diff --git a/.changeset/fix-dns-report-plan-compatibility.md b/.changeset/fix-dns-report-plan-compatibility.md
new file mode 100644
index 00000000..c1bd1c8a
--- /dev/null
+++ b/.changeset/fix-dns-report-plan-compatibility.md
@@ -0,0 +1,14 @@
+---
+'dns-analytics': patch
+---
+
+Fix `dns_report` tool failing with 403 on Free and Pro plan zones
+
+The tool hardcoded `responseCached` in the dimensions list, which is gated to Business plan and above. Free and Pro accounts received:
+
+```
+"Response Cached is not available for your plan.
+ Upgrade to the business plan to see DNS analytics by responseCached."
+```
+
+Removing `responseCached` from the default dimensions restores functionality for Free and Pro zones while keeping `responseCode` breakdown available to all plans. Business/Enterprise users who want `responseCached` analytics can query via the `cf-graphql` MCP server's `dnsAnalyticsAdaptiveGroups` dataset.
diff --git a/apps/dns-analytics/src/tools/dex-analytics.tools.ts b/apps/dns-analytics/src/tools/dex-analytics.tools.ts
index 0949fb13..af7ce22a 100644
--- a/apps/dns-analytics/src/tools/dex-analytics.tools.ts
+++ b/apps/dns-analytics/src/tools/dex-analytics.tools.ts
@@ -31,7 +31,7 @@ export function registerAnalyticTools(agent: DNSAnalyticsMCP) {
 				const params: ReportGetParams = {
 					zone_id: zone,
 					metrics: 'responseTimeAvg,queryCount,uncachedCount,staleCount',
-					dimensions: 'responseCode,responseCached',
+					dimensions: 'responseCode',
 					since: start_date,
 				}
 				const result = await client.dns.analytics.reports.get(params)