In measurements of four root DNS anycast networks taken in 2015 and 2016 from RIPE Atlas probes, the 8-site network sent 16% of the probes it measured to a site other than their lowest-latency option; the 144-site network sent 76% (Schmidt, Heidemann and Kuipers, PAM 2017). Median latency was about 30 ms across the range. The bigger network missed its best site far more often and was no faster in the median. Site count is the easiest number to compare between DNS providers — and the measurements say it is not the number that sets your latency.
What anycast DNS actually is
Anycast DNS announces one nameserver IP address from many separate locations, so a query sent to that address is answered by whichever location the Internet’s routing system delivers it to. RFC 4786 defines anycast as “the practice of making a particular Service Address available in multiple, discrete, autonomous locations, such that datagrams sent are routed to one of several available locations.”
There is no load balancer and no geography in that decision: “The routing system decides which node is used for each request, based on the topological design of the routing system and the point in the network at which the request originates.” The region whose queries land on one node is its catchment: “the topological region of a network within which packets directed at an Anycast Address are routed to one particular node.”
“Nearest” is a routing claim, not a distance claim
BGP does not measure latency; it selects paths by policy and AS path. RFC 4786 adds that “the population of clients using individual anycast nodes is neither static, nor reliably deterministic.”
The PAM 2017 authors call the gap a mishit: “We define mishits as the cases when VPs are sent to sites other than the lowest latency.” Their explanation is structural: “Anycast relies on BGP to map users to sites, but BGP only approximates shortest-path routing.”
A 2023 census of DNS, CDN and cloud anycast measured the severe version, which its authors call polarization: “when an anycast client is served by a distant site for some specific prefix,” even though a nearer site could serve it faster. Of 7,986 known anycast prefixes, the authors flagged potential polarization in “at least 2273 (28.5%).” Polarization “can add 100 ms or more to the round-trip time if traffic goes to a different continent” (Rizvi, Huang, Esrefoglu and Heidemann, PAM 2024). The causes they name — incomplete connectivity to Tier-1 providers and route leakage by regional networks — are properties of a provider’s transit and peering, not of its site count.
More sites do not buy lower latency
| Root DNS network | Sites | Mishit rate | Median mishit penalty | 75th-percentile penalty |
|---|---|---|---|---|
| C-Root | 8 | 16% | 5 ms | 10 ms |
| K-Root | 33 | 59% | 18 ms | 42 ms |
| F-Root | 58 | 56% | 15 ms | 51 ms |
| L-Root | 144 | 76% | 24 ms | 82 ms |
Source: Schmidt, Heidemann and Kuipers, “Anycast Latency: How Many Sites Are Enough?”, PAM 2017, Table 1. Between 5,351 and 6,464 RIPE Atlas probes per root, measured September 2015 to April 2016. The penalty is the extra latency of a mishit compared with the best available site.
L-Root missed its best site most often and paid most per miss — a median 24 ms, with a quarter of misses costing 82 ms or more — while C-Root paid a median 5 ms. Yet median latency was about the same: “Our data shows similar median performance (about 30 ms) from 8 to 144 sites,” suggesting that “as few as twelve sites” can provide reasonable latency if they are well distributed and well connected. The paper’s abstract states the general finding: “geographic location and good connectivity have a far stronger effect on latency than having many sites.”
Two cautions. The data is ten years old and all four networks have changed since. And these are root servers, not commercial managed DNS. The mechanism transfers; the percentages do not — which is why step 3 below measures your own.
Anycast routes the resolver; steering needs the user
An authoritative nameserver never sees your user, only the recursive resolver: “the source address is that of the Recursive Resolver rather than of the query originator” (RFC 7871). For the lookup itself that is fine. The problem appears when the answer is a routing decision: geo and latency policies — the ones priced at a premium below — choose an answer from the location they can see, which is the resolver’s.
