1) Prevent overblocking by utilizing the [law of diminishing returns]() (e.g., using sane, quality blocklists; allowing most TLDs; etc.). 2) Pass the girlfriend test with few exceptions. These deviations are documented throughout the guide.
Sign up for NextDNS here and support this page!
Security settings protect your data from harm, theft, and unauthorized use.^why does this matter?
Use Threat Intelligence Feeds
[!NOTE] NextDNS labels this feature as beta, although most users report it works well.
Enable AI-Driven Threat Detection
[!TIP] Unlike the version embedded in some browsers, this feature does not associate your public IP address to threats and does not allow bypassing the block.
Enable Google Safe Browsing
[!CAUTION] Leave this feature enabled if you use something other than the recommended blocklists (see https://github.com/yokoffing/NextDNS-Config/issues/31).
![Disabled]() Enable Cryptojacking Protection
Enable DNS Rebinding Protection
![Enabled]() Enable Homograph Attacks Protection
Enable Typosquatting Protection
Enable DGA Protection
[!WARNING] Blocking NRDs may cause false positives occasionally. Be selective when adding NRDs to your allowlist; and, if you do, NEVER give sensitive information to a NRD. If you plan to set-and-forget your configuration, disable this setting.
Block Newly Registered Domains (NRDs)
[!TIP] Dynamic DNS (DDNS) services can still access their own website and update API when you use this setting.
Enable Block Dynamic DNS Hostnames
Block Parked Domains
Updated: 18 March 2024
[!IMPORTANT] Blocking TLDs risks blocking legitimate sites along with malicious ones, since this feature stops both site navigations and subrequests. However, the entries below should allow for everyday browsing while offering protection against commonly abused TLDs.
You can find additional entries on Most Abused TLDs, but you may need to allowlist sites on occasion. If you plan to set-and-forget your configuration, skip this step.
Block Child Sexual Abuse Material
Privacy features limit the amount of data companies can collect about you.
Because privacy is a spectrum, what you need varies on your threat model, interest, and skillset.^why should I care? I have nothing to hide
Blocklists filter out ads, trackers, and malicious sites. Hundreds of volunteers contribute to these lists in the open-source community, and they are the undercover heroes who make blocking ads at scale possible.
We recommend you remove the NextDNS Ads & Trackers Blocklist and add the minimum number of useful lists.
A great question to ask is: "How much do I want to deal with the inconveniences of false positives?"
Here are the suggested blocklists, based on past issues and observations:
Blocklists | Rationale |
---|---|
HaGeZi - Multi NORMAL1 OISD |
Block tracker, ad, and badware requests without issues (set-and-forget). |
HaGeZi - Multi PRO2 OISD |
Block more requests, usually without issues (recommended). |
HaGeZi - Multi PRO++3 OISD |
Block more requests at the risk of site breakage. Report occasional site and app issues. |
[!TIP] Use different blocklists on separate DNS profiles (e.g., NORMAL for your router and PRO++ for your web browser).
[!NOTE] NextDNS does not offer Hagezi's Threat Intelligence Feed (TIF). We suggest using the OISD list, which contains some TIF sources missing from NextDNS security features.
You can also check out Hagezi's own recommendations.
Hagezi block ads, trackers, native device trackers, and badware. He maintains a sensible allowlist, handles false positives quickly, and communicates known issues to blocklists maintainers. Hagezi's primary DNS lists combine multiple sources including respected community blocklists like OISD, Steven Black, 1Hosts, notrack, and more.
You may also wonder why other lists are not utilized. This is because many list maintainers:
Add all the device brands you use.
![Enabled]() Block Disguised Third-Party Trackers
[!TIP] Your IP address will automatically be hidden (via TCP proxying) to preserve your privacy.
[!WARNING] Disabling this setting prevents some email links from opening properly.
Allow Affiliate & Tracking Links
Enforce YouTube Restricted Mode
Block tools that can bypass NextDNS filtering, such as VPNs, proxies, Tor software, and encrypted DNS services.
[!CAUTION] Enabling this setting causes unintended behavior.
Block Bypass Methods
Denylist entries are always blocked. These entries may further harden some profiles while not interfering with everyday browsing.
iCloud Private Relay can override DNS settings on devices, preventing NextDNS from protecting them.
Some DoH providers block this feature automatically.
mask.icloud.com
mask-h2.icloud.com
And possibly:
apple-relay.cloudfare.com
apple-relay.fastly-edge.com
doh.dns.apple.com
doh.dns.apple.com.v.aaplimg.com
Allowlist entries always resolve. These entries may be needed for aggressive DNS profiles to relax their rules.
Allow NextDNS itself in case a filterlist goes haywire and blocks your access.
nextdns.io
Storage location → Switzerland
[!CAUTION] Enabling this setting may cause site navigation issues if the NextDNS Root CA is not on your devices. Also, this setting breaks Paypal 2FA, iCloud Private Relay, Microsoft Teams, Yahoo! Mail, the NAVER app, Hoyolab app, and possibly banking apps.
Enable Block Page
Enable Anonymized EDNS Client Subnet
Enable Cache Boost
[!WARNING] Enabling this feature may break compatibility with Yahoo! Mail and cause issues with certain blocklists.
Enable CNAME Flattening
Enable Web3 → (optional)
Click here to get started.
Not all ads can be blocked at the DNS level.1 2 You will need an ad blocker to block what's leftover.
This is because not all ads come from third-party domains; some ads come directly from the site you're visiting, like YouTube. DNS blockers stop the resolution of a domain, and content blockers filter page content. Click here to easily install a lightweight ad blocker.
Choosing a browser is about as intimate as choosing a starter Pokémon, so here's a few caveats:
We based the recommendations below on a combination of effectiveness, resource efficiency, features, and ease of use.
OS | Browser | Content Blocker | |
---|---|---|---|
iOS | Safari | AdGuard | |
Android | Brave | Built-in blocker | |
Windows macOS Linux |
Firefox (with Betterfox) | uBlock Origin Built-in blocker or uBlock Origin |
At the end of the day, if you're using NextDNS + any browser with an ad blocker, you have more coverage than most people.
For the rich features it provides, NextDNS is very affordable at $19.90/year for unlimited devices. NextDNS pays for itself if it saves my family from a malicious incident.
The number of settings you toggle on will not affect your DNS latency.
Unless you use a separate profile for the browser, it is not neccessary. However, I recommend setting it in your web browser anyway.
The device will use the profile set by the NextDNS app or the installed root CA. However, if the device has not been configured to use a separate profile, then it will use the wifi/router configuration.1
Encrypted DNS queries boost privacy and security. This encryption stops your ISP from seeing what websites you search for and visit.
However, encrypted DNS does not hide website IP addresses from your ISP. While your ISP cannot see the specific domain you want to access, they can see that you contact DNS servers like Cloudflare or AWS. If you repeatedly send data to a certain IP address, your ISP can guess you are visiting a website at that address.
IVPN argues you only need a VPN for three reasons. Mainly, in order to:
Hide your real IP address from websites and peer-to-peer networks, which prevents ISPs and mobile carriers from tracking your online activity.
Guard against man in the middle and other common attacks on public Wi-Fi networks in places like airports, hotels, cafes, and libraries.
Bypass censorship or geographic restrictions, allowing you to access blocked websites and content.
Ultimately, you don't need a VPN unless your threat model demands it. Here are VPN suggestions from Techlore and Tom Spark Reviews if it does.