Domain registration and authoritative DNS for teams who need their nameservers in the same legal regime as their data

For most teams, you would not. Cloudflare is genuinely excellent infrastructure and the free tier is one of the best deals on the internet. We win in two specific scenarios. First: when EU sovereignty is a real requirement, not just a preference. Cloudflare is a US company and the Cloud Act applies regardless of which datacenter your zone happens to be served from. Second: when you need domain registration and DNS under one EU-jurisdiction contract, which Cloudflare provides only through their US registrar. If neither applies, Cloudflare is a fine choice and we will tell you that on a discovery call.

Standard zone transfer process. You export your zone from the current provider (AXFR transfer or zone file export, both work), import into our system via API or web upload, verify the records, then update the NS records at your registrar to point at our nameservers. Propagation typically completes within an hour for most resolvers, 24 hours for the long-tail caches. The records continue serving from the old provider during propagation, so there is no downtime. We help with the migration on the Standard tier and above, no extra fee. For complex migrations involving GeoDNS or unusual record types, we do a parallel-run validation period of 7 days where the old and new are both authoritative for verification before final cutover.

Yes, both directions, no retention games. Transfers in: provide the auth code from your current registrar, we initiate the transfer, completion typically takes 5 to 7 days per ICANN policy. Transfers out: request the auth code from us via dashboard or support ticket, we provide it within 24 hours, you initiate the transfer at the receiving registrar. We do not lock domains, we do not require upgraded support to release auth codes, we do not charge transfer-out fees beyond the ICANN-mandated minimum. Domain ownership belongs to the customer, not the registrar; we treat it that way.

DNSSEC is enabled on every zone by default and we manage it for you. Key generation, KSK and ZSK rotation on the standard schedule, automatic signing of all record types, NSEC3 with opt-out for performance. The DS record gets published to the parent zone (the registry) automatically when you register through us; for domains registered elsewhere, we provide the DS record value and you publish it at your registrar. Key rotations happen on a documented schedule with overlap to avoid validation failures. The complexity of DNSSEC is real but we handle it operationally; you get the security benefit without the management overhead.

Anycast architecture means a single PoP failure does not affect resolution; resolvers fail over to other PoPs automatically. A coordinated multi-PoP failure (the kind that has hit even Cloudflare and Route 53 historically) is rare but possible. For customers who want belt-and-suspenders redundancy, we support secondary DNS configurations where you run a second authoritative DNS provider in parallel (we recommend dnscale.eu for EU-only secondary or PowerDNS-based open-source on your own infrastructure). The dual-primary configuration uses standard zone transfers and means a complete OS Domains DNS outage would not take your records offline. Most customers do not bother because the primary infrastructure has been reliable, but the option exists.

Yes. Hidden master configurations work cleanly: your primary stays where it is, we receive zone transfers via AXFR/IXFR and serve as secondary nameservers. This is common for customers who want to add EU sovereign secondary to a US-primary setup, or for customers who want geographic redundancy across providers. Secondary-only pricing is the same as primary; we do not discount secondary because the operational cost is the same on our side. The arrangement is documented in zone transfer authorizations and works with Cloudflare, Route 53, NS1, BIND, PowerDNS, and any other authoritative DNS implementation that supports standard zone transfer protocols.

Yes, designed for it. The bulk registration workflow accepts a list of domains via API or CSV upload, runs availability checks, processes registrations in batch, and configures DNS records from a template. Common patterns we see: 50 to 200 domains for cold email agency client onboarding, 20 to 50 brand-protection registrations for a single business launching a new product line, 100+ domains for SaaS customers offering custom domains as a product feature. Bulk pricing applies at 50+ domains: 5% off list rate. At 200+ domains: 10% off. We have processed individual customer batches up to 800 domains without flagging issues at the registrar level.

