# Limits and plans

> OpenWAF is free during early access. These are the limits that apply to every organization, domain, record, token and sign-in.

## Plans

OpenWAF is **free during early access**, with every feature included and up to 100 domains per organization by default.
There are no request quotas and no overage charges; use must follow the
[Acceptable use policy](https://openwaf.dev/legal/acceptable-use/).

- Paid plans will come later; prices are not set yet. We will email you at least 30 days before any paid plan applies
  to your account, and nothing is charged without your agreement.
- Early access has no service-level agreement (SLA).
- Need more domains? Write to [support@openwaf.dev](mailto:support@openwaf.dev).

See [Pricing](https://openwaf.dev/pricing/) for the current terms.

## Organizations and domains

| Limit | Value |
|---|---|
| Domains (zones) per organization | 100 by default; more on request. Beyond it: `403 zone_limit` |
| Domains per bulk upload | 1,000; public records are imported automatically for uploads of up to 50 |
| Pending domain never delegated or verified | Deleted automatically 14 days after it was added |
| Delegated domain whose nameservers moved away | Disabled after 7 days in **Moved away** |
| Names with their own settings, per zone | 100 |
| Merged zone kept read-only (undo possible) | 14 days |
| Security events retention | 30 days |

## DNS records

| Limit | Value |
|---|---|
| TTL | 60 to 86,400 seconds; 3,600 when not set |
| TXT content | 4,096 bytes |
| Record comment | 100 characters |
| Record tags | 10 per record, 1–32 characters each (`a-z`, `0-9`, `:`, `_`, `-`) |
| Operations per record batch | 500 |
| Records per bulk create request | 1,000 |
| BIND zone file import | 1 MiB |

See [Record types and validation](https://developers.openwaf.dev/dns/record-types/).

## Changes and API

| Limit | Value |
|---|---|
| Change reason | 1–500 characters, required on every configuration change |
| Request body | 1 MiB |
| Audit log page | 100 entries by default, up to 500 |

## Accounts, sessions and tokens

| Limit | Value |
|---|---|
| Sign-in code | 6 digits, valid 15 minutes, 5 attempts |
| Sign-in codes requested | 5 per hour per email address, 20 per hour per IP address |
| Sign-ups | 5 per day per IP address |
| Dashboard session | 30 days, or 7 days without activity |
| Invitation | Valid 7 days |
| API token expiry | 1–365 days; 90 by default |
| API token name | 200 characters |

## White label and clients

| Limit | Value |
|---|---|
| Brand display name | 100 characters |
| Logo | SVG or PNG, 256 KB; PNG up to 4096×4096 pixels |
| Client name | 200 characters, unique in the organization |
| Client note | 2,000 characters |
| Own nameservers after you stop using them | Reserved for your organization for 30 days |

Limits of other products (WAF rules, rate limits, cache, analytics) are listed on each product's pages.