Hetzner DNS
- Free allowance
- DNS zones and records are managed in Hetzner Console and the API for free; up to 25 zones by default, up to 500 records per zone and 50 records per RRset; a domain you own is required
- Verdict
- caveatusable, with a named limit or an unprobed read path
- Cost
- free tier
- Identity
- emailcard unknown, phone required
- Binding limit
- per-object-capup to 500 records per zone, 50 records per RRset, 25 zones by default
- Evidence
- documented26 sources; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-12-04checked 2026-11-03 (live); stale on 2026-12-04
| Free tier | DNS zones and records are managed in Hetzner Console and the API for free; up to 25 zones by default, up to 500 records per zone and 50 records per RRset; a domain you own is required unit objects; metered on object-count |
|---|---|
| Price | none stated |
| Limits | |
| Binding | per-object-cap the owned-domain requirement and the 25-zone default decide; the record cap is not binding for a personal set of names |
| Identity | email an account needs a valid e-mail address, personal or business contact information and a billing address, with a phone number optional; Hetzner may ask an account to verify before it processes an order, by a government ID copy or by a credit-card prepayment; unverified: whether creating a DNS zone triggers that verification (https://docs.hetzner.com/general/billing-and-account-management/account-getting-started/, https://docs.hetzner.com/general/security-and-identify/fraud-prevention-faq/) |
| Egress | no DNS query cap published on the pages read |
| Per-object cap | up to 500 records per zone and 50 records per RRset, the 500 raisable on a justified demand; up to 25 zones by default |
| Retention | a zone that is not delegated to the Hetzner name servers for more than 28 days is deleted automatically; nothing else is stated about inactivity (28 days) |
| Interface | rest, cli the Hetzner Cloud API at https://api.hetzner.cloud/v1/ with an Authorization Bearer project token: POST /zones creates a zone, and POST /zones/{id_or_name}/rrsets/{rr_name}/{rr_type}/actions/set_records replaces the records of a record set; there is no dyndns2 or HTTP-GET update URL, so a dynamic update is an API call with a token; the default rate limit is 3600 requests per hour per project; zone names must be a registrable domain under a public suffix, not a subdomain |
| Tooling | curl, the hcloud CLI (hcloud zone create), BIND zone-file import, and AXFR secondary zones against an external primary |
| Composes with | a zone can also run as a secondary that copies a primary elsewhere by AXFR, and a zone can be shared across projects for managed certificates and load balancers; it cannot hold a name that is not a domain you own |
| Reliability | an undelegated zone is deleted after 28 days, and a new account can be asked for an ID copy or a card prepayment before it can order |
| Notes | Confirmation interval: none for a delegated zone; the only inactivity rule found is the 28-day deletion of a zone that is not delegated to Hetzner name servers. It is authoritative DNS for a domain the user already owns, not a free subdomain or a dynamic DNS hostname service. |
| Evidence note | documented the DNS Console page, the DNS overview and limits page, the creating-a-zone page, the DNS FAQ, the Cloud API reference and the account pages were read and quoted; the API was probed once without a token and answered 401. The 25-zone default is on the marketing page and the 500-record limit on the docs page |
| Parsed numbers |
|
Evidence 26
| date | source | what it proved |
|---|---|---|
| 2026-11-03 | www.hetzner.com/dns-console | zones and records can be listed, added, modified and removed for free in Hetzner Console and the API |
| 2026-11-03 | www.hetzner.com/dns-console | the default zone limit is 25 |
| 2026-11-03 | www.hetzner.com/dns-console | every Console feature is also available through a REST API |
| 2026-11-03 | www.hetzner.com/dns-console | an hcloud CLI command creates a zone |
| 2026-11-03 | docs.hetzner.com/dns-console/dns/general/dns-overview/ | DNS zones carry no charge |
| 2026-11-03 | docs.hetzner.com/dns-console/dns/general/dns-overview/ | the limit is up to 500 records per zone, which can be increased on a justified demand |
| 2026-11-03 | docs.hetzner.com/dns-console/dns/general/dns-overview/ | the limit is up to 50 records per RRset |
| 2026-11-03 | docs.hetzner.com/dns-console/dns/general/dns-overview/ | limits marked with an asterisk, the 500 records per zone among them, can be increased on a justified demand |
| 2026-11-03 | docs.hetzner.cloud/reference/cloud | the remaining API requests refill by 1 every second |
| 2026-11-03 | www.hetzner.com/dns-console | the API authenticates with a Bearer token |
| 2026-11-03 | www.hetzner.com/dns-console | a zone is created with a POST to the zones endpoint of api.hetzner.cloud |
| 2026-11-03 | docs.hetzner.com/networking/dns/getting-started/creating-a-z | records can be imported from a BIND-compatible zone file |
| 2026-11-03 | docs.hetzner.com/networking/dns/getting-started/creating-a-z | a secondary zone pulls a full copy from an external primary by AXFR |
| 2026-11-03 | docs.hetzner.com/networking/dns/getting-started/creating-a-z | a zone can be shared with other projects |
| 2026-11-03 | docs.hetzner.com/dns-console/dns/general/dns-overview/ | a domain the user owns is required |
| 2026-11-03 | docs.hetzner.com/dns-console/dns/general/dns-overview/ | the minimum TTL is 60 seconds |
| 2026-11-03 | docs.hetzner.cloud/reference/cloud | the default API rate limit is 3600 requests per hour per project |
| 2026-11-03 | docs.hetzner.cloud/reference/cloud | the zones API does not accept subdomains as zone names |
| 2026-11-03 | docs.hetzner.cloud/reference/cloud | an rrset action set_records replaces the records of a record set |
| 2026-11-03 | docs.hetzner.com/networking/dns/faq/general | the text of Limits, above |
| 2026-11-03 | docs.hetzner.com/networking/dns/getting-started/creating-a-z | an empty zone holds only NS and SOA records after creation |
| 2026-11-03 | docs.hetzner.com/general/billing-and-account-management/acco | registration needs a billing address, and a phone number is optional |
| 2026-11-03 | docs.hetzner.com/general/security-and-identify/fraud-prevent | an account may be asked to verify before an order is processed |
| 2026-11-03 | docs.hetzner.com/general/security-and-identify/fraud-prevent | verification is by a government-issued ID copy or by a credit-card prepayment |
| 2026-11-03 | probe: https://api.hetzner.cloud/v1/zones | the zones endpoint is live and answers HTTP 401 without a token |
| 2026-11-03 | probe: body-hetzner | the 401 body says a token is required |