Kubernetes Cost Optimization Starts Below the Pod

In measurements of four root DNS anycast networks taken in 2015 and 2016 from RIPE Atlas probes, the 8-site network sent 16% of the probes it measured to a site other than their lowest-latency option; the 144-site network sent 76% (Schmidt, Heidemann and Kuipers, PAM 2017). Median latency was about 30 ms across the range. The bigger network missed its best site far more often and was no faster in the median. Site count is the easiest number to compare between DNS providers — and the measurements say it is not the number that sets your latency.

What anycast DNS actually is

Anycast DNS announces one nameserver IP address from many separate locations, so a query sent to that address is answered by whichever location the Internet’s routing system delivers it to. RFC 4786 defines anycast as “the practice of making a particular Service Address available in multiple, discrete, autonomous locations, such that datagrams sent are routed to one of several available locations.”

There is no load balancer and no geography in that decision: “The routing system decides which node is used for each request, based on the topological design of the routing system and the point in the network at which the request originates.” The region whose queries land on one node is its catchment: “the topological region of a network within which packets directed at an Anycast Address are routed to one particular node.”

“Nearest” is a routing claim, not a distance claim

BGP does not measure latency; it selects paths by policy and AS path. RFC 4786 adds that “the population of clients using individual anycast nodes is neither static, nor reliably deterministic.”

The PAM 2017 authors call the gap a mishit: “We define mishits as the cases when VPs are sent to sites other than the lowest latency.” Their explanation is structural: “Anycast relies on BGP to map users to sites, but BGP only approximates shortest-path routing.”

A 2023 census of DNS, CDN and cloud anycast measured the severe version, which its authors call polarization: “when an anycast client is served by a distant site for some specific prefix,” even though a nearer site could serve it faster. Of 7,986 known anycast prefixes, the authors flagged potential polarization in “at least 2273 (28.5%).” Polarization “can add 100 ms or more to the round-trip time if traffic goes to a different continent” (Rizvi, Huang, Esrefoglu and Heidemann, PAM 2024). The causes they name — incomplete connectivity to Tier-1 providers and route leakage by regional networks — are properties of a provider’s transit and peering, not of its site count.

More sites do not buy lower latency

Source: Schmidt, Heidemann and Kuipers, “Anycast Latency: How Many Sites Are Enough?”, PAM 2017, Table 1. Between 5,351 and 6,464 RIPE Atlas probes per root, measured September 2015 to April 2016. The penalty is the extra latency of a mishit compared with the best available site.

L-Root missed its best site most often and paid most per miss — a median 24 ms, with a quarter of misses costing 82 ms or more — while C-Root paid a median 5 ms. Yet median latency was about the same: “Our data shows similar median performance (about 30 ms) from 8 to 144 sites,” suggesting that “as few as twelve sites” can provide reasonable latency if they are well distributed and well connected. The paper’s abstract states the general finding: “geographic location and good connectivity have a far stronger effect on latency than having many sites.”

Two cautions. The data is ten years old and all four networks have changed since. And these are root servers, not commercial managed DNS. The mechanism transfers; the percentages do not — which is why step 3 below measures your own.

Anycast routes the resolver; steering needs the user

An authoritative nameserver never sees your user, only the recursive resolver: “the source address is that of the Recursive Resolver rather than of the query originator” (RFC 7871). For the lookup itself that is fine. The problem appears when the answer is a routing decision: geo and latency policies — the ones priced at a premium below — choose an answer from the location they can see, which is the resolver’s.

EDNS Client Subnet (ECS) lets a resolver pass a truncated client prefix so the authoritative server can tailor its answer. It changes the answer, not which anycast site receives the query. And it comes with a warning label: RFC 7871 is Informational, not Standards Track, describes the option as “not for general purpose deployment,” and states: “Due to the high cache pressure introduced by ECS, the feature SHOULD be disabled in all default configurations.” Resolver support varies: Cloudflare’s 1.1.1.1 does not send ECS, while Google Public DNS sends it to authoritative servers that implement it correctly.

So geo steering is only as accurate as your users’ resolvers allow. Ask a provider which resolvers it actually receives ECS from — not whether it “supports ECS”.

What anycast DNS costs

Published rates, read 22 October 2026.

Route 53 and Google Cloud DNS charge the same standard rate — $0.40 per million to one billion queries a month, $0.20 above — and the same $0.70 for geo-style steering. They differ on latency-based routing, which Route 53 prices at $0.60, on zones, and on free queries: Google states “There is no free tier for Cloud DNS,” while Route 53 provides alias queries to AWS resources such as CloudFront and load balancers at no additional cost.

The steering line varies more than the query line. No price list here has a line item for anycast itself. Steering carries a 50–75% premium at the hyperscalers, is a separate add-on at Cloudflare, and is listed free at Bunny.

At 100 million standard queries a month on one zone: about $40.50 at Route 53, $40.20 at Google Cloud DNS, nothing at Cloudflare and $1 at Bunny. At one billion geo-steered queries: about $700 at either hyperscaler, nothing listed at Bunny, and no published per-query figure at Cloudflare. A spread from zero to $700 with no published performance basis has to be settled by measurement.

What breaks in production

1. Instability that is invisible in aggregate. In 2015–16 root DNS measurements, anycast route flipping occurred “in about 1% of (VP, service) pairs,” and “80% of unstable pairs of VP and anycast services are unstable for more than a week”; for the rest, “routes are stable for hours, days, or longer” (Wei and Heidemann, IEEE TNSM, 2018). Aggregate dashboards show the stable majority.

2. TCP queries get cut. Responses too large for UDP, such as large DNSSEC-signed answers, are retried over TCP, which needs the whole exchange to reach one node. TCP flipping “does occur in about 0.15% (VP, letter) combinations,” and when it occurs, “more than 20% of DNS queries over TCP do not complete.”

3. Health-triggered withdrawal moves a whole catchment. RFC 4786 describes coupling the route to the service, so that “availability of the service triggers the route advertisement, and non-availability of the service triggers a route withdrawal.” A flapping health check does not drop one node’s queries; it moves a whole catchment, twice.

