Picking free DNS in 2026 is harder than “just use Cloudflare” suggests

I compared ten free DNS hosts that all answer “where does this hostname point?” but solve different problems: Cloudflare DNS, Hurricane Electric Free DNS, FreeDNS, Namecheap FreeDNS, ClouDNS, deSEC, Dynu, Vercel DNS, Netlify DNS, and Porkbun DNS. The quick answers in forum threads mostly skip the part that actually bites you: redirects are not a DNS feature, Cloudflare Redirect Rules only work when Cloudflare sits in the traffic path, and “free DNS” products often cap zones, records, or API access in ways that do not show up on a landing page.

For subdomains plus edge redirects or Workers, my default is Cloudflare DNS. Create the hostname, proxy it, then apply Redirect Rules, Page Rules, or Workers. That is the only option in this set that cleanly unifies authoritative DNS, CDN proxying, and edge redirects on a widely used free plan. I wrote a step-by-step Cloudflare subdomain redirect tutorial if you want the UI walkthrough.

For DNSSEC-first authoritative DNS without caring about built-in URL forwarding, I would look at deSEC first. Managed DNSSEC is central to the product, not a paid add-on, and record-type support is unusually broad. The tradeoff is no ALIAS/ANAME and no provider-hosted redirect layer.

For a simple vanity redirect without moving the whole zone to Cloudflare, ClouDNS is the clearest free option I found with explicit web forwarding in official docs. One zone, 50 records, 500,000 queries per month on free. Enough for a personal site or redirect domain, not for a complex multi-subdomain setup.

Google Cloud DNS is not in the main tables below. Google explicitly states there is no free tier, only trial credits for new customers. It shows up in “free DNS” roundups anyway.

One terminology warning before the tables: many providers call URL forwarding a “DNS redirect” in their UI. In protocol terms, A, AAAA, CNAME, MX, TXT, SRV, and NS are DNS records. HTTP redirects, Page Rules, Redirect Rules, Workers, _redirects, and netlify.toml routing are application-layer features. A CNAME cannot perform an HTTP redirect. Some rows below are directional, not perfect apples-to-apples.

I prioritized official docs and pricing pages from mid-June 2026. Where docs were silent, I say so instead of guessing.

You cannot compare these on “free DNS” alone

Three different jobs get collapsed into one question:

flowchart LR
    Browser[Browser request]
    DNS[Authoritative DNS]
    Edge[Edge redirect layer]
    Origin[Origin or target URL]
    Browser --> DNS
    DNS --> Edge
    Edge --> Origin

Cloudflare’s own docs are explicit: it does not offer “DNS redirect services” as such. URL forwarding happens through Redirect Rules, Page Rules, or Workers, and those require proxied traffic. Dynu and FreeDNS describe their redirect features as web redirect or URL forwarding, not DNS record types.

The most important Cloudflare-specific gotcha: self-serve plans do not give you a clean “keep DNS elsewhere but still use Cloudflare redirects everywhere” workflow. Partial/CNAME setup is Business and Enterprise only. Delegated subdomain setup is Enterprise-only. In most hobby and small-site cases the honest answer is either move the zone to Cloudflare, or use the other provider’s own redirect mechanism.

The questions I ask before picking one:

Free tiers at a glance

Record types and subdomain features

Redirect methods and Cloudflare compatibility

What the free tiers actually feel like in use

Cloudflare: excellent DNS, but redirects are architectural

Cloudflare DNS on the free plan is hard to beat for general-purpose authoritative DNS with no query metering. DNSSEC is included. Wildcards, API access, and CNAME flattening for apex aliases all work.

The trap is not operational, it is architectural. Cloudflare is not a drop-in HTTP redirect layer on top of some other authority. Redirect Rules and Page Rules require proxied hostnames. If you want “keep DNS at HE.net but use Cloudflare redirects everywhere,” that is usually not available on the free path. Partial setup starts at Business. Delegated subdomain setup is Enterprise-only.

For vanity URLs like webinar.example.com pointing at an external booking page, Cloudflare DNS plus a proxied record plus a Redirect Rule is the clean model. See my Cloudflare subdomain redirect guide for the UI steps.

deSEC: DNSSEC done properly, not a convenience redirect host

deSEC is the option I would try first when DNSSEC is non-negotiable. Automatic managed DNSSEC is a core feature, not an afterthought. Record-type support includes HTTPS/SVCB and other modern RR types useful for DANE and ACME workflows.

The docs explicitly reject ALIAS/ANAME. There is no built-in URL forwarding. Community threads confirm an enforced domain limit per account that support can raise on request. For “free DNSSEC done right” that trade-off is often worth it. For “easy apex alias plus nice URL forwarding” it is not.

