Private and open-source alternatives to Amazon Route 53
8 DNS hosting rated against the same public privacy criteria as Amazon Route 53, with our picks first.
Why look for an alternative?
- Open source: no. Closed source.
- No trackers or telemetry: no. AWS websites set cookies from third parties including The Trade Desk, Oracle BlueKai and LinkedIn.
- No ads or data sales: no. The privacy notice says cookies and identifiers are used to advertise to visitors on third-party websites.
- Independent audit: partial. Only the SOC 3 summary report is public; SOC 1 and SOC 2 reports are available to customers in AWS Artifact.
- DNSSEC: partial. DNSSEC signing is supported but needs a customer-managed AWS KMS key for the key-signing key.
See the full Amazon Route 53 rating.
The alternatives
Cloudflare DNS Grade C Our pick
Authoritative DNS hosting on Cloudflare's anycast network with a free plan, DNSSEC, an API and security-key login.
Why it is our pick: Free on every plan, one of the fastest DNS networks, a complete API, and hardware security key login. DNSSEC is automatic when the domain is also registered with Cloudflare Registrar.
Based in the United States (Five Eyes). Cloudflare DNS scores 66 out of 100 (grade C) on the DNS hosting criteria. It meets 7 of 11 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, DNSSEC, API access and two-factor login.
deSEC Grade B
Free authoritative DNS hosting from the Berlin non-profit deSEC e.V., with automatic DNSSEC signing, a full REST API and open-source software.
Based in Germany (Fourteen Eyes). deSEC scores 77 out of 100 (grade B) on the DNS hosting criteria. It meets 8 of 11 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, security headers, DNSSEC, API access and two-factor login.
DNSimple Grade D
Paid managed DNS hosting and domain registrar with DNSSEC, secondary DNS, an API, a CLI and a Terraform provider.
Based in the United States (Five Eyes). DNSimple scores 52 out of 100 (grade D) on the DNS hosting criteria. It meets 5 of 11 criteria: tells users about requests, TLS configuration, DNSSEC, API access and two-factor login.
LuaDNS Grade D
Anycast DNS hosting from Romania with DNSSEC, a REST API and git integration that builds zones from BIND or Lua files, with a free plan and paid plans.
Based in Romania. LuaDNS scores 52 out of 100 (grade D) on the DNS hosting criteria. It meets 5 of 11 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, DNSSEC and API access.
Bunny DNS Grade D
Authoritative DNS hosting from the Slovenian CDN provider bunny.net, with DNSSEC, scriptable DNS records, health-check failover and usage-based pricing.
Based in Slovenia. Bunny DNS scores 43 out of 100 (grade D) on the DNS hosting criteria. It meets 4 of 11 criteria: no ads or data sales, DNSSEC, API access and two-factor login.
Hetzner DNS Grade D
Free authoritative DNS hosting from the German provider Hetzner, managed in the Hetzner Console and through the Hetzner Cloud API.
Based in Germany (Fourteen Eyes). Hetzner DNS scores 43 out of 100 (grade D) on the DNS hosting criteria. It meets 4 of 11 criteria: no ads or data sales, TLS configuration, API access and two-factor login.
ClouDNS Grade F
Managed DNS hosting from Bulgaria with a free plan and paid plans adding anycast, DNSSEC, GeoDNS, DDoS protection, secondary DNS and failover.
Based in Bulgaria. ClouDNS scores 36 out of 100 (grade F) on the DNS hosting criteria. It meets 3 of 11 criteria: TLS configuration, DNSSEC and two-factor login.
Hurricane Electric Free DNS Grade F
Free authoritative DNS hosting from the US network operator Hurricane Electric, with forward and reverse zones, secondary DNS and dynamic DNS updates.
Based in the United States (Five Eyes). Hurricane Electric Free DNS scores 25 out of 100 (grade F) on the DNS hosting criteria. It meets 1 of 11 criteria: no ads or data sales.