Pricing you can
read in sixty seconds.
One free tier that isn’t a trial. One paid tier that grows with you. One enterprise tier for the spreadsheet people. Nothing hidden.
- ◇∞ zones · ∞ records · ∞ queries
- ◇DNSSEC with automatic key rollover
- ◇DNS.Clinic MCP server included
- ◇Global anycast via your own nodes
- ◇Docker compose dev stack
- ◇Kubernetes helm chart
- ◇Community Discord + GitHub issues
- ◇Bring-your-own PowerDNS or Bind
- ◇Everything in Open Source
- ◇30-region self-hosted BGP anycast (66.253.71.0/24)
- ◇Managed wildcard SSL · auto-renew
- ◇5 free domain registrations / year
- ◇Unlimited status pages
- ◇15 monitoring regions · 30s intervals
- ◇On-call rotations · Slack / Teams / PagerDuty
- ◇MCP · 500 agent tool calls / month / seat
- ◇SOC-2 Type II · SAML SSO · audit export
- ◇24/7 support · 15-min response P1
- ◇Everything in Cloud
- ◇On-premise deployment · air-gapped
- ◇Bring-your-own HSM for DNSSEC
- ◇Custom TLDs · brand gTLD onboarding
- ◇White-labeled status pages
- ◇Unlimited seats + MCP tool calls
- ◇Dedicated infra in your region
- ◇99.99% uptime SLA with financial penalties
- ◇DPA · BAA · HIPAA · PCI · FedRAMP (Q4)
- ◇Named CSM · quarterly architecture review
Everything, side by side.
| Open Source | Cloud | Enterprise | |
|---|---|---|---|
| DNS zones | ∞ (self-hosted) | ∞ | ∞ |
| DNS records | ∞ | ∞ | ∞ |
| DNS queries / month | self-served | ∞ | ∞ |
| Anycast regions | BYO | 30 | 30 + private |
| DNSSEC | ✓ | ✓ managed | ✓ HSM |
| Domain registrations | BYO registrar | 5 free · wholesale after | unlimited · wholesale |
| SSL certificates | BYO ACME | managed wildcard + SAN | HSM-backed + private CA |
| Monitoring regions | — | 30 | 30 + private probes |
| Check interval | — | 30s | 15s |
| Status pages | OSS build | ∞ | ∞ white-labeled |
| Status page subscribers | — | ∞ | ∞ |
| On-call rotations | — | ∞ | ∞ |
| Escalation policies | — | ∞ | ∞ |
| Incident history | self-hosted | ∞ | ∞ with SIEM export |
| MCP tool calls / seat / mo | — | 500 | unlimited |
| Audit log | self-hosted | 30d · queryable | ∞ · exportable |
| SAML SSO | — | ✓ | ✓ with SCIM |
| SOC-2 | — | Type II | Type II + HIPAA + PCI |
| On-prem deployment | self-host | — | ✓ |
| Support | community | 24/7 · 15m P1 | 24/7 · dedicated · CSM |
| Monthly price (10 seats) | $0 | $490 | starts at $2,500 |
Modular pricing. Only what you use.
For agents that really, really want to run dns_check_propagation every five seconds.
Headless-browser synthetic checks with screenshot + video capture on failure.
.ai · .io · .sh · .studio — priced at registry cost. We take nothing.
Your DNSSEC keys in an AWS CloudHSM cluster you control. Dual-person access.
Push a Relays probe binary inside your VPC for zero-trust monitoring.
Ship a status page on your domain with zero Relays branding.
When your agent holds the card.
Agents get their own capability tokens with their own spend caps. Every tool call is content-addressed. Billing events fire per-capability, not per-user — so you always know which agent spent what.
| cap_9fe2 · ONE · mira | $142.00 |
| cap_10c1 · claude · code | $28.30 |
| cap_5d42 · cursor · ravi | $14.10 |
| cap_7a91 · windsurf · aisha | $6.90 |
| cap_2b18 · custom · prod | $212.40 |
| 10 seats · cloud | $490.00 |
| total | $893.70 |
The questions we kept getting.
Is the free tier a trial?
No. The Open Source edition is permanently free, MIT-licensed, and self-hosted. You run it on your own machines. We do not timer it, gate features behind a paywall, or suddenly rug-pull it in v2.
What’s actually different about the Cloud tier?
Managed hosting on our 30-region self-hosted anycast network (PowerDNS + BIRD2 BGP, IPXO-assigned /24), automatic SSL with dual-CA fallback, 30-region monitoring, included MCP tool call budget, 24/7 support with 15-minute P1 response, SOC 2 Type II, and SAML SSO. If you want the convenience, you pay for it. If you don’t, you don’t.
How does MCP billing work?
Each Cloud seat gets 500 agent tool calls per month. Calls that return from cache are free. Calls that touch external registries (domain_register, domain_transfer) pass through wholesale pricing — we take no markup. Overages are $9 per additional 1,000 calls.
What do you mean “wholesale domain pricing”?
We charge exactly what our registry partners charge us, rounded to the nearest dollar. .com is $9, .io is $49, .ai is $79. Every TLD. Every time. No “loss leader .com for year one and then $34 after”. No “privacy for $14.99”. No “SSL for $69.99 please”.
Where is my data?
Your zones are stored in Postgres, with streaming replicas in every anycast region. You choose the primary region. You can export the full zone history at any time as BIND, JSON, or Terraform. Deleting a zone deletes every replica within 24h.
Do you have an SLA?
Cloud is 99.99% with SLA credits. Enterprise is 99.99% with financial penalties beyond credits. Open Source is whatever you run it on — we ship the code.
What about GDPR / DPA / BAA?
Cloud comes with a DPA out of the box. Enterprise adds BAA for HIPAA workloads, PCI segmentation, and FedRAMP Moderate is on the roadmap for Q4 2026.
Can I use Relays as my registrar without using Relays DNS?
Yes. Register a domain, point it at any nameservers you like. You keep the auto-renew, the WHOIS privacy, and the transfer lock. You just don’t get the managed zone.
Can I use Relays DNS without Relays as my registrar?
Yes. Bring your domain from any registrar, delegate NS to ns1.relays.one / ns2.relays.one, and you’re done. DNSSEC DS records can be published by us on your behalf or managed at your registrar.
What happens to my agent’s capability token if it’s leaked?
Revoke it in the dashboard, or call /v1/capabilities/:id/revoke from a break-glass token. All in-flight sessions re-key on the next MCP resource update — typically within a few seconds.
No credit card.
No seat minimums.
Start with the free tier. Upgrade when (if) you need the managed stack.