4. Record-level failover waits on TTLs. Withdrawing a nameserver route fails over at BGP speed. A health-checked record that changes its answer fails over only as fast as resolvers expire the old one — and a share of resolvers hold records longer than instructed. See our multi-CDN strategy piece for the measurements.

5. Measuring from the wrong place. Querying your nameservers from your own monitoring region tells you about one catchment. Mishits and polarization are properties of specific client networks, so a check that passes everywhere you look is the expected result.

Before you buy: seven measurements

1. Pull 30 days of resolver source addresses from your current authoritative logs. Rank by query volume.

2. Map the top 20 resolver networks to the regions your users are actually in. The gap between those two lists is the error ceiling on any geo or latency steering.

3. Measure resolution latency from inside those networks, not from your own infrastructure or a synthetic monitoring region.

4. Ask each shortlisted provider about its transit and peering in each region you care about. Polarization’s named causes are transit gaps and route leaks, so this question predicts your tail latency.

5. Ask which resolvers it receives ECS from, and what prefix length it honours.

6. Price your actual monthly query count against the per-million rate and the steering premium separately, and check which of your queries are free.

7. Run both providers in parallel on a delegated subdomain for a full billing cycle before cutting over — sequencing is in our CDN migration playbook.

Deciding

Is DNS resolution a measurable share of your page-load time? Because resolvers cache answers, often it is not. Measure it before buying on latency. If it is small, buy anycast DNS for availability and DDoS absorption, and judge providers on catchment stability and transit rather than site count.

Does your DNS answer depend on where the user is? If you use geo or latency steering, its accuracy is capped by your users’ resolvers, and ECS coverage matters more than site count. If every user gets the same answer, the steering premium is money you do not need to spend.

Does your failover plan depend on DNS, or on something faster? If your recovery objective is shorter than your TTL plus resolver drift, DNS is the wrong layer for it. Anycast DNS makes the lookup resilient; it does not make the application resilient.

Authoritative DNS from INXY.hosting

INXY.hosting sources authoritative DNS from multiple providers on one invoice, so the steering premium can be priced across vendors and the choice made on catchment quality rather than site count.

Send us 30 days of resolver logs and the regions that matter, and we will run steps 1 to 3 against your own traffic first — see authoritative DNS and protection services. The same anycast mechanics underpin content delivery, covered in what is a CDN.

FAQ

What is anycast DNS?

Anycast DNS announces one nameserver IP address from many separate locations, so each query is answered by whichever location the Internet’s routing system delivers it to. RFC 4786 defines it as making one service address available in multiple discrete, autonomous locations. BGP, not geography, decides which location answers.

Does anycast DNS send queries to the nearest server?

Not reliably. BGP approximates shortest-path routing rather than measuring latency. In 2015–16 measurements of four root DNS networks, the share of probes sent to a site other than their lowest-latency one ranged from 16% at 8 sites to 76% at 144, with median penalties of 5 to 24 ms (PAM 2017).

How much does anycast DNS cost?

Published rates differ more on steering than on plain queries. Cloudflare’s Free, Pro and Business plans and Bunny charge nothing for standard queries. Amazon Route 53 and Google Cloud DNS both charge $0.40 per million, halving above one billion a month, and $0.60–$0.70 per million for latency or geo routing.

Are more anycast sites always better?

No. In the PAM 2017 study, median latency was about 30 ms whether a root DNS network had 8 sites or 144, while the larger networks sent more clients to a site other than their best one. The authors found geographic distribution and good connectivity mattered far more than raw site count.

Does anycast DNS break TCP queries?

Rarely, but badly where it happens. In 2015–16 root DNS measurements, TCP route flipping occurred in about 0.15% of vantage-point/root-server combinations, and where it occurred more than 20% of DNS queries over TCP did not complete (IEEE TNSM, 2018). TCP matters for responses too large for UDP, such as large DNSSEC-signed answers.

What is EDNS Client Subnet and do I need it?

ECS passes a truncated client prefix to the authoritative server so it can tailor the answer to the user’s network rather than the resolver’s; it does not change which anycast site receives the query. RFC 7871 is Informational and recommends disabling it by default. Support varies by resolver — Cloudflare’s 1.1.1.1 does not send it.

A second CDN looks like insurance until the first invoice arrives. Priced band by band on Bunny's published Volume ladder, 2 PB a month costs at least 20% more split evenly across two accounts than on one — 38.5% more if you take the 1–2 PB rate from Bunny's marketing page rather than its documentation. The ratio you send to the second provider sets your bill, your cache hit ratio and your real failover time at once. This article settles how to pick it.

What a multi-CDN strategy actually is

A multi-CDN strategy delivers the same content through two or more CDN providers, with a steering layer deciding which one serves each request. It is built three ways: DNS-based steering, client-side selection inside the player or application, and manual failover by changing a record when something breaks. They differ in how fast they react and in what they can measure.

DNS steering is the common choice because it needs no application change; Cloudflare's Load Balancing documentation, for example, lists five global steering policies — Standard, Geo, Dynamic, Proximity and Least Outstanding Requests (Cloudflare, 2026). Client-side selection reflects real delivery performance, because the player measures what the user got, but it requires you to own the client.

The decision most teams skip is not which mechanism, but what share of traffic the second provider carries in steady state. That number reorders every other answer below.

The split ratio sets the bill, and the worst ratio is 50/50

CDN volume pricing is a descending ladder. Where it is applied band by band to one monthly total — which is how the published labels read ("First 500 TB", "Next 10 TB"), although neither Bunny page states the method — splitting the traffic restarts each provider's meter at the top band. Because the marginal rate falls as volume rises, the penalty on two identical ladders is largest at the even split, the configuration that looks most redundant.

The table isolates the effect by pricing one published ladder against itself, one account against two. A real second vendor has a different ladder, so read it as the mechanism, not a quote.

Rates: bunny.net/pricing/cdn, bunny.net/docs/cdn/pricing and fastly.com/pricing, all read 15 October 2026. Bunny's two pages disagree on the 1–2 PB band, so both rows are shown. Fastly bills "per GB per Region per month"; its free first 100 GB is included.

Three things fall out of that table no single provider will say.