We register most of them. Some examples: .io, .dev, .app, .ai, .co, .tech, .design, .software, .blog. The pricing varies significantly by TLD because the underlying registry rates vary. Pricing is at-cost passthrough plus our standard management fee, with no hidden markups. The handful of newer TLDs we do not register are typically those with poor abuse handling on the registry side or pricing instability. If you need a TLD not on our list, ask; we may register it through a different partner registrar specifically for your case.

Yes, all three are supported on every tier including Free. CDS and CDNSKEY automate DNSSEC key transition (you publish the new KSK in CDS/CDNSKEY records, the parent zone picks it up automatically, no manual DS update at the registrar). OPENPGPKEY publishes PGP public keys via DNS for email cryptographic verification. SMIMEA does the same for S/MIME certificates. These are not the most-requested features but the senders who care about them tend to care a lot, and supporting them costs us almost nothing operationally so we do.

No. The Free tier is genuinely free, with no time limit and no upgrade pressure. The limitations are the published ones: 5 zones, 1M queries per month, EU-only anycast, community support. If you exceed those limits, your zones are not silently degraded; we email you, you have 30 days to upgrade or reduce usage, then queries beyond the limit are rate-limited but not refused. We run the Free tier because EU sovereign DNS at the entry level should not require a payment to access, and because we believe infrastructure for small projects should be available without friction. The Free tier is funded by the paid tiers; that is the whole funding model, and there is no premium feature held back specifically to push upgrades.

Pro tier covers up to 250 million queries per month. Above that, Enterprise pricing kicks in and the per-query rate drops significantly. Customers running billions of queries per month (large SaaS, popular consumer apps) pay roughly €0.10 per million queries on annual contracts, which is comparable to AWS Route 53 list pricing without the AWS-specific friction. We do not publish Enterprise pricing because the negotiation depends on volume commitment, contract length, and additional services. The discovery call covers it.

Yes. Registrar and DNS are separate products and there is no requirement to use both together. Some customers use us as registrar (for the EU-jurisdiction registration) and run DNS on their own BIND or PowerDNS infrastructure, or on dnscale.eu, or even on Cloudflare for the CDN integration. The registration product gives you the right to specify any nameservers; we are not in the business of forcing DNS bundling. Same the other direction: customers can run DNS with us with domains registered at any other registrar, as long as the registrar lets them set custom NS records (which all reputable registrars do).

WHOIS privacy is enabled by default on every domain we register where the TLD allows it. The post-GDPR landscape is uneven: gTLDs (.com, .net, .org, etc.) implement WHOIS privacy via redaction protocols that vary by registrar, ccTLDs vary by country (some redact aggressively, some not at all). For domains where privacy is not implemented at the registry level, we do not publish customer details beyond what is legally required, which usually means a registrar contact rather than the customer. Subpoena requests for WHOIS data go through proper legal process; we do not respond to copyright-cease-and-desist letters or template phishing attempts asking for customer details.

Anycast routing is designed to survive partial failures. When a PoP becomes unreachable, BGP withdrawal causes resolvers to fail over to the next-closest PoP automatically, typically within seconds. The customer impact is usually limited to a brief latency increase on resolution rather than actual lookup failures. We monitor each PoP independently and we have automated alerting that fires within 30 seconds of degraded service. Historical PoP-level events have lasted under 15 minutes in 2025 and resolved without customer impact thanks to anycast failover. The architecture is designed assuming PoPs will occasionally fail; the failure mode is not "global outage", it is "local performance dip".

Yes, fully. NS records on any subdomain delegate that subdomain to whatever nameservers you specify, and we handle the parent zone authoritatively while letting the subdomain be served from elsewhere. Common use cases: dev.example.com hosted on a cloud DNS service for the development team, status.example.com delegated to Statuspage, branded subdomains delegated to SaaS providers that need to control their CNAME chains. The delegation works with full DNSSEC chain-of-trust if the subdomain provider supports DNSSEC, which most modern providers do. Glue records are supported for delegations that need them.

