Managed DNS Plans

Small monthly prices for the infrastructure you actually use

Launch status

The catalogue on this page is implemented for the v2 launch. At the last verified production snapshot on 2026-08-29, the service still used the legacy stack. That dated evidence is not proof of current live state; reverify the deployed service before making a current claim. Checkout and the features below must not be treated as generally available until the coordinated cutover is verified.

Cost-recovery pricing

Paid plans fund servers, monitoring, backups, payment processing and ongoing maintenance. They are intended to recover the cost of operating the service, not to turn DNS answers or customer data into a profit centre.

France consumer reference (75001), in EUR, without a discount or business tax exemption. The final total depends on buyer details confirmed by Paddle before payment. Estimate for your country. Live checkout is not open during qualification.

Monthly recurring payments are being qualified with Paddle as reseller; live checkout is not open. Paddle collects applicable taxes and shows the final tax-inclusive total before payment. The Free plan requires no payment method.

Feature matrix

Availability and plan entitlement are separate:

• Stable launch contract means the feature is intended to be available to the listed plan after the verified v2 cutover.
• Preview allocation is only a finite plan ceiling. Buying the plan does not activate the feature; it remains unavailable until server-side preview enrollment is deployed, its external acceptance gate passes and the account or installation is explicitly enrolled.
• Unavailable means no new customer activation is supported. Existing Smart objects retain only safe read/delete/unwind continuity.

Only authoritative and secondary zone counts are unlimited on Enterprise. Its finite maxima are 10,000 records per zone under fair use, a 50,000-record technical ceiling, 1,000,000,000 DNS queries per day under fair use, 60,000 API requests per minute, 100 teams, 500 members per team, 1,000 configured health checks per zone, 1,000 active health checks per account and 1,000,000 retained zone-history record versions per account. These are safety/admission ceilings, not an SLA, guaranteed throughput or an overage tariff. Disabled monitor configurations do not count against the account-wide active-monitor ceiling. Analytics days are the canonical zone owner’s current reporting-access window, not a tier-specific storage-deletion schedule or indefinite pay-once archive. The dormant smart-record catalogue values remain finite technical ceilings, not launch availability.

For capacity and reliability, le_dns retains the same privacy-safe authoritative aggregates independently for up to 180 days hourly and 730 days daily. An upgrade may expose only the upgraded plan’s bounded current window; a downgrade narrows customer access immediately. These aggregates are not raw per-query logs or client histories.

Smart/active answers are excluded from every paid launch entitlement. New create/update/target mutations are unavailable; existing objects retain read/delete/unwind access only. A future content-hash signing architecture must prove every selected variant against DNSSEC before general availability. Disabling DNSSEC is not a supported workaround.

Health checks are a bounded monitoring preview and never select authoritative answers. Plesk is a limited October pilot preview. Health, Plesk, Enterprise SAML and customer-provided KSK are not automatically activated by a paid plan: they remain unavailable until server-side enrollment is deployed, the relevant external acceptance gate passes and the account or Plesk installation is explicitly enrolled. Health requires probe-fleet egress/failure validation; Plesk requires the supported-panel lifecycle matrix; SAML requires the representative IdP and certificate-rollover matrix; and BYOK requires the public-delegation and HSM rollover rehearsal. Repository implementation does not make any of these features generally available on the legacy production service.

Primary and secondary DNS

Primary mode stores and serves records managed through the portal or API. Secondary mode keeps the customer’s primary authoritative server and pulls updates through TSIG-authenticated AXFR or IXFR. TSIG authenticates transfers but does not encrypt standard zone-transfer traffic.

Hobby

Hobby adds long-lived personal API keys, supported CLI/integration automation, zone-file import with a dry-run preview, a seven-day aggregate view and seven-day zone history. It is intended for personal services and small self-hosted deployments that exceed Free limits. Zone history is a bounded recovery aid: Hobby retains at most 10,000 record versions per account, with no overage billing. DNS changes continue if that safety ceiling pauses new history capture, and the portal shows the resulting gap.

Pro

Pro adds longer history, with a finite 100,000 retained record-version ceiling per account, one team with up to five members and change approvals. Its preview allocations are ten configured health checks per zone, 150 active checks per account and the Plesk pilot; none becomes available merely by buying Pro. Once explicitly enrolled, a monitor’s configured interval is a best-effort scheduling target rather than an SLA, and the returned observation age and stale state expose actual recency. Automatic smart-answer selection is unavailable. The enrolled Plesk preview sends bounded HTTPS desired state: Plesk remains the record-management source while le_dns stores and serves an authoritative primary copy. It does not use bulk secondary-zone transfer automation.

Enterprise

Enterprise removes only the authoritative and secondary zone-count limits. It carries finite preview allocations for SAML 2.0 SSO, customer-provided KSK support and health monitoring, but those features remain unavailable until enrollment and their respective external acceptance gates. It still enforces every finite fair-use, safety, history, team, member and monitoring maximum stated above; Smart launch admission remains zero. The current signer accepts RSA/SHA-256 and ECDSA P-256 keys; P-384 and Ed25519 are not yet supported.

Billing without hostage tactics

• No paid plan is preselected for Free users.
• Cancellation keeps paid access until the end of the current paid period.
• A failed recurring payment receives a seven-day grace period before the account returns to Free. Existing DNS and recovery continue, but new paid-only objects, authority, automation and scheduled monitoring pause immediately.
• Billing state never rewrites DNS answers, redirects domains to ads, or deletes zones.
• If an account returns to Free while above Free limits, existing zones continue to be served. New zone creation and paid-only controls remain limited until the account is back within Free limits or a paid plan is restored.

See the canonical pricing and billing policy.

API availability

The v2 public plan catalogue is exposed by GET /api/v1/plans. Billing operations require an interactive browser session; API keys cannot start, inspect or cancel a subscription. Do not automate against these routes until v2 is deployed.

Legal review

Pricing display, VAT treatment, cancellation rights and consumer-law wording require approval by qualified French/EU counsel and accounting review before this page is used as final commercial terms.