Below the first band boundary, splitting is free. At 500 TB both halves stay inside Bunny's first Volume band, so the split costs nothing. Tier dilution only exists once your single-provider volume has crossed a discount boundary — so below that point the cost argument against a second CDN does not apply.

The cheapest split is the one that protects you least. At 2 PB, moving from 50/50 to 90/10 cuts the premium from 20.0% to 5.3% on the documentation rate (38.5% to 9.2% on the marketing rate), and 95/5 cuts it to 2.7% (4.6%). Every point saved there comes from traffic taken away from the provider you are paying to keep warm.

Above a certain volume the comparison stops being possible. Fastly's public rate card ends after the "Next 10 TB" band, with "Contact us for high-volume pricing" above the table; Bunny's Volume ladder ends at "2 PB+" with "Contact us". A multi-CDN plan at real scale is a negotiation, and the published cards are only your opening anchor. Before assuming the split is cheap, see how to cut CDN costs before you add a second provider.

Failover is slower than your TTL, and lowering the TTL makes it worse

DNS-based CDN failover is not instant. Detection takes the health-check interval multiplied by the retry count — Cloudflare's own monitor documentation works an example in which five retries at a 20-second timeout mark an endpoint unhealthy "after approximately 120 s (6 × 20 s)" — and the record change then has to outlive every resolver cache still holding the old answer.

The instinct is to cut the TTL to 30 or 60 seconds. Measurement data says that makes the tail worse rather than better. Bhowmick et al. measured 27,131 resolvers across 9,514 autonomous systems. At a 60-minute TTL, 0.31% of the resolvers tested extended it; as the test TTL was lowered step by step to one minute, the share rose to 8.74% of the resolvers measurable from at least five vantage points. The authors estimate the effect reaches "at least 38% of the popular websites that use CDNs" (Bhowmick et al., PAM 2023).

So the shortest TTL you set is not the longest wait you get. Close to one in eleven of the resolvers measured extended a short TTL, which keeps their users on a CDN you have already pulled from rotation. Plan the failover window as detection plus TTL plus a non-compliant tail.

The standby cache is the cost nobody quotes

Each CDN maintains its own cache. A provider carrying 5% of your traffic sees 5% of your request volume, which means the long tail of your catalogue is never resident in it. When you fail over, you do not move traffic onto a warm CDN. You move it onto a cold one, and every miss becomes an origin fetch.

The arithmetic is unforgiving because miss rate, not hit rate, is what the origin feels. Fastly's engineering team puts it plainly: "If your CHR increases from 90% to 95%, it's not merely a 5% improvement; it actually halves your origin load" (Fastly, 2024). Run that backwards. A standby whose hit ratio starts at 50% instead of a steady-state 95% delivers ten times the origin fetch volume of the provider it just replaced — at the exact moment you are already in an incident.

Fastly's shielding case study shows the scale in production: with shielding, one customer's origin load was "capped well below 5GiB/s"; without it, at a similar hit ratio, it settled "in the low 20GiBs range," which Fastly describes as 4x the shielded load (Fastly, 2024). Shielding suppresses that, and shielding is per-vendor — provider B's shield cannot read provider A's cache. Two CDNs means two independent fill paths against one origin.

That is the hidden cost of a multi-CDN strategy: it appears on neither CDN invoice. It lands on your origin egress bill. If your origin sits in a hyperscaler, see cloud egress fees comparison for what those fetches cost per GB.

What breaks in production

• The cold standby turns a CDN incident into an origin incident. The failure mode is not that the second CDN is slow. It is that your origin saturates while it fills. Load-test the failover at real traffic, not at 1%.

• Shielding inflates the miss count you monitor on. Fastly documents that "a request that does reach your origin server will be counted as two misses, one at the edge, and one at the shield." Fastly adds that this "will result in a cache hit ratio (CHR) that may be lower than you expect" — enabling shielding can make the reported hit ratio look worse while origin load falls. Judge it on origin bytes, not on CHR.

• Anycast routing can move you into a more expensive billing region. Fastly's billing documentation states that Anycast IPs "will route a request to the nearest POP located in a billing region that may charge a higher rate." Two providers means two independent region maps, and traffic you believed was European can be billed otherwise at one of them.

• Package terms can carry geographic caps. Fastly's Deliver packages carry the footnote "No more than 10% of traffic may originate in the African, Indian, or South Korean billing regions." A steering policy that shifts traffic by latency can walk a contract into breach without anyone reading the clause.

• You cannot attribute a failure without a per-response identifier. When a user reports a broken session, nothing in a standard response says which CDN served it. CTA-5006, Common Media Server Data, defines response headers that give "a uniform method for media servers and services to communicate data about media objects," and AWS Elemental MediaPackage uses its n key for "The identifier for the MediaPackage origin endpoint of this object" (AWS, 2026). Without an equivalent header or log field at every provider, a multi-CDN incident review is guesswork.

Measure these seven things before you split traffic

1. Your single-provider monthly volume against your current ladder. Find the next band boundary. Below it, tier dilution is zero and the cost objection does not apply to you.

2. Origin egress over 30 days, in bytes, not requests — the number a second cache will increase.

3. Cache hit ratio by content class — hot catalogue versus long tail. The long-tail ratio is what the standby will actually deliver on day one.

4. Health-check detection time end to end: interval × retries, measured, not assumed. Then add your TTL.

5. Resolver behaviour on your own zone. Change a record, then watch the decay curve of requests to the old target. That tail is your real failover window.

6. A parallel run. Serve a sampled share of live traffic through the candidate provider for a full week including a weekend peak, and compare delivered performance from the client rather than from either vendor's dashboard. CDN optimization: cache hit ratio, TTL and origin load covers the measurement setup.

7. Your contracts. Minimums, commitments, region caps and the overage rate above the published card — for both providers, in writing, before the split.

Choosing the ratio

Three questions decide it, in order.

Is your volume past a discount boundary? If not, choose the split on resilience grounds alone. If it is, price 50/50, 90/10 and 95/5 against your actual ladder first — at 2 PB on Bunny's ladder, the gap between 50/50 and 95/5 is 17 to 34 percentage points.

Can your origin survive the standby filling at full traffic? If not, give the second provider a higher steady-state share, paid for as cache warmth, not redundancy. A 5% standby is a 5% guarantee.

