This topic describes the billing rules and billable items for DNS Firewall.
Billing methods
DNS Firewall includes multiple components and supports both pay-as-you-go and subscription billing methods.
Pay-as-you-go
This billing method applies to Private Zone DNS Firewall and Public Recursive DNS Firewall. Fees are calculated and settled daily based on your actual usage.
Component | Billable item | Pricing | Description |
Private Zone DNS Firewall | Number of custom rules | USD 0.015/rule/day |
|
Number of protection detections | USD 0.004/10,000 queries | Fees are charged based on the number of domain name queries that hit Custom Rules or Threat Intelligence Rules. | |
Public Recursive DNS Firewall | Number of protection detections | USD 0.004/10,000 queries | Fees are charged based on the number of domain name query requests generated within the scope of the Threat Intelligence Rules. |
Cost estimation example
Feature: Private Zone DNS Firewall
Usage: 20 custom rules. Each custom rule blocks 10,000 domain name queries per day.
Monthly cost estimate:
Protection rule fee: 20 rules × USD 0.015/rule/day × 30 days/month = USD 9/month
Protection detection fee: 20 rules × 10,000 queries/day × USD 0.004/10,000 queries × 30 days/month = USD 2.4/month
Total fee: USD 9/month + USD 2.4/month = USD 11.4/month
Overdue payments
Alibaba Cloud DNS offers service suspension protection. This feature lets you continue using Alibaba Cloud services for a specific period or within a certain credit limit after a payment becomes overdue. Your existing pay-as-you-go services, purchased resource plans, and subscription resources can be used normally. The service suspension process starts only if your usage exceeds the protection scope. For more information, see Pay-as-you-go service suspension protection.
Subscription
This billing method applies to Public Zone DNS Firewall. You must purchase the service in advance, and the fee covers the subscription period that you select.
Component | Billable item | Pricing | Description |
Anti-DDoS Protection | DNS Anti-DDoS Basic | USD 86/domain name/year | Provides basic DNS attack protection for each domain name attached to the edition. The basic DNS attack defense threshold is 10 million queries per second (QPS). |
DNS Anti-DDoS Advanced | USD 429/domain name/year | Provides comprehensive DNS attack protection for each domain name attached to the edition. This can withstand over 100 million DNS QPS. | |
Authoritative DNS Resolution Agent | Authoritative Zone Name | USD 588/domain name/year | The fee to purchase an authoritative proxy domain name. Note Due to a sales policy adjustment, starting from October 30, 2025, subscription plans with DNS Security set to "No Defense" will no longer be available for purchase. |
Expiration
Anti-DDoS Protection: This feature expires when the Public Authoritative Zone instance expires. To avoid service interruptions, renew the instance. For more information, see Instance expiration and renewal.
Authoritative DNS Resolution Agent: When the service expires, the proxy feature is disabled. To ensure business continuity, renew the service before it expires.