Latest / The Cloud Business Podcast with Fexingo: AWS, Azure, GCP, and Enterprise Infrastructure / Cloud Contracts Now Charge for Internal DNS Query Volume
Transcript
- Lucas: So here's a number that made me stop: one point two billion. That's the number of internal DNS queries a single Kubernetes cluster at a mid-size fintech was generating per day earlier this year. Luna: Per day? That sounds like a service-mesh story. Lucas: Exactly. Istio, to be specific. Every sidecar proxy does a DNS lookup for every upstream service on every request. And for a long time, all those lookups were effectively free — bundled into the control-plane cost at AWS, Azure, and GCP. But that's changing. Luna: Right, we've covered a lot of new granular cloud charges on this show — container image pulls, load balancer throughput, pod evictions. But DNS has been the quiet one. Lucas: Quiet until now. In March 2026, AWS updated its Route 53 pricing page to include a per-query charge for private hosted zones. The first one billion queries per month per account are $0.40 per million queries. After that, it tiers up. For that fintech, their monthly Route 53 bill went from about $200 to nearly $4,000. Luna: Twenty times increase. And that's just one cluster. What about Azure and GCP? Lucas: Azure DNS Private Resolver has always had a per-query component — $0.20 per million queries — but they recently lowered the free tier from one million queries per month to just one hundred thousand. Google Cloud DNS peering zones also now have a per-query cost: $0.10 per million inbound queries, and they started charging for outbound forwarding too. Luna: So the free lunch is officially over. But why now? DNS is essential infrastructure. Lucas: That's exactly why. DNS is the glue that makes everything talk. As microservices and service meshes scale, DNS query volume grows faster than compute or storage. Hyperscalers realised they were leaving money on the table — a table that's now groaning under the weight of trillions of queries. Luna: And the customers I talk to — especially in regulated industries — they're running private DNS zones for every environment, plus forwarding rules for hybrid cloud. It adds up. Lucas: One healthcare company I spoke to had thirty separate private hosted zones, each with overlapping query patterns. Their total DNS charges went from negligible to $12,000 a month after the changes. Luna: Ouch. And this isn't just about cost — it's about architecture. If you have a service mesh, every pod to pod communication triggers multiple DNS lookups. Lucas: Right. In Istio, by default, the sidecar proxy resolves DNS for the application. But with strict mTLS and headless services, you can get a cascade of lookups per request. I've seen clusters where DNS traffic accounts for fifteen percent of total network packets. Luna: And those packets are now costing real money. Lucas: What's interesting is that the big three didn't coordinate — but they all moved within six months of each other. AWS went first in March 2026, Azure followed in May, and GCP announced its changes in June. Luna: So what's the play for an enterprise? Just move to external DNS providers? Lucas: Not so fast. External DNS providers like Cloudflare or Akamai charge per query too, and you add latency. Plus, if you're using private zones, you can't easily move those to a third party. Luna: So you're stuck with the hyperscaler pricing. Lucas: Not entirely stuck. There are optimisation levers. First, audit your query logs. Most companies don't know which services are generating the most DNS traffic. Often it's a misconfigured application doing repeated lookups for the same record. Luna: Caching is the obvious one. Tune your DNS TTLs. Lucas: Yes. The default TTL in Route 53 is 300 seconds. If you can safely bump that to 600 or 900 seconds, you halve or third your query volume. But that only works for stable services — not for endpoints that change frequently, like spot instances or autoscaled pods. Luna: And there's the service mesh angle. Some teams are moving to dns based service discovery instead of the control plane's native discovery — which actually increases DNS load. Lucas: Exactly the opposite of what you want. The better approach is to use a dedicated DNS caching proxy like CoreDNS with aggressive caching, or even run a local node-level DNS cache. Luna: That's what the fintech I mentioned eventually did — they deployed CoreDNS with a 600-second cache and cut their Route 53 bill by sixty percent. Lucas: And that's just the technical fix. There's also a contractual angle. Some large enterprises are negotiating DNS caps into their cloud contracts — a flat fee for up to X billion queries per month. The hyperscalers are willing to do that if you commit to a three-year term. Luna: Which, of course, locks you in. But if you know your growth trajectory, it might be worth it. Lucas: The bigger question is: what's next? If DNS queries are now a billable line item, what about other control-plane operations that have always been free? Luna: Like what? Lucas: Think about Kubernetes API server requests. Every time a pod starts, it hits the API server. That's currently bundled into the control plane cost. But I wouldn't be surprised if we see per-request charges for the API server within the next twelve months. Luna: That would be a huge shift. It would change how we design operators and controllers. Lucas: Right. And it makes the case for auditing your usage now, before the pricing changes. Know your query counts, know your API call rates, know your cache hit ratios. Because once those become line items, the negotiation is already over. Luna: Speaking of negotiations, if you're listening and these conversations help you make sense of what's coming — we hear from a lot of people who say the show helps them stay ahead of these changes. If that's you, and you want to keep it ad-free, you can support us at buy me a coffee dot com slash fexingo. It genuinely makes a difference. Lucas: And it's what allows us to stay independent and dig into these niche angles that most business shows skip. We appreciate it. Luna: Alright, so back to DNS: one last point I want to make is that this isn't just a hyperscaler story. I've seen managed Kubernetes providers like DigitalOcean and Linode start to add DNS query charges too. Lucas: It's becoming an industry-wide shift. The era of free networking glue is ending. And for cloud architects, that means paying attention to the quietest line item on the bill — because it won't stay quiet for long. Luna: So the takeaway: audit your DNS logs this week, tune your TTLs, and if you're on a service mesh, consider whether every lookup is necessary. Lucas: And if you're negotiating a cloud contract in the next quarter, bring up DNS query volume before they bring it up first.