Can you attribute a failure to a provider within one incident? If not, build that before the second CDN, not after. A multi-CDN setup you cannot debug is two vendors blaming each other.

Read together, the three sections above point one way: a single well-chosen provider with shielding beats a badly-split pair, and a share chosen deliberately — priced against your ladder and tested against your origin — beats both a default 50/50 and a reflexive 95/5. We buy across providers rather than for one, so the split ratio is a configuration choice here, and one invoice covers every provider in the test. Bring us 30 days of volume, origin egress and hit-ratio figures and we will price the split three ways before you commit to either vendor — see how our data delivery service handles multi-provider sourcing. If you are splitting because one provider is exiting, the CDN shutdown migration playbook sequence applies first.

FAQ

Does a multi-CDN strategy always cost more?

Not always. Below your provider's first discount boundary, splitting traffic costs nothing extra, because both halves stay in the same band. Above it, the penalty grows with volume and peaks at an even split — on Bunny's published Volume ladder, 11.1% at 1 PB a month and 20% to 38.5% at 2 PB, depending on which Bunny page you price from.

How fast is multi-CDN failover in practice?

Slower than the TTL suggests. Detection takes the health-check interval times the retry count, and Cloudflare's documentation gives roughly 120 seconds for six 20-second attempts. The record change then has to expire in every resolver cache, and measurement data shows a minority of resolvers extend short TTLs beyond their stated value.

Should I lower my DNS TTL to speed up failover?

Within limits. A 2023 study of 27,131 resolvers found 0.31% extending a 60-minute TTL, rising to 8.74% as the test TTL was lowered to one minute, so very short TTLs increase the share of resolvers that hold your record longer than instructed. A short TTL shortens the median failover and lengthens the tail.

What traffic share should the second CDN carry?

Enough to keep its cache representative of your catalogue, which for most workloads is more than the 5% a hot-standby design implies. Measure your long-tail hit ratio at the candidate share during a parallel run; if it is far below your primary's steady state, the standby is not yet a standby.

Does multi-CDN increase origin load?

Yes. Each provider fills its own cache independently and each vendor's shield is private to that vendor, so the same object can be fetched from origin twice. The effect is largest on long-tail content and shows up on your origin egress bill rather than on either CDN invoice.

Can I run multi-CDN without changing my application?

Yes, with DNS-based steering, which is why most teams start there. The tradeoff is measurement: DNS steering decides from health checks and routing data rather than from what the user actually received. Client-side selection reacts to real delivery performance but requires you to control the player or application.

Most Hetzner vs OVH comparisons line the two up on monthly price. That leaves out the line that hits first: the setup fee. Since Hetzner’s 15 June 2026 price adjustment, its dedicated setup fee works out to about half of one month’s rate — €49.00 on a €97.30 AX42-1, €799.00 on a €1,597.30 AX162-3 (Hetzner Docs). OVHcloud charges a full month: Advance-3 is €199.99 a month with a €199.99 installation fee on its European site, and $255 with $255 on its US site — where, and only where, the fee is included on a twelve-month commitment (OVHcloud). For anyone who will not keep a server for a year, that difference reorders the comparison.

The fee as a share of the rate

Both providers publish a monthly rate and a one-time fee. Neither publishes the number that compares across them: the fee as a share of the rate.

On Hetzner’s price-adjustment page, the standard dedicated configurations carry setup fees between 47.4% (SX65-2) and 50.4% (AX42-1) of the monthly rate. On OVHcloud, every Advance and Scale listing we could read — European and US — shows an installation fee equal to one full month.

Spread over the time you keep the server, the fee becomes a premium on the monthly rate, and it shrinks as 1/N:

Premium = setup fee ÷ (monthly rate × months). Hetzner AX42-1: €97.30/month + €49.00 setup. OVHcloud Advance-3 2024: €199.99 + €199.99 (EU, excl. VAT) or $255 + $255 (US). The machines are not equivalent hardware, so only the fee structure is compared here. INXY.hosting charges no setup fee and has no minimum term.

Two things follow. Below twelve months, Hetzner’s entry cost is about half of OVHcloud’s. At twelve months and beyond, the setup fee shrinks to a few percent of the bill on either provider — at which point the monthly rate, not the fee, decides the comparison. So tenancy length decides the entry cost; it does not decide which provider is cheaper overall.

One caveat on OVHcloud’s waiver. The US Advance FAQ states: “The setup fees for your dedicated server are included for any commitment period of 12 months or longer.” The European Advance page lists the same one-month fee and says nothing about commitment. If you are buying in Europe — where Hetzner’s dedicated servers are — do not assume the waiver applies; get it on the order form before signing the term that is supposed to buy it.

Which is cheaper to set up, Hetzner or OVHcloud? Hetzner’s dedicated setup fee is about half of one month’s rate. OVHcloud’s installation fee equals one full month; its US site includes it on commitments of twelve months or longer, while its European site does not mention a waiver. Below twelve months, Hetzner costs less to start.

What each one charges to start

Hetzner sells from three inventory pools with three fee structures — not three tiers of one product.

Hetzner: price-adjustment page (created 15 June 2026, last changed 8 July 2026) and Server Auction FAQ. OVHcloud: European and US Advance pages and US price page. Prices excl. VAT. All read 12 October 2026.

The -LTD setup fee is nearly flat. €39.00 applies across most of the pool — 50.5% of a month on the €77.30 AX42-1-LTD, 12.3% on the €317.30 AX162-1-LTD. Two models (AX41-1-LTD and EX44-1-LTD) carry €0.00, and three step up: EX131-2-LTD to €49.00, DX182-1-LTD to €51.00 and SX295-1-LTD to €59.00. Hetzner sells the pool while supply lasts, so repeat orders are not assured — but on a one-off order the larger server has the smaller relative entry cost.

The Server Auction has no setup fee at all. Hetzner’s FAQ: “There are no setup fees for these servers,” and “The cancellation period for these servers is usually immediately.” These are “old” servers re-listed after a previous customer cancelled, “designed for people who already have experience in server administration.” For a short load test it is the zero-entry-cost option on either vendor.

