- Prevent overblocking by utilizing the law of diminishing returns (e.g., using sane, quality blocklists; allowing most TLDs; etc.).
- Pass the girlfriend test with few exceptions. These deviations are documented throughout the guide.
Sign up for NextDNS here and support this page!
Security settings protect your data from harm, theft, and unauthorized use.^why does this matter?
Threat Intelligence Feeds 1
AI-Driven Threat Detection 1
Note
NextDNS labels this feature as beta, although most users report it works well.
Enable AI-Driven Threat Detection
Tip
Unlike the version embedded in some browsers, this feature does not associate your public IP address to threats and does not allow bypassing the block.
Cryptojacking Protection 1
Caution
Leave this feature enabled if you use something other than the recommended blocklists (see #31).
Enable Cryptojacking Protection
Enable DNS Rebinding Protection
Enable Homograph Attacks Protection
Typosquatting Protection 1
Enable Typosquatting Protection
Block Newly Registered Domains (NRDs) 1
Warning
Blocking NRDs may cause false positives occasionally. Be selective when adding NRDs to your allowlist; and, if you do, NEVER give sensitive information to a NRD. If you plan to set-and-forget your configuration, disable this setting.
Block Newly Registered Domains (NRDs)
Tip
Dynamic DNS (DDNS) services can still access their own website and update API when you use this setting.
Enable Block Dynamic DNS Hostnames
Block Parked Domains 1
Updated: 18 March 2024
Important
Blocking TLDs risks blocking legitimate sites along with malicious ones, since this feature stops both site navigations and subrequests. However, the entries below should allow for everyday browsing while offering protection against commonly abused TLDs.
Click me to view TLDs
.autos
.best
.bid
.bio
.boats
.boston
.boutique
.charity
.christmas
.dance
.fishing
.hair
.haus
.loan
.loans
.men
.mom
.name
.review
.rip
.skin
.support
.tattoo
.tokyo
.voto
You can find additional entries on Most Abused TLDs, but you may need to allowlist sites on occasion. If you plan to set-and-forget your configuration, skip this step.
Block Child Sexual Abuse Material
Privacy features limit the amount of data companies can collect about you.
Because privacy is a spectrum, what you need varies on your threat model, interest, and skillset.^why should I care? I have nothing to hide
Blocklists 1
Blocklists filter out ads, trackers, and malicious sites. Hundreds of volunteers contribute to these lists in the open-source community, and they are the undercover heroes who make blocking ads at scale possible.
We recommend you remove the NextDNS Ads & Trackers Blocklist and add the minimum number of useful lists.
A great question to ask is: "How much do I want to deal with the inconveniences of false positives?"
Here are the suggested blocklists, based on past issues and observations:
Blocklist | Rationale |
---|---|
HaGeZi - Multi NORMAL1 | Block tracker, ad, and badware requests without issues (set-and-forget). |
HaGeZi - Multi PRO2 | Block more requests, usually without issues (recommended). |
HaGeZi - Multi PRO++3 | Block more requests at the risk of site breakage. Report occasional site and app issues. |
Tip
Use different blocklists on separate DNS profiles (e.g., NORMAL for your router and PRO++ for your web browser).
You can also check out Hagezi's own recommendations.
Hagezi block ads, trackers, native device trackers, and badware. He maintains a sensible allowlist, handles false positives quickly, and communicates known issues to blocklists maintainers. Hagezi's primary DNS lists combine multiple sources including respected community blocklists like OISD, Steven Black, 1Hosts, notrack, and more.
You may also wonder why other lists are not utilized. This is because many list maintainers:
- do not remove false positives and/or are no longer active 1 2
- already aggregate common blocklists into their own list (Easylist/Fanboy, AdGuard, Steven Black, etc.) 1 2 3 4
- offer no meaningful additional coverage when compared with the chart combinations above
Native Tracking Protection 1
Add all the device brands you use.
Windows
Apple
Samsung
Xiaomi
Huawei
Amazon Alexa
Roku
Sonos
Block Disguised Third-Party Trackers
Warning
Disabling this setting causes prevent site navgiation when opening some email links.
Allow Affiliate & Tracking Links
Enforce YouTube Restricted Mode
Block Bypass Methods 1
Caution
Enabling this setting causes unintended behavior.
Denylist entries are always blocked. The entries below may further harden some profiles while not interfering with everyday browsing.
Not currently in NextDNS's Native Tracking Protection list: 1
xp.apple.com (unblock for device updates!)
acfeedbackws.icloud.com
api-adservices.apple.com
feedbackws.fe.apple-dns.net
feedbackws.icloud.com
iadsdk.apple.com
notes-analytics-events.apple.com
notes-analytics-events.news.apple-dns.net
weather-analytics-events.apple.com
weather-analytics-events.news.apple-dns.net
syndication.twitter.com
NVIDIA Gefore Experience 1
events.gfe.nvidia.com
Allowlist entries always resolve. These entries may be needed for aggressive DNS profiles to relax their rules.
