain against a DS record that no longer matches your authoritative zone, producing connectivity errors across the domain. The fix ordering is: remove the DS at the registrar first, then change nameservers, then publish the new DS (DNSSEC docs). DS TTL is commonly 24–48 hours; verify with dig DS example.com.
Can I use Cloudflare DNS without changing nameservers?
Not on the free plan. Free and Pro support only the “primary setup (full)” — nameservers are pointed at Cloudflare and all records live there. CNAME setup (partial), which keeps your current provider and proxies only some subdomains, requires Business or Enterprise, and Secondary DNS, zone transfers, and subdomain setup are Enterprise (zone setups reference).