Bandwidth: both say unlimited, and they mean different things

Hetzner meters only the faster port. Its traffic documentation: “All root servers have a dedicated 1 GBit uplink by default and with it unlimited traffic,” while “Inclusive monthly traffic for servers with 10Gbit uplink is 20TB,” charged at “€ 1 ($1.20)/TB for overusage.” Only outbound traffic counts: “We do not count incoming and internal traffic.” The AX42 product page confirms it: traffic “is unlimited and free of charge,” except on servers with the 10G uplink add-on. The upgrade turns an unmetered service into a metered one — see metered vs unmetered bandwidth.

OVHcloud does not meter, with one regional exception. Its US bandwidth page says “Our bandwidth is unlimited and unmetered across all dedicated servers,” with no exception on that page. The US Advance FAQ adds one: unmetered traffic applies “with the exception of solutions and services hosted in our Asia-Pacific data centers.” For a server in Singapore, Mumbai or Sydney, ask for the traffic terms in the quote.

Guaranteed throughput differs by range, not just by vendor. OVHcloud’s European Advance page lists “3Gbps unmetered and guaranteed public bandwidth”; its US Advance page lists 1 Gbps unlimited public bandwidth, upgradable to 5 Gbps. Hetzner’s AX42 lists a 1 Gbit/s port with 1 Gbit/s guaranteed. On the Advance range, OVHcloud guarantees more.

For ingest-heavy work — backup targets, log sinks, replication receivers — Hetzner’s outbound-only rule keeps inbound free even on a metered 10G uplink, and OVHcloud counts nothing outside Asia-Pacific. Both work; the dedicated server pricing line items decide more than port speed.

Where each one physically is

Location rules providers out rather than reordering them, so it is where the comparison should start.

Hetzner: location labels from the price-adjustment page (US and Singapore appear only under cloud servers); SLA from Hetzner’s Cloud SLA document. OVHcloud: sites from the global availability page; commitments from the US Dedicated Server SLA (effective 6 January 2025). Read 12 October 2026.

A two-country footprint suits one buyer and rules out another. For EU data residency it is simple and defensible. For a latency target in North America or Asia it ends the conversation.

The SLAs are not symmetric. OVHcloud’s US SLA pays service credits of 10%, 30% or 100% of the monthly fee as availability drops below the commitment, below 99.00% and below 95.00%, excluding one-time fees and capped at 100% of the month. Hetzner’s published SLA covers Cloud servers and vServers at 99.9%; we found no dedicated-server equivalent. Treat it as unpublished rather than absent, and ask for it in writing.

For Asia-Pacific, confirm in the quote. OVHcloud’s global availability page marks Rise, Advance and Scale at all three APAC sites, while the APAC traffic exception above applies there. Confirm range, site and traffic terms before ordering.

Contracts, generations and repricing

Hetzner’s commercial shape is short. The AX42 page states “No minimum contract term” and “Cancellation period: immediately.” You pay about half a month to start and can leave the same day, which makes it a natural home for anything exploratory.

OVHcloud’s shape is the mirror image — on its US site. There the commitment buys the fee waiver, so the cheapest entry is also the longest lock-in. For a workload already sized for years, that is a fair trade; for one still being measured, it turns an experiment into a term contract.

Hetzner reprices on change, not on renewal. “For orders placed before 15 June 2026, but delivered after 15 June 2026, the previous prices will apply,” and “certain changes to servers with legacy pricing may trigger a switch to the current pricing.” Your cheapest server is your oldest one, and a consolidation that touches it can move that capacity onto current rates. Model fleet changes at today’s prices.

OVHcloud model names outlive their hardware. The US price page lists 2024 and 2026 Advance ranges under the same names, on different processors:

OVHcloud US price page, read 12 October 2026; the 2026 listings are marked “Coming Soon”. The European page shows the same pattern: Advance-1 2024 at €114.99, 2026 at €159.99 (+39.1%).

These are different machines, not a price rise on the same one — Advance-5 even changes CPU vendor. A quote for “Advance-5” without a generation year could describe either server. Put the generation and CPU model on the order.

A third option: no setup fee, no minimum term

The trade-off above — a cheap, flexible entry or a committed, waived one — is a feature of these two providers’ pricing, not of dedicated hosting. INXY.hosting dedicated servers have no setup fee and no minimum term, so the entry premium in the first table stays at 0% whatever the tenancy.

• No setup fee — the entry premium is 0% at every tenancy length

• No minimum term — leave when the workload ends

• Matched-spec quotes on request, priced next to the published Hetzner and OVHcloud rates

• Pay in fiat or crypto

What breaks in production

1. The commitment was meant to buy the waiver, and the order form did not say so. The fee sits on the price card unconditionally; the waiver lives in an FAQ — and only on OVHcloud’s US site. Reconcile them before signing.

2. The 10G uplink was ordered for headroom and arrived with a meter. A 1 Gbit Hetzner port is unlimited; the 10 Gbit add-on is 20 TB, then €1/TB.

3. Backup and replication were sized against the wrong direction. Hetzner counts outgoing traffic only, so a replication target receiving 40 TB and serving 2 TB bills on the 2 TB. Check the direction rule per product.

4. The APAC server inherited European terms in the plan but not in the contract. Unmetered on the bandwidth page, excluded in the Advance FAQ.

5. The short-tenancy server was bought from the standard range. A six-week load test there pays a ~50% setup premium that the Server Auction or a zero-fee -LTD model would not.

6. The fleet consolidation repriced the survivors. Changes to grandfathered Hetzner servers can move that capacity onto current pricing.

Seven steps before you order

1. Write down the tenancy in months. If the honest answer is “we do not know”, treat it as under twelve.

2. Decide the region first. Hetzner’s dedicated range is Germany and Finland only.

3. Divide the one-time fee by the monthly rate, then by your tenancy. That is the entry premium, comparable across vendors and currencies.

4. Compare monthly rates on matched hardware. Above twelve months, this decides the bill.

5. Measure traffic in both directions for 30 days before choosing an uplink.

6. Get three things in writing: the installation-fee condition, the per-TB rate above any allowance, and the uptime commitment with its credit mechanism.

7. Write the exit before the entry. Immediate cancellation and a committed term cost very different amounts for the same change of mind.

