Bunny DNS, and why we now recommend it

DNS in plain English

When someone types your domain into a browser, their device asks the internet’s address book where to go. DNS is that address book. It answers with the numeric address of your web server, your mail server, and a few proofs of ownership.

Three different companies can be involved with one domain, and this is where most confusion lives.

The records, in one breath

An A record points a name at a server address. A CNAME says “same as that other name”. MX records say where your email goes. TXT records hold proofs: SPF and DKIM for email, verification strings for services. A small site rarely has more than a dozen records, and that is 95% of DNS.

TTL and “propagation”

Every record carries a TTL, the number of seconds the rest of the internet may cache the answer. Change a record and the world sees it once the old cache expires: minutes for normal records.

Changing your DNS host is slower, because the pointer to the nameservers themselves is cached for up to 48 hours. That is fine: during the changeover both the old and new host keep answering with the same records, so nothing goes down if you migrate properly. The Move tab covers it.

What Bunny DNS is

Bunny (bunny.net) is a European content-delivery company based in Slovenia, inside the EU. If you run PageMotor you already use them: the fonts on your site are served by Bunny Fonts, the GDPR-safe mirror of the Google Fonts catalogue that PageMotor uses precisely because Bunny is under EU law.

On 24 June 2026 Bunny made its DNS hosting free: up to 500 domains per account, no query fees, no query limits, and no features held back for a paid tier. Before that it was metered per million queries. The honest footnote: Bunny accounts carry a standard $1/month minimum spend, so “free” means about a euro a month if you use nothing else of theirs.

What you get

There are also three Bunny-only record types: pull-zone records that link a hostname straight to Bunny’s CDN, redirect records that bounce a URL at the DNS layer, and scriptable records whose answers are computed by a small script. Nice to have; none of them are needed for ordinary hosting.

Why we recommend it

We audited this properly before changing our recommendation, including against our own estate of 71 Cloudflare zones. Here is the case for Bunny, in order of weight.

1. Your DNS host sits under EU law

Every DNS query about your domain reveals who is visiting what, when, from roughly where. With Bunny that metadata is handled by an EU company under GDPR. With the big American providers it sits under US jurisdiction.

This is the same reasoning that put Bunny Fonts into PageMotor core. If your customers are in the UK or EU, your privacy story gets simpler when the infrastructure is too.

2. The free tier has no missing teeth

Failover with health checks, geographic and weighted routing, custom branded nameservers, full raw query logs, DNSSEC: all included. On Cloudflare those are, respectively, a paid load-balancing add-on, a Business-plan feature ($200/month), an Enterprise feature, and (to be fair) free. Bunny simply does not paywall DNS features.

3. No record cap

Cloudflare free zones created since September 2024 are capped at 200 DNS records. Sounds like plenty until subdomains multiply; our own busiest zone brushed that ceiling this summer. Bunny has no per-zone record limit.

4. Real failover for a two-server future

The day you run a second server, Bunny’s 30-second health checks give you automatic failover for free: a visitor stops being sent to a dead box within a minute. That is uptime insurance most small sites simply never get, because it normally costs money.

5. Fast, and honest about speed

Anycast networks answer from the nearest node; Bunny claims sub-20 ms in most regions and lets record TTLs go as low as 15 seconds when you need a change seen quickly. In practice both Bunny and Cloudflare are far faster than any registrar’s default nameservers, which is what most small sites are still using.

6. Freedom to leave

BIND export means your whole zone walks out in one file, any time. A recommendation you cannot cheaply reverse is a trap; this one is reversible in twenty minutes.

7. One roof, if you ever want more

Bunny’s CDN and storage are well-regarded and cheap, and DNS integrates with them in one click. You do not need them, but growth has a path that stays under EU law.

When we don’t recommend it

An honest recommendation names its losing cases. Here is every reason to stay where you are, in order of weight.

1. You use Cloudflare’s orange cloud

Cloudflare’s headline feature is not DNS, it is the proxy: traffic flows through Cloudflare, which hides your server’s address, absorbs attacks, caches pages, and can apply a firewall. Bunny DNS is DNS only; it points visitors straight at your server.

If your Cloudflare dashboard shows orange cloud icons on your records, you are using the proxy, and moving to Bunny DNS alone would expose your origin server and drop that shield. Either stay, or price up Bunny’s CDN as the replacement shield before moving.

2. You use Workers, Access, or Rules

Cloudflare Workers (code running on their edge), Access (login gates), and redirect/transform Rules all stop working the moment DNS leaves Cloudflare. We know because our own gated tools run on Workers: those zones of ours are staying on Cloudflare, and we say so openly. Plain DNS zones are a different matter.

3. Your domain is registered at Cloudflare Registrar

Cloudflare Registrar requires Cloudflare nameservers. Moving DNS means moving the registration first. Not worth it for most people.

4. Ecosystem maturity

Cloudflare is the default everywhere: every tutorial, every tool, every certificate-automation plugin knows it. Bunny’s API is clean and DNSControl supports it, but some tooling (for example wildcard TLS certificates via DNS validation with certbot) relies on community plugins rather than first-party ones. If your workflow leans on Cloudflare-specific automation, weigh the porting cost.

