Premium DNS
DNSSEC-signed DNS,
built to stay up.
DNSSEC-signed authoritative DNS on four globally distributed nameservers (Falkenstein, Helsinki, Ashburn, Singapore), with health-checked failover and 60-second TTLs. Free Kapsule DNS is included on every Kapsule domain. Premium DNS adds the resilient, signed nameservers.
Premium DNS
acme-coffee.com, DNSSEC active
Queries today
842K
Nameservers
4
Avg TTL
60s
Failover
Enabled
DNSSEC signed, answered by four nameservers
What Premium DNS includes
DNS built to stay resolvable.
4
Global nameservers
Falkenstein, Helsinki, Ashburn, and Singapore, across three continents
60s
Minimum TTL
Fast failover and rapid DNS propagation
1M
Queries/month
Included per zone on Premium DNS, enough for most sites
Global nameservers
DNSSEC-signed DNS on four globally distributed nameservers
Premium DNS answers from four nameservers in Falkenstein, Helsinki, Ashburn, and Singapore, across three continents. Every zone is replicated to all four by AXFR, so a query keeps resolving even if a nameserver goes offline.
- Four nameservers across three continents
- Falkenstein, Helsinki, Ashburn, and Singapore
- Full AXFR replication to every nameserver
- No single point of failure
Nameserver cluster
AXFRns1
Germany
ns2
Finland
ns3
United States
ns4
Singapore
Every zone is replicated to all four nameservers by AXFR. If one is unreachable, resolvers use another.
Health-checked failover: acme-coffee.com
A record, health-checked failover enabled
Primary origin
116.203.10.4
Backup origin
49.12.11.28
Standby origin
23.92.19.80
Health-checked failover
Automatic failover when an origin goes down
Configure health checks on your records and Premium DNS watches each origin. When a check fails, the unhealthy IP is removed from responses and the backup is served automatically. When the origin recovers, the primary is restored.
- Native health-checked DNS failover
- Automatic removal of unhealthy origins
- Configurable check interval per record
- 60-second TTL for fast failover
DNSSEC and infrastructure
Every zone signed with DNSSEC
Premium DNS signs your zone with DNSSEC (ECDSA P-256), so resolvers can cryptographically verify that answers have not been tampered with. The nameservers run on DDoS-protected infrastructure.
- DNSSEC signing (ECDSA P-256)
- DS records ready for your registrar
- Runs on DDoS-protected infrastructure
- Tamper-evident DNS responses
DNSSEC signing active
Zone signed with ECDSA P-256
Every answer is cryptographically signed, so resolvers can verify it has not been tampered with in transit.
All Kapsule domain registrations include free Kapsule DNS. Premium DNS adds DNSSEC signing, health-checked failover, and four globally distributed nameservers, per zone, per month.
Free DNS
Included with all domains
- Kapsule DNS (free)
- Full DNS editor in KPanel
- A, AAAA, CNAME, MX, TXT, SRV, CAA
- Changes propagate in < 5 min
- Included on every Kapsule domain
Premium DNS
Per zone, per month
- Everything in Free DNS
- Four global nameservers (Falkenstein, Helsinki, Ashburn, Singapore)
- DNSSEC signing (ECDSA P-256)
- Health-checked DNS failover
- AXFR replication across all nameservers
- 1M queries/month included
- 60-second TTL minimum
FAQ
Frequently asked questions
Free DNS on every domain. Premium when you need it.
Kapsule DNS is free with every Kapsule domain. Premium DNS adds DNSSEC signing, four globally distributed nameservers, and health-checked failover for US$11/month per zone.