EDNS Client Subnet (ECS) lets a resolver pass a truncated client prefix so the authoritative server can tailor its answer. It changes the answer, not which anycast site receives the query. And it comes with a warning label: RFC 7871 is Informational, not Standards Track, describes the option as “not for general purpose deployment,” and states: “Due to the high cache pressure introduced by ECS, the feature SHOULD be disabled in all default configurations.” Resolver support varies: Cloudflare’s 1.1.1.1 does not send ECS, while Google Public DNS sends it to authoritative servers that implement it correctly.
So geo steering is only as accurate as your users’ resolvers allow. Ask a provider which resolvers it actually receives ECS from — not whether it “supports ECS”.
What anycast DNS costs
Published rates, read 22 October 2026.
| Provider | Zone charge | Standard queries | Steering (geo / latency) | Notes |
|---|---|---|---|---|
| Amazon Route 53 | $0.50/zone (first 25), $0.10 after | $0.40/M to 1B/mo, then $0.20/M | Latency $0.60/M; geo $0.70/M (halved above 1B) | Alias queries to AWS resources free |
| Google Cloud DNS | ≈$0.20/zone/month (first 25; billed hourly) | $0.40/M to 1B/mo, then $0.20/M | Routing policy $0.70/M, then $0.35/M | “No free tier” |
| Cloudflare | None | Free on Free / Pro / Business | Load Balancing add-on “Starting at $5/mo”; no per-query rate published | Enterprise on contract |
| Bunny DNS | Free to 500 zones | Free | “Smart” queries free | $1/month account minimum |
| DNS Made Easy | Not itemised | DNS-5 $225/yr (5M/mo); DNS-25 $675/yr (25M/mo); DNS-50 $2,100/yr (50M/mo) | Global Traffic Director: add-on on DNS-5 and DNS-25, listed as included on DNS-50 | Plans differ in support |
Route 53 and Google Cloud DNS charge the same standard rate — $0.40 per million to one billion queries a month, $0.20 above — and the same $0.70 for geo-style steering. They differ on latency-based routing, which Route 53 prices at $0.60, on zones, and on free queries: Google states “There is no free tier for Cloud DNS,” while Route 53 provides alias queries to AWS resources such as CloudFront and load balancers at no additional cost.
The steering line varies more than the query line. No price list here has a line item for anycast itself. Steering carries a 50–75% premium at the hyperscalers, is a separate add-on at Cloudflare, and is listed free at Bunny.
At 100 million standard queries a month on one zone: about $40.50 at Route 53, $40.20 at Google Cloud DNS, nothing at Cloudflare and $1 at Bunny. At one billion geo-steered queries: about $700 at either hyperscaler, nothing listed at Bunny, and no published per-query figure at Cloudflare. A spread from zero to $700 with no published performance basis has to be settled by measurement.
What breaks in production
Instability that is invisible in aggregate. In 2015–16 root DNS measurements, anycast route flipping occurred “in about 1% of (VP, service) pairs,” and “80% of unstable pairs of VP and anycast services are unstable for more than a week”; for the rest, “routes are stable for hours, days, or longer” (Wei and Heidemann, IEEE TNSM, 2018). Aggregate dashboards show the stable majority.
TCP queries get cut. Responses too large for UDP, such as large DNSSEC-signed answers, are retried over TCP, which needs the whole exchange to reach one node. TCP flipping “does occur in about 0.15% (VP, letter) combinations,” and when it occurs, “more than 20% of DNS queries over TCP do not complete.”
Health-triggered withdrawal moves a whole catchment. RFC 4786 describes coupling the route to the service, so that “availability of the service triggers the route advertisement, and non-availability of the service triggers a route withdrawal.” A flapping health check does not drop one node’s queries; it moves a whole catchment, twice.
Record-level failover waits on TTLs. Withdrawing a nameserver route fails over at BGP speed. A health-checked record that changes its answer fails over only as fast as resolvers expire the old one — and a share of resolvers hold records longer than instructed. See our multi-CDN strategy piece for the measurements.