Which one when

Is Hetzner cheaper than OVHcloud? Published monthly rates do not settle it, because the two vendors’ configurations are not like-for-like. Entry cost can be compared: Hetzner’s setup fee is about half a month, while OVHcloud’s is a full month, included on twelve-month commitments only on its US site.

The decision, framed

Can you name the region? If the workload needs a dedicated server in North America or Asia-Pacific, Hetzner is out.

Can you name the tenancy? Under twelve months, Hetzner’s entry cost is about half of OVHcloud’s, and the Server Auction or a zero-fee -LTD model takes it to zero. Above twelve months, the setup fee fades and the monthly rate on matched hardware decides.

Can you sign for it? A commitment on hardware you have not sized is the most expensive line in this article. If the tenancy question has no number, choose an option you can leave without paying for the entry twice.

Most buyers asking this are choosing between a flexible entry and a committed one, and these two providers sit at opposite ends of that trade. If you would rather not choose, INXY.hosting dedicated and bare-metal servers have no setup fee and no minimum term. Send us your target configuration and an honest tenancy estimate, and we will price it side by side with the published Hetzner and OVHcloud rates. Leaving a hyperscaler? Start with what cloud egress actually costs.

FAQ

Does Hetzner charge a setup fee?

Yes, on the standard dedicated range. Since the 15 June 2026 price adjustment it is about half of one month’s rate — €49.00 on a €97.30 AX42-1, €799.00 on a €1,597.30 AX162-3. Server Auction servers carry no setup fee, and two -LTD models, AX41-1-LTD and EX44-1-LTD, are listed at €0.00.

Is OVHcloud’s installation fee avoidable?

On OVHcloud’s US site, yes: its Advance FAQ states the setup fees are included on any commitment of twelve months or longer. Its European Advance page lists a one-month installation fee without mentioning a waiver. Confirm the condition on your order form either way.

Is Hetzner traffic really unlimited?

On the default 1 Gbit uplink, yes — unlimited, counted outbound only. Servers with the 10 Gbit uplink add-on include 20 TB per month, then €1 ($1.20) per TB. The faster port is the metered one.

Does OVHcloud meter bandwidth?

Outside Asia-Pacific, no. Its bandwidth page describes traffic as unlimited and unmetered across all dedicated servers, while its US Advance FAQ excludes services hosted in Asia-Pacific data centres. For Singapore, Mumbai or Sydney, ask for the applicable terms.

Which has better uptime guarantees, Hetzner or OVHcloud?

OVHcloud’s US dedicated-server SLA commits 99.95% for Advance, 99.99% for Scale and 99.90% for Rise and Game, with credits of 10%, 30% or 100% of the monthly fee. Hetzner’s published SLA covers Cloud servers and vServers at 99.9%; we found no dedicated-server figure.

Is there an alternative without setup fees or minimum terms?

Yes. Hetzner’s Server Auction and two -LTD models have no setup fee but limited stock. INXY.hosting dedicated servers have no setup fee and no minimum term.

Two teams store 100 TB of the same video library on Storj’s Regional Workflows tier, at the same published $10/TB rate. One pays $1,000 a month, the other $5,000. The only difference is how much they read back. Most comparisons of S3 alternatives sort vendors by storage price per terabyte — and for many workloads that column decides the smaller part of the bill. This article shows which number actually decides it, and how to measure yours before you sign.

The number that decides this is a ratio, not a rate

Divide your monthly egress volume by your stored volume. A 100 TB archive serving 10 TB a month is a 0.1× workload. The same 100 TB feeding a video player at 500 TB a month is a 5× workload. Nothing else about the two workloads differs, yet almost every vendor in this market prices them differently.

The reason is structural. Storage per terabyte is close to a commodity, so object storage vendors compete on how much read traffic they will absorb at that price. “No egress fees” is a real differentiator — and also a bet on your ratio, which each vendor has placed at a different number.

What is an egress ratio in object storage? The egress ratio is your monthly download volume divided by your stored volume. A 100 TB bucket serving 300 TB a month has a 3× ratio. Many “free egress” offers are capped at a multiple of stored data — commonly 1× or 3× — while a few have no cap at all, so the ratio, not the storage rate per terabyte, decides which provider is cheapest for a given workload.

Four offers, four definitions of “free egress”

Wasabi charges nothing for egress, and its pricing FAQ draws the line at a ratio of one: the free-egress policy fits workloads whose monthly egress is “less than or equal to your active storage volume”. There is no overage rate. If usage regularly exceeds the policy, Wasabi says it may “limit or suspend your service” (Wasabi pricing FAQ).

Cloudflare R2 states: “There are no charges for egress bandwidth for any storage class.” There is no ratio; R2 earns on operations instead, at $4.50 per million Class A and $0.36 per million Class B requests on Standard storage (Cloudflare R2 pricing).

Storj includes 1× egress on its Global Collaboration and Regional Workflows tiers and charges $0.02/GB and $0.01/GB above it. Its cheapest tier, Active Archive at $6/TB, includes no free egress and charges $0.02/GB from the first byte (Storj pricing, updated 15 July 2026).

INXY.hosting S3 includes egress up to 3× your average stored data each month and charges $0.015/GB above it. Egress to our CDN partners CacheFly and Gcore is free and unlimited.

Read side by side, these offers implement four different rules — 1×, 3×, unlimited, and no free egress at all on the cheapest archive tier — and one of them enforces its limit through an account-level right to limit or suspend service rather than an overage price. A commercial term you cannot convert into a line item is not a price; it is a risk, and it belongs in your vendor review as well as your cost model.

Published rates, side by side

All rates from each vendor’s own published page, read 9 October 2026; currencies as published, prices before tax, no FX applied. Hetzner’s included quota is defined in TB-hours and scales with month length, which is why its included traffic runs from 1.008 TB (28 days) to 1.116 TB (31 days). Hetzner’s rates are taken from its price list as of October 2026. DigitalOcean prices in GiB, so its per-TB figure is about 7% lower than the same number in decimal units.

The worked example: same 100 TB, two ratios, different winners

Take 100 TB stored. First at a 0.1× ratio — 10 TB egress a month, a backup target or a compliance archive — then at 5×, an ordinary month for a media library or a dataset read by training jobs.