Just in case a filterlist goes haywire and blocks your access
nextdns.io
Facebook / Instagram 1
graph.facebook.com
graph.instagram.com
i.instagram.com
b-graph.facebook.com
If you're still having issues, try these:
connect.facebook.com
connect.facebook.net
graph-fallback.facebook.com
z-m-graph.facebook.com
graph-fallback.instagram.com
A known tracking domain, but it's needed for device updates
xp.apple.com
smoot.apple.com
Apple Store 1
amp-api-edge.apps.apple.com
amp-api-search-edge.apps.apple.com
This request is blocked when using NextDNS' Native Tracking list (Windows)
settings-win.data.microsoft.com
Xiaomi device updates 1
update.intl.miui.com
srv.sec.intl.miui.com
Google Nest usage metrics 1
logsink.devices.nest.com
Yahoo Mail 1
consent.yahoo.com
guce.oath.com
pr.comet.yahoo.com
pov.spectrum.net
logfiles.zoom.us
us04logfiles.zoom.us
us04zpns.zoom.us
YouTube history 1
s.youtube.com
Hulu 1
ads-fa-darwin.hulustream.com
Epic Games Launcher 1
eulatracking-public-service-prod06.ol.epicgames.com
NVIDIA Gefore Experience 1
gfe.nvidia.com
nvgs.nvidia.cn
Chick-Fil-A App 1
tmetrix.my.chick-fil-a.com
js.media-lab.ai
doppler-config.cbsivideo.com
production-cmp.isgprivacy.cbsi.com
pubads.g.doubleclick.net
tags.tiqcdn.com
Paramount+ uses certain domains to display ads. These domains must be accessible to allow Paramount+ content to load (even for viewers with ad-free plans).
imasdk.googleapis.com
pubads.g.doubleclick.net
Users have reported that the following domains also may need to be allowed:
cbsaavideo.com
cbsi.com
conviva.com
convivia.com
demdex.net
dns-clientinfo.cbsivideo.com
partnerad.l.doubleclick.net
saa.cbsi.com
summerhamster.com (yes, really)
udm.scorecardresearch.com
FiveThirtyEight videos / National Geographic website 1
dcf.espn.com
Men's Health videos 1
glimmer.hearstapps.com
Storage location → Switzerland
Caution
Enabling this setting may cause site navigation issues if the NextDNS Root CA is not on your devices. Also, this setting breaks Paypal 2FA, iCloud Private Relay, Microsoft Teams, Yahoo! Mail, the NAVER app, Hoyolab app, and possibly banking apps.
Anonymized EDNS Client Subnet 1
Enable Anonymized EDNS Client Subnet
Cache Boost 1
Warning
Enabling this feature may break compatibility with Yahoo! Mail and cause issues with certain blocklists.
Click here to get started.
Not all ads can be blocked at the DNS level.1 2 You will need an ad blocker to block what's leftover.
This is because not all ads come from third-party domains; some ads come directly from the site you're visiting, like YouTube. DNS blockers stop the resolution of a domain, and content blockers filter page content. Click here to easily install a lightweight ad blocker.
Choosing a browser is about as intimate as choosing a starter Pokémon, so here's a few caveats:
- The best browser on paper may not work well in real world usage.
- Browsers are tools! Use a variety of browsers depending on what you need to do.
- You should use various browsers (or browser profiles) for different areas of life (e.g., work, school, personal).
We based the recommendations below on a combination of effectiveness, resource efficiency, features, and ease of use.
OS | Browser | Content Blocker |
---|---|---|
iOS | Safari | AdGuard |
Android | Brave | Built-in blocker |
Windows macOS Linux |
Firefox (with Betterfox) | uBlock Origin Built-in blocker or uBlock Origin |
At the end of the day, if you're using NextDNS + any browser with an ad blocker, you have more coverage than most people.
For the rich features it provides, NextDNS is very affordable at $19.90/year for unlimited devices. NextDNS pays for itself if it saves my family from a malicious incident.
The number of settings you toggle on will not affect your DNS latency.
Unless you use a separate profile for the browser, it is not neccessary. However, I recommend setting it in your web browser anyway.
The device will use the profile set by the NextDNS app or the installed root CA. However, if the device has not been configured to use a separate profile, then it will use the wifi/router configuration.1
DNS protocols like DoH/DoT/DoQ are designed to increase privacy and security by encrypting DNS queries. They prevent your ISP from seeing your web searches and browsing history, which significantly contributes to protecting your privacy.
However, encrypted DNS does not hide the IP addresses of the websites you visit from your ISP. So while they cannot see the content of the encrypted DNS query (i.e., your ISP can't see what specific domain you're trying to access), they can see that you're making a request to a particular DNS server like Cloudflare or AWS. And if you're constantly sending packets to a particular IP address, it's likely that you're visiting a website hosted at that address.
That being said, IVPN argues that you only need a VPN for three reasons:
-
Maintaining control over your privacy by hiding your real IP address from websites and peer-to-peer nodes, preventing ISPs and mobile network operators from tracking the domains and IPs you visit.
-
Protecting your connection from man in the middle and other common attacks on untrusted networks, such as Wi-Fi in airports, hotels, cafes, and libraries.
-
Circumventing censorship or geographical blocks on websites and content, allowing you to retrieve otherwise inaccessible information and media.
You don't need a VPN unless your threat model demands it. Here are VPN suggestions from Techlore and Tom Spark Reviews if it does.
- See here
- The ULTIMATE Guide to Mastering NextDNS! | clarifications (July 2023)
- Knot Resolver — with ad blocking (Dec 2022)
- Privacy Toolkit: NextDNS (Sept 2022)
- A comprehensive guide to setting up NextDNS (Sept 2023)
- FMHY: DNS Adblocking → NextDNS → Guide
- hagezi/dns-blocklists → Online DNS services