This topic describes the billing rules and billable items for DNS Firewall.
Billing methods
DNS Firewall includes multiple components and supports both pay-as-you-go and subscription billing methods.
Pay-as-you-go
This billing method applies to Private Zone DNS Firewall and Public Recursive DNS Firewall. Fees are calculated and settled daily based on your actual usage.
Component | Billable item | Pricing | Description |
Private Zone DNS Firewall | Number of custom rules | CNY 0.1/rule/day |
|
Number of protection detections | CNY 0.03/10,000 queries | Fees are charged based on the number of DNS queries generated within the scope of the Custom Rules or Threat Intelligence Rules. | |
Public Recursive DNS Firewall | Number of protection detections | CNY 0.03/10,000 queries | Fees are charged based on the number of DNS queries generated within the scope of the Threat Intelligence Rules. |
Cost estimation example
Feature: Private Zone DNS Firewall
Usage: 20 custom rules. Each custom rule blocks 10,000 domain name queries per day.
Monthly cost estimate:
Protection rule fee: 20 rules × CNY 0.1/rule/day × 30 days/month = CNY 60/month
Protection detection fee: 20 rules × 10,000 queries/day × CNY 0.03/10,000 queries × 30 days/month = CNY 18/month
Total fee: CNY 60/month + CNY 18/month = CNY 78/month
Overdue payments
Alibaba Cloud DNS provides a grace period that allows you to continue using services for a specific time or within a certain credit limit after a payment on your account becomes overdue. Your existing pay-as-you-go services, purchased resource plans, and subscription resources continue to function normally during this period. We suspend services only if you exceed the grace period. For more information, see Service suspension for overdue payments.
Subscription
This billing method applies to Public Zone DNS Firewall. You must purchase the service in advance, and the fee covers the subscription period that you select.
Component | Billable item | Pricing | Description |
Anti-DDoS Protection | DNS Anti-DDoS Basic | CNY 600/domain name/year | Provides basic DNS attack protection for each domain name attached to the edition. The basic DNS attack defense threshold is 10 million queries per second (QPS). |
DNS Anti-DDoS Advanced | CNY 3,000/domain name/year | Provides comprehensive DNS attack protection for each domain name attached to the edition. This can withstand over 100 million DNS QPS. | |
Authoritative DNS Proxy | Authoritative Zone Name | CNY 3,936/domain name/year | The fee to purchase an authoritative proxy domain name. Note Due to a sales policy adjustment, starting from October 30, 2025, subscription plans with DNS Security set to "No Defense" will no longer be available for purchase. |
Expiration
Anti-DDoS Protection: This feature expires when the Public Zone instance expires. To avoid service interruptions, renew the instance. For more information, see Instance expiration and renewal.
Authoritative DNS Proxy: When the service expires, the proxy feature is disabled. To ensure business continuity, renew the service before it expires.