Hurricane Electric: the classic power-user toolbox

Hurricane Electric Free DNS offers broad RR support including native ALIAS, dynamic updates, slave/secondary support, and reverse DNS. The public update API is primarily DDNS and TXT updates rather than a full modern CRUD API.

The interface is dated. The portal still describes DNSSEC as something they were “exploring,” so I would treat DNSSEC as unclear or effectively unavailable. No built-in HTTP redirect surfaced in the docs I reviewed. Good for delegated subdomains and home-lab DDNS, not for edge redirects.

FreeDNS: flexible hobbyist service with shared-domain risk

FreeDNS remains useful for labs and prototypes. Unlimited domains on your account, 20 free subdomains per domain you own, DDNS update URLs, and Web Forward for simple redirects.

The FAQ explicitly warns that shared registry domains can disappear and recommends using your own domain for longevity. Wildcard DNS is paid. Building a brand-critical subdomain strategy on a shared afraid.org hostname is asking for pain.

Namecheap FreeDNS: easy manually, gated for automation

Namecheap FreeDNS works for domains registered elsewhere too. Up to 150 host records, ALIAS/ANAME support, URL Redirect records, and 100 forwarding email addresses on free.

The surprise is API access. Namecheap’s API FAQ says your account needs either 20 domains, $50 on balance, or $50 spent in the last two years before API access is enabled. For a one-domain hobby user who wants Terraform or a cron job updating records, that is a real blocker.

ClouDNS: small free plan, explicit web forwarding

ClouDNS free tier is intentionally small: one zone, 50 records, 500,000 queries per month. Web Redirect is documented explicitly. Wildcards and delegation work. DNSSEC is not on free.

That is enough for a personal site, vanity domain, or low-traffic redirect domain. Not for a complex delegated subdomain architecture or a high-query zone.

Dynu: friendly DDNS with a low free ceiling

Dynu free plan includes four hostnames and four subdomains. Community forum reports suggest about four DNS records per hostname on free accounts. URL forwarding and port forwarding are available. DNSSEC requires paid membership or a domain purchased from Dynu.

Better for small DDNS or home-lab use than for a larger multi-subdomain content setup.

Vercel and Netlify: deployment platforms first

Vercel DNS and Netlify DNS are strong when the site already lives on those platforms. Vercel supports ALIAS, domain redirects, and framework routing. Wildcard domains require the nameserver method. If your domain uses external DNS like Cloudflare, you cannot manage records through vercel dns add.

Netlify DNS explicitly does not support DNSSEC. Standalone subdomain support and wildcard SSL are well documented. Redirects belong in _redirects or netlify.toml, not in a separate DNS redirect record type.

Neither is a neutral “bring any domain” free DNS host in the same way Cloudflare, HE.net, or deSEC are.

Porkbun: registrar convenience with modern RR types

Porkbun DNS is free with Porkbun DNS management. ALIAS, HTTPS/SVCB, TLSA, SSHFP, and CAA are supported. DNSSEC controls exist when using Porkbun DNS. Zone, record, and query caps were not published in the docs I retrieved. Built-in HTTP redirect was not clearly surfaced in the DNS materials I reviewed.

Good when registration and DNS should stay together with modest automation needs.

Redirect method picker

If HTTPS matters, prefer application-edge redirects over provider URL forwarders unless the provider clearly documents HTTPS behavior. Cloudflare, Netlify, and Vercel treat redirects as first-class routing. Some DNS-host redirectors work fine for simple 301/302 use but are usually weaker for path preservation, query-string control, headers, and debugging.

Treat WHOIS privacy as a registrar question, not a DNS-hosting question. That matters for Namecheap and Porkbun comparisons where readers often bundle registration and DNS in their heads.

Sample configurations

Root domain with Cloudflare proxy and redirect

Redirect apex to www with Cloudflare:

; Cloudflare-managed zone
@      A      192.0.2.1        ; proxied
@      AAAA   100::            ; proxied (optional)
www    CNAME  your-origin.example.net   ; proxied

Then create a Redirect Rule matching the apex hostname and sending traffic to https://www.example.com, preserving path and query string. Cloudflare’s guide uses placeholder 192.0.2.1 and 100:: so redirects and Workers can run without a real origin on the alias domain. Redirect Rules only work when the hostname is proxied.

Subdomain delegation

Manage docs.example.com separately from the parent zone:

; Parent zone (where example.com is authoritative)
docs    NS    ns1.child-dns.example
docs    NS    ns2.child-dns.example

; Child zone (authoritative for docs.example.com)
@       CNAME   docs-hosting.example.net
_acme-challenge TXT "token-value"

Subdomains can be different DNS zones, not just extra records in one zone. ClouDNS documents subdomain delegation. Netlify documents standalone subdomain support without bringing over the apex. Cloudflare supports delegated subdomain setups in documentation, but current docs mark that flow as Enterprise-only, so it should not be the default free path.

