Dora NodaEvery tenant custom domain on a git-push PaaS walks the same four-step pipeline: the tenant claims the domain, the platform verifies they own it, TLS automation issues a certificate, and traffic starts routing. Three of those steps already run on infrastructure you own — your ingress, your cert-manager, your build pipeline. The fourth still makes an API call to someone else's company on every single signup.
That someone is usually Route53 or Cloudflare. And the question is whether the authoritative DNS layer behind your tenant domains should be the last thing you outsource — or the next thing you bring home with PowerDNS.
The verdict up front: at 1,000 tenant domains, Route53 bills roughly $620/month in zones plus queries, growing linearly with every signup. A two-server PowerDNS setup answers the same queries for roughly $10–55/month in infrastructure — but adds a permanent ops bill: redundant nameservers in diverse networks, monitoring that pages someone, and DNSSEC key ceremonies that cannot be skipped. Own your DNS when per-tenant query and zone growth is unbounded or sovereignty matters and you can staff that bill. Delegate it while your team is small enough that a 3 a.m. DNS page has exactly one person to land on. The rest of this post shows the math behind that rule.
What Route53 actually bills you
Route53 pricing has three lines that matter to a PaaS: hosted zones at $0.50 per zone per month (first 25; volume tiers beyond that), standard queries at $0.40 per million for the first billion per month and $0.20 per million after, and health checks at $0.50 per check per month. There is also pay-as-you-go pricing for zones holding more than 10,000 records, but a tenant-domain fleet rarely hits that — the bill that scales is zones times tenants plus queries times traffic.
Assume one hosted zone per tenant custom domain and a modest 300,000 queries per domain per month (about 10,000 resolutions a day — low-TTL records and curious crawlers add up). No health checks; those are optional and would add $0.50 per tenant per month each.
| Tenant domains | Zones (× $0.50) | Queries (× $0.40/M) | Illustrative total |
|---|---|---|---|
| 100 | $50 | 30M → $12 | ~$62/mo |
| 1,000 | $500 | 300M → $120 | ~$620/mo |
| 10,000 | $5,000 | 3B → ~$800 (tiered) | ~$5,800/mo |
Two things to notice. First, the zone line dominates, not the query line — DNS is cheap per lookup and expensive per tenant. Every custom-domain signup is a new $0.50/month subscription you pay to AWS forever. Second, the bill is perfectly linear in tenants: there is no volume discount that bends the curve before very large scale, so your margin per tenant shrinks by a fixed amount the day they bring a domain.
The 300,000-queries assumption deserves a sentence of defense, because low estimates are how this table gets gamed. Authoritative query volume for a tenant domain is driven less by human visitors — resolvers cache — than by short TTLs, certificate-authority validation lookups, uptime monitors, and crawlers that never cache anything. A platform default TTL of 300 seconds multiplies every one of those sources. If your tenants point apex ALIAS records at your ingress or you verify domains with DNS-01 challenges on short-lived TXT records, 10,000 resolutions a day per domain is conservative, not generous. Raise it to a million and the query line triples — but the zone line still dominates, which is exactly the point: you cannot TTL-tune your way out of a per-tenant subscription.
Optional extras only steepen it. Add a Route53 health check per tenant apex for failover and each tenant costs another $0.50/month before a single query is answered. None of this is hidden — it is all on the pricing page. It is just never presented as "the cost of one signup," which is the unit a PaaS actually budgets in.
What Cloudflare-free costs instead
Cloudflare's answer to that table is simple: authoritative DNS hosting is free and queries are unmetered on every plan. Your $620/month line goes to zero overnight, which is why half the PaaS world delegates here instead.
The price is non-cash, and you should name it before you accept it. Your domain-verification-to-live-traffic pipeline now depends on a third party's dashboard, API rate limits, and incident response on every tenant signup — the exact critical-path coupling you removed everywhere else. Apex domains need CNAME flattening rather than real records, which behaves subtly differently from standards-compliant DNS when you debug resolution failures at 2 a.m. And the migration path off is a zone transfer negotiated under time pressure, because the day you want to leave is the day something already hurts.
There is a middle path worth naming: Hetzner's own DNS product offers free authoritative hosting with an API (there is even a community cert-manager webhook for DNS-01 challenges against it). It removes the per-query meter without removing the external dependency. For a Hetzner-based fleet it is the cheapest delegation option — but it is still delegation.