5. DNSSEC needs your registrar to play along

Turning DNSSEC on is two halves. Your DNS host signs the zone, which Bunny does with one toggle. Then your registrar must publish one small record, called the DS, in the registry above your domain. Only a registrar can do that half. No DNS host can do it for them, whether that is Bunny, Cloudflare or anyone else.

Some registrars make it a two-minute form. Others make it a support ticket, and a few are simply not up to it.

IONOS is the cautionary tale, and we have first-hand evidence. For domains on external nameservers, their own help page tells you to email the request in. We did exactly that in August 2026, in their documented format, and first-line support declined, replying that the record must be added at the external host instead. That is not possible: a DS record lives in the registry above your domain, not in your zone, so no external host can publish it. Public forum reports show others escalating the same request for weeks without ever getting it published.

The practical advice: if DNSSEC matters to you, ask your registrar whether they can publish a DS record before you count on it. And if you do get stuck there, nothing is broken. A signed zone with no DS in the registry behaves exactly like an unsigned one, so your site and your email carry on as normal.

6. Small print

The $1/month account minimum means Bunny is not literally free. And one standards footnote: Bunny’s wildcard-record handling deviates slightly from the DNS RFCs in an edge case (empty non-terminals get the wildcard answer). It affects almost nobody, but we would rather tell you than not.

7. Cloudflare Free is also genuinely good

Unlimited queries, solid speed, free DNSSEC. If you are already on Cloudflare, use none of the proxy features, and do not care about the jurisdiction point, there is no urgency to move. Our recommendation bites hardest for new domains and for anyone whose customers make the EU question matter.

Which should you use?

Find your row. The first one that matches you is your answer.

Move your DNS to Bunny, safely

Twenty minutes of work, zero downtime if you follow the order. Or download the LLM prompt at the top and let Claude walk you through it interactively.

1. Check the table first. If the “Which should you use?” tab told you to stay, stay. In particular look for orange-cloud (proxied) records in Cloudflare: if you have any, stop here.
2. Export your current zone. Every serious DNS host exports a BIND zone file: in Cloudflare it is under DNS › Records › Export. This file is your inventory and your rollback.
3. If DNSSEC is currently on, turn it off first at both your current DNS host and your registrar (remove the DS record), then wait 24 hours. Skipping this can take your domain offline during the move. If you never enabled DNSSEC, skip this step.
4. Create the zone at Bunny and import the file. Add your domain in the Bunny panel, import the BIND export, and eyeball the result. Give special attention to MX and TXT records: they are your email.
5. Switch nameservers at your registrar. Replace the current nameservers with the two Bunny gives you. This is the actual move, and it is one form at your registrar.
6. Wait, without deleting anything. The change reaches the whole internet within 48 hours. Both old and new hosts keep answering identically during that window, which is why nothing goes down. Leave the old zone in place for a week as a safety net.
7. Verify. Load the site. Send an email to yourself and reply to it. If you use Mailgun or similar, check its dashboard still shows your domain verified (SPF and DKIM are TXT records; they moved with the import).
8. Optional, and worth checking first: DNSSEC. Signing is one toggle at Bunny. The other half is your registrar publishing the DS record Bunny then shows you, which only they can do. Ask them whether they support DS records before you rely on it, and read the IONOS cautionary tale in “When we don’t recommend it” above. If your registrar will not do it, simply leave it: a signed zone with no DS behaves exactly like an unsigned one, so nothing breaks either way.

FAQ

Will moving DNS move or break my website?

No. DNS is the pointer, not the site. Your web host, your PageMotor install, your content are untouched. The records you import point at exactly the same servers as before.

Will my email break?

Only if the MX and TXT records are copied wrongly, which is why the move uses a file export rather than retyping, and why step 7 is a real send-and-reply test. Done that way, email never notices the move.

Is there downtime during the switch?

No. During nameserver propagation both hosts answer with identical records. Downtime comes from deleting the old zone too early, which is why we say leave it a week.

Is it really free?

DNS itself: yes, up to 500 domains, no query fees. Bunny accounts carry a $1/month minimum spend, so budget roughly a euro a month if you use nothing else of theirs.

Can I change my mind later?

Yes. Export the zone from Bunny as a BIND file, import it at the next host, switch nameservers back. Twenty minutes, same procedure in reverse.

Do I need DNSSEC?

No. It is a good thing to have rather than a requirement, and most small sites run perfectly well without it. It guards visitors against a rare attack where someone forges DNS answers for your domain. Turn it on if your registrar makes it easy, and skip it without guilt if they do not: the rest of your DNS works identically either way.

Is this the same Bunny as Bunny Fonts?

Yes, the same Slovenian company. PageMotor already serves your fonts through them for the GDPR reasons this guide leans on.

Do my EP plugins or PageMotor care who hosts DNS?

Not at all. Plugins talk to your server and your email service; neither knows nor cares who answers DNS queries. Mailgun’s SPF and DKIM records are ordinary TXT records and move with the zone.

Can Claude Code do the move for me?

Yes. Bunny has a clean API, and the prompt download at the top of this page gives any capable AI assistant the full procedure, gates included. Have it show you the imported records before you switch nameservers.