Arithmetic from the published rates above at 1 TB = 1,000 GB, 30-day month, storage and egress only. Amazon S3 uses the standard us-east-1 internet egress tiers ($0.09/GB first 10 TB, $0.085 next 40 TB, $0.07 next 100 TB, $0.05 above 150 TB). R2 read requests add $0.36 per million GETs — tens of dollars a month for a typical video library. The CacheFly / Gcore row covers storage and storage egress only; delivery from the CDN to viewers is billed under the CDN plan.

Four things follow from the table.

Against Amazon S3, every alternative wins — by a margin that depends on the ratio. At 0.1× the alternatives cost roughly a fifth to two-thirds of the S3 bill. At 5×, where S3’s metered egress dominates, the cheapest alternatives cost about a twentieth of it. The ratio decides not only which alternative wins, but how much moving off S3 is worth.

Between a 3× plan and an unlimited one, the ranking inverts. At 0.1×, INXY.hosting S3 is cheaper and R2 costs 1.5× as much ($1,500 against $999). At 5× served directly from storage, R2 is cheaper and the 3× plan costs 2.7× as much. The crossover is calculable: $9.99/TB with 3× free egress and $15/TB above it equals R2 at $15/TB when egress reaches 3.33× stored volume. Below that ratio the 3× plan is cheaper; above it unlimited egress is — unless delivery runs through a CDN whose egress from storage is free, which removes the overage line altogether.

The lowest storage rate does not guarantee the lowest bill. Storj Active Archive has the lowest storage rate in the table, $6/TB, but at 0.1× it only ties with Wasabi ($800 against $799) because every byte of egress is billed, and at 5× it is the second most expensive option after S3.

The cheapest number on the list comes with the tightest ceilings. On Hetzner’s current price list, both scenarios are the lowest direct-from-storage prices in the table even after converting euros to dollars (about €636 and €1,126). But Hetzner caps a bucket at 100 TB and 750 requests per second, and bills small objects as 64 kB. The 100 TB in this example fills one bucket exactly. Cheap and constrained is a valid choice; it is a different choice from cheap and elastic.

Wasabi needs its own sentence. Its storage line is among the cheapest at 0.1×, and at 5× there is no number to put in the table: a 5× workload sits outside the policy the product is sold under. That is not a criticism — the fit is clearly stated — but it means comparing a published price with an absent one. Treat any “no egress fees” claim as a question: free up to what multiple, and above it, a rate or a conversation?

Minimum billable object size: the second bill nobody models

Storage rates assume your objects are large. Three providers above publish a minimum billable object size, and the numbers differ by a factor of 25: Wasabi bills a minimum of 4 KB per object, Hetzner 64 kB, and Storj 50 kB on its Global and Regional tiers and 100 kB on Active Archive. INXY.hosting S3 has no minimum billable object size.

Take 100 million objects averaging 10 KB — thumbnails, map tiles, log shards, feature vectors, small JSON documents. That is 1 TB of real data.

The cheapest archive rate in the market produces the most expensive bill for this workload. Storj Active Archive at $6/TB bills 7.5× what Wasabi charges at $7.99/TB for the identical byte count, because a 10 KB object is billed as 100 kB. Storj Regional at $10/TB bills five times what INXY.hosting S3 charges at $9.99/TB, for the same reason. All of these numbers sit on the vendors’ own public pages, one click from the headline rate.

Request pricing compounds in the same direction. Writing those 100 million objects once costs about $445 in Class A operations on R2 after its 1 million free monthly requests, against nothing on INXY.hosting S3, Hetzner and Scaleway, where those calls are free or included. On an ingest-heavy, small-object workload the request line can exceed the first month of storage — then fall to near zero, which is why it rarely appears in an estimate built from a steady-state month.

“S3-compatible” is a spectrum — and the gaps are in the vendors’ own docs

Every provider here speaks the S3 API. None implements all of it, and the gaps are documented plainly enough that there is no reason to discover them during a cutover.

Cloudflare R2. The compatibility page states “Feature implementation is currently in progress” and marks as not implemented: bucket versioning, object tagging, bucket policies, replication, public access blocks, website configuration and object lock. ACL headers and SSE-KMS headers are unsupported; only the STANDARD and STANDARD_IA storage classes are implemented. On multipart uploads, if a retry to the same part number fails, the earlier part is lost and must be re-uploaded (Cloudflare R2 S3 API compatibility). The missing object lock matters for anyone using object storage as an immutable backup target.

Hetzner publishes hard ceilings: up to 100 TB and 50,000,000 objects per bucket, 750 requests per second and 10 Gbit/s per bucket, and 100 buckets per account (Hetzner Object Storage docs). Amazon’s performance guidance is at least 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix, with no limit on the number of prefixes in a bucket (AWS S3 performance guidelines). These are different units — per bucket versus per prefix — but that is the point: on S3 you scale request rate by adding prefixes; on a per-bucket ceiling, you can only add buckets, up to the account cap.

That is the migration risk the price tables never carry. A storage rate is reversible in a month. An architecture that assumed versioning, object tags, object lock, bucket policies or prefix-level scaling is not.

Is S3-compatible object storage the same as Amazon S3? No. S3 compatibility means a provider implements the S3 API, not all of it. Cloudflare R2, for example, documents bucket versioning, object tagging, object lock and replication as not implemented. Check each provider’s compatibility page against the specific operations your application calls.

What breaks in production

• Minimum storage duration on short-lived objects. Wasabi Pay as You Go has a 90-day minimum: an object stored on day 1 and deleted on day 16 is billed 15 days of active storage and 75 days of deleted storage (Wasabi, updated 14 September 2026). Storj Active Archive has a 30-day minimum; R2 Infrequent Access has a 30-day minimum plus $0.01/GB retrieval. A job that writes and expires temporary objects daily pays for each of them for a month or a quarter.

• The minimum can depend on your contract. Wasabi publishes 90 days for Pay as You Go, but says other pricing models have different minimums and directs customers to sales or support for the figure. If you buy on a contract, get the number in writing before signing.

• Included quotas do not accumulate. Hetzner: “Unused included quota expires at the end of each month and cannot be carried over to the next month.” A quarterly restore is three months of unused allowance followed by one month of overage.