The three PowerDNS features that move the money
PowerDNS Authoritative Server (4.9.x current, 5.0 adding BIND-style views and simpler DNSSEC bootstrapping) is a big product, but only three features matter to the cost calculus:
| Feature | What it kills on the bill |
|---|---|
| Full REST API with OpenAPI docs over SQL/LMDB backends | The marginal cost of a record operation drops to zero — no per-zone, per-query, or per-API-call meter on tenant signup |
ALIAS records at the apex (with expand-alias plus a resolver) | Tenant apex domains point at your ingress without workaround records or support tickets explaining why bare domains can't CNAME |
| Online DNSSEC signing with automatic ZSK rollover | No separate signer infrastructure; key material lives in the same database as the zones |
Everything else — Lua records, GeoIP backends, views — is capability, not savings. One backend choice does touch cost: LMDB or SQLite backends need no database server at all, while the generic SQL backends assume a Postgres or MySQL you are already running for the platform. If you already operate Postgres for everything else, PowerDNS zones become rows in infrastructure you pay for anyway — the cheapest possible backing store. If you do not, LMDB keeps the nameserver self-contained instead of adding a stateful dependency to your critical path.
And note what this list implies: PowerDNS removes the vendor bill, not the work. The work moves to your team, which is the next section.
(One pointer, not a repeat: if you run Kubernetes, the mechanics of reconciling zones as custom resources are covered in our PowerDNS Operator post. This post is the build-vs-delegate decision that comes before those mechanics.)
The ops bill, quantified
Here is the part Route53's pricing page never shows you. Running authoritative DNS means meeting the obligations every registrar and resolver on the internet assumes you meet:
| Obligation | What it takes | Illustrative cost |
|---|---|---|
| Two nameservers on diverse networks (registrars require at least two) | Two small VPS in different regions or providers, or one plus a secondary-DNS service | ~$10–25/mo infra, up to ~$30/mo with a commercial secondary |
| Uptime someone actually watches | DNS monitoring with paging — DNS downtime is not degraded mode, it is everything down: apps, mail, verification, renewals | A few hours/month of alert tuning and response readiness |
| Patching | Authoritative-server CVEs are recurring (PowerDNS published a multi-issue security advisory as recently as June 2026) | Upgrade windows across both nameservers, a few times a year |
| DNSSEC KSK rotation | ZSK rollover is automatic, but KSK rotation still means generating the key, publishing the DS record at the parent, and waiting out TTLs — a ceremony, not a cron job | 1–2 scheduled ceremonies per year, each with a rollback plan |
| Resolution latency | A single-region pair cannot match anycast; published comparisons put single-region self-hosted resolution around 80–200ms versus 10–30ms on a global anycast edge | Slower first-visit resolution for distant tenants until you add locations |
Monitoring deserves one concrete detail, because "watch DNS" is too vague to staff. At minimum you want external checks that each nameserver answers authoritatively for a canary zone, that SOA serials match across primaries and secondaries after every update, and that DNSSEC signatures validate with comfortable margin before expiry. All three are cheap to build and each catches a distinct historical outage class: the silent dead server, the failed zone transfer nobody noticed, and the expired signature that turns your own security feature into a self-inflicted blackout.
Add it up and the steady state is roughly $10–55/month in infrastructure plus a few engineering hours a month and one or two key ceremonies a year — against Route53's ~$620/month at a thousand tenants and ~$5,800 at ten thousand. The crossover is not subtle at scale. But the honest counter-argument deserves its full weight: that small monthly number assumes the paging, patching, and ceremonies actually happen. A PaaS team that neglects its nameservers the way teams neglect internal tooling will discover the failure mode all at once, across every tenant simultaneously, with no vendor status page to point at. DNS is the one layer where "we'll get to it" becomes everybody's outage.
The decision rule
If your tenant count is in the dozens and your team fits in one chat channel, delegate — to Cloudflare for zero marginal cost or Hetzner DNS for API-driven free hosting on your existing provider. Your scarcest resource is engineering attention, and DNS ops will spend it at the worst possible moments.
Once tenant domains number in the hundreds and grow with revenue, the math flips: every signup mints a permanent $0.50/month vendor subscription, and PowerDNS on two small machines plus a secondary converts a linear cost into fixed infrastructure plus a bounded, schedulable ops routine. That is the point where owning the last layer stops being ideology and starts being margin — provided you write down the key-ceremony runbook before you need it, not after.
Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.