All supported, all handled cleanly. MX records with proper priority handling. SPF as TXT records with our auto-flattening tool that helps stay under the 10-lookup limit. DKIM with TXT records up to the maximum length supported by major mailbox providers. DMARC as TXT with proper rua and ruf addressing. BIMI as TXT with VMC integration if you have one. MTA-STS via the special _mta-sts.example.com TXT record plus the well-known HTTPS endpoint (which we serve from our infrastructure if you want, or we just publish the DNS records and you serve the endpoint yourself). For customers also using our /managed-dmarc product, the integration is automatic; the DMARC records, the rua addressing, the report aggregation, all configured through one workflow.

For most TLDs, the registrar choice is determined by the TLD itself: .de is registered through Hetzner because they have the best operational footprint with DENIC, .com is registered through Gandi because their EU operation handles the gTLDs cleanly, .se is registered through Internetstiftelsen as the official Swedish registry for .se. For TLDs with multiple registrar options, you can specify a preference during registration. The default is whichever partner registrar gives us the cleanest operational pattern (least anti-fraud friction, best abuse handling, best support response time). If your procurement requires registration through a specific registrar that we do not currently use, we can usually accommodate, with the caveat that adding a new partner registrar takes 4 to 6 weeks to set up properly.

Domain registration and DNS hosting are billed separately and can be cancelled independently. If you cancel DNS and keep registration, your zones move from our nameservers to whatever you specify; the registration continues at the registrar. If you cancel registration and keep DNS, the domain expires at the end of its current period unless you transfer it to another registrar before then; the DNS continues to serve the records. We send 30, 60, and 90 day reminders before any expiration event. Auto-renewal is opt-in, not the default; we believe customers should make active decisions about their domain renewals rather than discover charges after the fact.

Yes, our Austrian GmbH holds ICANN accreditation for the gTLDs we register directly. For TLDs we register through partner registrars (most ccTLDs and some specialty gTLDs), the partner registrar holds the accreditation and we are a reseller. The customer-facing experience is the same regardless of accreditation path; the difference matters mostly for transparency and for bulk-registration thresholds. Customers needing direct ICANN-accredited registration for compliance reasons can specify that during onboarding and we route the registrations through our directly-accredited path.

deSEC is excellent infrastructure operated as a non-profit by SSE in Germany. The service is genuinely free, fully open-source, and operationally serious. We are not a non-profit and we are commercial; the difference matters in three ways. First: SLA. deSEC does not offer signed SLAs because they are non-profit and cannot make those commitments responsibly; we do, with service credits, on Standard tier and above. Second: domain registration. deSEC is DNS only; we offer registration as part of the same contract. Third: support response time. deSEC support is community-driven and best-effort; ours is contractual with documented response windows. For pure free DNS hosting on hobby projects, deSEC is genuinely a great choice and we will tell you that. For anything requiring an SLA or a registrar relationship, we are the better fit.

Volumetric DNS amplification attacks against authoritative nameservers are common and we are configured to absorb them. The anycast architecture distributes attack traffic across PoPs, each PoP has overprovisioned capacity for query handling, and our upstream providers have additional DDoS scrubbing available for sustained large-scale events. Most attacks resolve themselves within minutes because the anycast architecture makes single-PoP attacks ineffective; the attacker would need to target every PoP simultaneously, which is logistically harder and economically less attractive. For customers who experience sustained targeted attacks, we can coordinate additional upstream filtering at no extra cost on Pro and Enterprise tiers.

No. Keep transactional mail on its own subdomain with its own DKIM key and DMARC policy, separate from the subdomain that carries marketing. A promotional send that draws complaints damages the reputation of whatever domain sent it, and sharing that domain with order confirmations means the confirmation a customer is waiting for inherits the damage for weeks. The separation costs an afternoon of DNS work and a second DKIM selector, and it protects the mail that cannot afford to miss the inbox.