Provider-native redirect without Cloudflare

When the zone is not on Cloudflare and you only need a simple redirect:

Host: blog.example.com
Action: 301 redirect
Target: https://www.example.com/blog

ClouDNS Web Redirect, Dynu URL forwarding, FreeDNS Web Forward, and Namecheap URL Redirect record all follow this pattern. Works for one-host aliases. Less attractive when you need large redirect sets, conditional logic, wildcard behavior, or edge-side headers.

Migration checklist

Reduce TTLs before any migration. Vercel’s troubleshooting docs recommend lowering existing TTLs to 60 seconds before DNS changes so rollback is easier. That advice applies across providers, not just on Vercel.

What I would pick

flowchart TD
    A[Need Cloudflare Redirect Rules or Workers on same hostname?] -->|Yes| B[Use Cloudflare as authoritative DNS]
    B --> C{Need only a delegated subdomain in Cloudflare?}
    C -->|Yes, self-serve plan| D[Move full zone or use another provider redirect]
    C -->|Yes, Enterprise| E[Use Cloudflare delegated subdomain setup]
    C -->|No| F[Create proxied records and use Redirect Rules or Workers]

    A -->|No| G{Is DNSSEC a hard requirement?}
    G -->|Yes| H[Choose deSEC]
    G -->|No| I{Dynamic DNS or home-lab use?}

    I -->|Yes| J[Choose HE.net, Dynu, or FreeDNS]
    I -->|No| K{Want registrar-bundled convenience?}

    K -->|Yes| L[Choose Namecheap FreeDNS or Porkbun]
    K -->|No| M{Site already on Vercel or Netlify?}

    M -->|Yes| N[Choose Vercel DNS or Netlify DNS]
    M -->|No| O{Want provider-native URL forwarding?}

    O -->|Yes| P[Choose ClouDNS, Dynu, or FreeDNS]
    O -->|No| Q[Choose Cloudflare, HE.net, or deSEC]

Vanity subdomain plus Cloudflare edge redirect: Cloudflare DNS and the subdomain redirect tutorial.

DNSSEC-first authoritative DNS: deSEC.

Classic power-user DNS with DDNS and reverse DNS: Hurricane Electric.

Registrar bundled, modest automation: Namecheap FreeDNS or Porkbun.

Simple provider-side redirect without moving to Cloudflare: ClouDNS.

DDNS and home-lab: Dynu, FreeDNS, or HE.net.

Already deployed on Vercel or Netlify: use that platform’s DNS and routing.

For net-new free DNS where none of those constraints apply, Cloudflare is still my default general-purpose pick. deSEC when I care about DNSSEC. ClouDNS when I need a documented free redirect host and one zone is enough.

Gaps in the public docs

Google Cloud DNS has no free tier. Trial credits are not the same as an ongoing free product.

Vercel, Netlify, and some registrar-bundled DNS do not publish clean DNS-only quotas for zones, records, or queries. Those rows say “not publicly specified” because I could not find a number, not because I assumed unlimited.

WHOIS privacy lives at the registrar layer. It is easy to mix that up with DNS hosting when you are shopping providers, but they are separate operationally.

Cloudflare Free zone record limits changed on 2024-09-01: 200 records on new zones vs 1,000 on older ones. If you are near the cap, check which bucket your zone falls into.

Propagation and SLA numbers in this post come from vendor docs. I did not run a controlled propagation shootout across all ten providers.

Sources

Cloudflare

Cloudflare DNS documentation
Cloudflare Redirect Rules
Cloudflare Page Rules
Cloudflare Workers limits
Cloudflare partial (CNAME) setup

Hurricane Electric

Hurricane Electric Free DNS
HE.net DNS

FreeDNS

FreeDNS by afraid.org
FreeDNS FAQ

Namecheap

Namecheap FreeDNS
Namecheap API intro

ClouDNS

ClouDNS pricing
ClouDNS Web Redirect
ClouDNS subdomain delegation

deSEC

deSEC homepage
deSEC documentation
deSEC RRsets

Dynu

Dynu homepage
Dynu FAQ
Dynu URL forwarding

Vercel

Vercel domains documentation
Vercel DNS records
Vercel redirects
Vercel domain API limits

Netlify

Netlify custom domains
Netlify DNS records
Netlify redirects
Netlify DNSSEC

Porkbun

Porkbun
Porkbun DNSSEC KB

Google Cloud DNS (excluded from comparison)

Google Cloud DNS pricing