• GiB and GB are mixed across the market. DigitalOcean prices in GiB; most of the market prices in decimal TB. The 7.4% gap lands on both the storage and the egress line.

• Egress policies are enforced against sustained behaviour, not peaks. A one-off restore is unlikely to matter; a permanent change in read pattern after you point a CDN at the bucket is a different conversation. With a CDN in front, the ratio the storage vendor sees is your cache-miss volume — which makes cache hit ratio a storage cost input, not only a performance metric.

• Self-hosting an S3 API needs an owner. In December 2025 MinIO put its open-source community edition into maintenance mode — no new features or pull requests, security fixes assessed case by case — and pointed users towards MinIO Enterprise (InfoQ, 2025), after earlier removing admin features from the community web console. Whatever comes next, a self-hosted comparison row needs a named owner, a patch process and a maintenance budget.

Measure these seven things before you shortlist anything

1. Pull 90 days of egress and stored volume from your current provider’s billing export, not a monitoring dashboard. Compute egress ÷ stored for each month and take the highest, not the average.

2. Count objects and get the size distribution — specifically the share below 4 KB, 50 kB, 64 kB and 100 kB, the published minimum billable sizes in this market.

3. Count write operations separately from reads. On R2, PutObject, CreateMultipartUpload, UploadPart, CopyObject and ListObjects are Class A — a listing-heavy application is priced like a write-heavy one.

4. List every S3 operation your code and tooling actually call, including backup agents and SDK defaults, and check each candidate’s compatibility page. Versioning, tagging, object lock, ACLs, bucket policies, SSE-KMS and POST pre-signed uploads are the usual casualties.

5. Measure peak request rate and throughput per bucket and check them against each candidate’s per-bucket ceiling and per-account bucket cap.

6. Price the exit as well as the entry. Moving data in is an egress event at your current provider; moving it out later is one at the new provider. See the cloud egress fees comparison for the regulatory changes now starting to waive exit charges.

7. Run a parallel write for two weeks against the top two candidates before cutting over reads. That bill is the only estimate not built on assumptions.

How to decide

Three questions, in this order.

What is your peak monthly egress ratio? Below about 1×, the storage rate dominates and most providers in the table are viable — sort on price, limits and compatibility. Between 1× and about 3.3×, a 3×-included plan is usually cheapest, and 1× models are either metered or outside their policy. Above about 3.3×, unlimited egress beats a 3× plan served directly from storage — or put a CDN with free storage egress in front of the 3× plan. Either way, request pricing becomes your next question.

What is your median object size? Under about 100 kB, minimum billable object size can outweigh everything else in the storage column and reorder the table. Above about 1 MB it is irrelevant. Check it rather than assume it: object counts are usually dominated by small objects even when bytes are not.

What does your application assume the API will do? If the answer includes versioning, object lock, object tags, bucket policies or prefix-level request scaling, the compatibility matrix — not the price — is your shortlist.

The three answers often point at two providers rather than one, and that is a useful outcome: an archive tier priced for low egress and a delivery tier priced for high egress can beat a single compromise on both lines.

Where INXY.hosting S3 storage fits

INXY.hosting S3-compatible object storage costs $9.99 per TB a month. Egress up to 3× your average stored data is included; above that it is $0.015/GB. Egress to our CDN partners CacheFly and Gcore is free and unlimited. There is no minimum billable object size, API requests are included, and you can pay in fiat or crypto.

On the egress-ratio curve, that fits most workloads up to about 3× — backups, archives, datasets and application storage — and, with delivery through CacheFly or Gcore, high-ratio media and download workloads where the storage-side egress line would otherwise dominate the bill.

If you want the arithmetic run against your own numbers, send us 90 days of stored volume, egress volume, object count and request counts. We will show you what the same workload costs on INXY.hosting S3-compatible object storage next to the published rates above — including the cases where another option fits better.

Related reading: 95th percentile vs metered bandwidth billing on when backup ingest is billable at all; GPU server hosting on why moving a training corpus is an egress event priced by the storage side; and the CDN migration playbook for the cutover sequence when delivery moves with the data.

FAQ

What is the cheapest alternative to Amazon S3?

It depends on your egress ratio. At 100 TB stored and 10 TB monthly egress, a 3×-included plan such as INXY.hosting S3 costs $999 a month and Cloudflare R2 $1,500. At 500 TB monthly egress served directly from storage, R2 stays at $1,500 while the 3× plan reaches $3,999 — unless delivery runs through a CDN partner with free storage egress. Hetzner’s list price is lower at both ratios but comes with 100 TB and 750 requests-per-second limits per bucket. Compute your own ratio first.

Does “no egress fees” mean unlimited downloads?

Not always. Wasabi’s policy covers egress up to your active storage volume and reserves the right to limit or suspend accounts that regularly exceed it. 3×-included plans such as INXY.hosting S3 meter egress above three times stored volume. Cloudflare R2 charges no egress at any volume but meters requests instead.

Is S3-compatible storage a drop-in replacement for S3?

Not without checking. Cloudflare R2 documents bucket versioning, object tagging, object lock, bucket policies and replication as not implemented, and every provider publishes its own list of gaps. List the S3 operations your application calls, then verify each one against the provider’s compatibility page.

Why is my object storage bill higher than the per-terabyte rate suggested?

Usually minimum billable object size or minimum storage duration. Storj bills at least 50 kB per object on its Regional tier and 100 kB on Active Archive, Hetzner 64 kB, Wasabi 4 KB — so 10 KB objects can bill as 5 to 10 times their real volume. Wasabi Pay as You Go also has a 90-day minimum storage duration, and Storj Active Archive a 30-day one.

Should we self-host object storage instead?

It can make sense for high-ratio workloads, but it is now a staffed option. MinIO’s community edition moved to maintenance mode in December 2025, so the assumptions behind the most common default have changed. Budget an owner, a patch process and a tested restore before comparing it on price.

How many object storage providers should we use?

Two is common and often cheaper than one. An archive tier priced for low egress and a delivery tier priced for high egress can beat a single compromise provider on both lines, provided the application can address two endpoints. The overhead is one more set of credentials and one more compatibility matrix.