Measuring from the wrong place. Querying your nameservers from your own monitoring region tells you about one catchment. Mishits and polarization are properties of specific client networks, so a check that passes everywhere you look is the expected result.
Before you buy: seven measurements
Pull 30 days of resolver source addresses from your current authoritative logs. Rank by query volume.
Map the top 20 resolver networks to the regions your users are actually in. The gap between those two lists is the error ceiling on any geo or latency steering.
Measure resolution latency from inside those networks, not from your own infrastructure or a synthetic monitoring region.
Ask each shortlisted provider about its transit and peering in each region you care about. Polarization’s named causes are transit gaps and route leaks, so this question predicts your tail latency.
Ask which resolvers it receives ECS from, and what prefix length it honours.
Price your actual monthly query count against the per-million rate and the steering premium separately, and check which of your queries are free.
Run both providers in parallel on a delegated subdomain for a full billing cycle before cutting over — sequencing is in our CDN migration playbook.
Deciding
Is DNS resolution a measurable share of your page-load time? Because resolvers cache answers, often it is not. Measure it before buying on latency. If it is small, buy anycast DNS for availability and DDoS absorption, and judge providers on catchment stability and transit rather than site count.
Does your DNS answer depend on where the user is? If you use geo or latency steering, its accuracy is capped by your users’ resolvers, and ECS coverage matters more than site count. If every user gets the same answer, the steering premium is money you do not need to spend.
Does your failover plan depend on DNS, or on something faster? If your recovery objective is shorter than your TTL plus resolver drift, DNS is the wrong layer for it. Anycast DNS makes the lookup resilient; it does not make the application resilient.
Authoritative DNS from INXY.hosting
INXY.hosting sources authoritative DNS from multiple providers on one invoice, so the steering premium can be priced across vendors and the choice made on catchment quality rather than site count.
Send us 30 days of resolver logs and the regions that matter, and we will run steps 1 to 3 against your own traffic first — see authoritative DNS and protection services. The same anycast mechanics underpin content delivery, covered in what is a CDN.
FAQ
What is anycast DNS?
Anycast DNS announces one nameserver IP address from many separate locations, so each query is answered by whichever location the Internet’s routing system delivers it to. RFC 4786 defines it as making one service address available in multiple discrete, autonomous locations. BGP, not geography, decides which location answers.
Does anycast DNS send queries to the nearest server?
Not reliably. BGP approximates shortest-path routing rather than measuring latency. In 2015–16 measurements of four root DNS networks, the share of probes sent to a site other than their lowest-latency one ranged from 16% at 8 sites to 76% at 144, with median penalties of 5 to 24 ms (PAM 2017).
How much does anycast DNS cost?
Published rates differ more on steering than on plain queries. Cloudflare’s Free, Pro and Business plans and Bunny charge nothing for standard queries. Amazon Route 53 and Google Cloud DNS both charge $0.40 per million, halving above one billion a month, and $0.60–$0.70 per million for latency or geo routing.
Are more anycast sites always better?
No. In the PAM 2017 study, median latency was about 30 ms whether a root DNS network had 8 sites or 144, while the larger networks sent more clients to a site other than their best one. The authors found geographic distribution and good connectivity mattered far more than raw site count.
Does anycast DNS break TCP queries?
Rarely, but badly where it happens. In 2015–16 root DNS measurements, TCP route flipping occurred in about 0.15% of vantage-point/root-server combinations, and where it occurred more than 20% of DNS queries over TCP did not complete (IEEE TNSM, 2018). TCP matters for responses too large for UDP, such as large DNSSEC-signed answers.
What is EDNS Client Subnet and do I need it?
ECS passes a truncated client prefix to the authoritative server so it can tailor the answer to the user’s network rather than the resolver’s; it does not change which anycast site receives the query. RFC 7871 is Informational and recommends disabling it by default. Support varies by resolver — Cloudflare’s 1.1.1.1 does not send it.

