The free tier does all of it. The DNS and SSL glossary entries describe what it holds; the public-presence leftovers (#500) are the redirects still to be set here.
Cloudflare
ServiceSprout
DNS, the edge, the certificate and the email routing for this site’s names — the public address arrives through it, and the domain redirects are a record plus a rule.
WebCLI