PowerDNS underneath
Standard zone transfers, dynamic updates and the PowerDNS API work as documented. Bring the automation you already trust.
Authoritative DNS for operators
DNS hosting that fits your existing workflow
PTRDNS is managed authoritative DNS built on PowerDNS. Run primary or secondary zones, enable DNSSEC, use ALIAS records and update zones dynamically. The service runs across a redundant network in Europe and North America and supports the PowerDNS API.
No commitment required. Monthly plans start at €5.
Why PTRDNS
Use the DNS workflow you already have
PTRDNS runs PowerDNS, not a proprietary DNS engine. Your existing tools, APIs and protocols keep working, and your zones remain portable if you ever move providers.
Designed for resilience
Nameservers run on independent networks in different regions, TLDs (.net, .org, .eu) and registrars. A problem in one place does not take down the whole service.
Easy to automate
Use Terraform, OctoDNS, acme.sh or nsupdate (RFC 2136). There is also a
web editor if you'd rather manage zones by hand.
Who it's for
For operators who want straightforward DNS
If you care about open standards, interoperability and automation, PTRDNS gives you authoritative DNS without locking your zones into a provider-specific setup.
- Infrastructure and platform engineers who keep DNS in source control and need a predictable API.
- Hosting providers and agencies managing many zones with secondary DNS and zone transfers.
- Operators adding redundancy who want a second DNS provider without adopting another toolchain.
- Security-conscious owners who want DNSSEC, passkeys and multi-factor authentication included.
How does it work?
- Use PTRDNS as your primary. Manage your zone data at PTRDNS and let PTRDNS POPs serve the records.
- Use PTRDNS with another provider. Manage your zone data at PTRDNS, transfer it by AXFR to any provider that supports AXFR, and serve the zone from both providers' nameservers.
- Use PTRDNS as a secondary. Manage your zone at another provider or on your own hidden primary, then transfer it to PTRDNS by AXFR.
Features
The records and tools authoritative DNS needs
All common record types supported (A, AAAA, TXT, MX and CNAME), along with ALIAS, HTTPS and TLSA. Wildcards are supported, and TTLs can be as low as 30 seconds.
DNSSEC
Sign your zones so resolvers can verify that responses are authentic. Turn on DNSSEC with one click.
Secondary DNS
Serve zones that originate elsewhere. If your other provider has a problem, PTRDNS can keep answering for the zone.
Dynamic DNS (RFC 2136)
Update records with standard DNS update tools such as nsupdate. Secure updates
with TSIG keys.
PowerDNS API
Automate changes across your zones through the PowerDNS API. Existing acme.sh, Terraform and OctoDNS integrations need no provider-specific rewrite.
Zone transfers (AXFR)
Send and receive zones with any provider that supports standard AXFR transfers. Use TSIG keys when transfers need authentication.
Apex aliases (ALIAS)
Point an apex domain such as example.com to an external hostname.
Use cases
A few ways to use PTRDNS
Hidden primary
Keep the master server private. PTRDNS serves the public nameservers and receives the zone over authenticated AXFR.
ACME certificates
Handle DNS-01 challenges from Certbot, acme.sh or lego. Add the required TXT record
through the API or with nsupdate, then let the ACME client finish.
Terraform
Keep zone definitions in source control and apply record changes through the PowerDNS provider and API.
OctoDNS
Keep one source of truth for your records and synchronize them to PTRDNS and other providers.
PowerDNS API
Connect existing PowerDNS tooling and scripts. The supported endpoints cover zones, cryptokeys, TSIG keys, notify, export and AXFR retrieval.
Multi-provider DNS
Run PTRDNS alongside another DNS provider and synchronize the zones with standard zone transfers. Either provider can continue serving if the other has an outage.
At a glance
The details behind the service
Network
- POPs in Europe and North America: London (UK), Lelystad (NL), Los Angeles (US), New Jersey (US)
- 4 independent autonomous systems (AS62240, AS62874, AS174, AS46475)
- IPv4 and IPv6 reachable on every nameserver
- DNSSEC supported for native, primary and secondary zones
Reliability
- Monthly availability target of at least 99.5%
- Availability and performance monitoring, with a public status page
- Nameservers registered at 3 independent registrars
- Delegated across 3 different top-level domains (.net, .org, .eu)
Operations
- PowerDNS, the open-source authoritative server
- Native, primary and secondary zones
- PowerDNS API compatibility for existing tools and code
Security
- Passkeys supported for account sign-in
- TOTP-based multi-factor authentication available on all accounts
- DNSSEC to authenticate responses and prevent spoofing
- TSIG keys to secure zone transfers and dynamic updates
Pricing
Simple plans with clear limits
Try any plan for 14 days. Pay monthly with no commitment, or save by paying yearly.
Lithium
€5 /month
For a few personal domains or a small DNS setup.
- Primary and secondary DNS
- 5 DNS zones
- 5M monthly queries
- Unlimited records
- TTL as low as 120s
- DNSSEC and ALIAS records
- Full PowerDNS API access
Carbon
€20 /month
For several zones and more traffic.
- Everything in Lithium
- 30 DNS zones
- 50M monthly queries
- TTL as low as 30s
Oxygen
€50 /month
For busy domains with hundreds of millions of queries.
- Everything in Carbon
- 50 DNS zones
- 300M monthly queries
- TTL as low as 30s
- Detailed query statistics
FAQ
Frequently asked questions
How do I point a zone at PTRDNS?
Sign in to your registrar's control panel and set the nameservers to the ones listed on your zone's page. You can delegate to PTRDNS only, or to PTRDNS together with another provider when a zone transfer (AXFR) is configured between them.
Is DNSSEC supported?
Yes. It works with native, primary and secondary zones, and you can enable it with one click.
Are ALIAS records supported?
Yes. ALIAS records point an apex domain at an external hostname. They are similar to CNAME records, but can be used at the zone apex.
How do I transfer an existing primary zone to PTRDNS (AXFR)?
Add a TSIG key to both your primary nameserver and PTRDNS, then configure PTRDNS to
accept transfers with that key. Configure your primary to send NOTIFY to
intake.ns.ptrdns.net and to accept AXFR authenticated with the TSIG key.
How does dynamic DNS work?
Create a TSIG key and attach it to the zone you want to update. Configure an RFC
2136-compatible client, such as nsupdate, with that key and send record
updates to intake.ns.ptrdns.net.
Does PTRDNS implement the PowerDNS API?
Yes. PTRDNS implements the zone, cryptokey and TSIG key endpoints, as well as export, notify and AXFR retrieval. Existing PowerDNS tooling should work with none or minimal changes.
Are the nameservers protected against DDoS attacks?
Yes. All nameservers are DDoS-protected. Accounts also include query quotas sized to handle peak usage.
Are there discounts for yearly commitments?
Yes. Yearly plans cost less than paying month to month. Select “Yearly” above to compare the rates.
Put your DNS on a solid footing
Start a 14-day trial. Use open standards, keep your existing tools and add redundancy as your setup grows.