NextDNS-Config - Setup guide for NextDNS, a DoH proxy with advanced

项目说明

Guidelines :bookmark:

1) Prevent o by utilizing the [law of diminishing returns]() (e.g., using sane, quality blocklists; allowing most TLDs; etc.).
2) Pass the grandma test with few exceptions. These de are documented throughout the guide.

***

Create your account

Sign up for NextDNS here and support this page!

***

Security :police_officer:

Security settings protect your data from harm, theft, and unauthorized use.^{*^why does this matter?*}

Threat Intelligence Feeds ^¹

> [!CAUTION]
> Leave this feature enabled if you use something other than the recommended blocklists (see and ).

!Enabled Use Threat Intelligence Feeds

AI-Dri Detection ^¹

NextDNS labels this feature as beta, although most users report it works well.

!Disabled Enable AI-Dri Detection

Google Safe Browsing ^{^{1 2 3 4#serra)}}

> [!CAUTION]
> Google Safe Browsing wasn't designed as a DNS-le and may flag legitimate CNAME domains as scams. NextDNS can also take months to remove a false positive.

!Disabled Enable Google Safe Browsing

Cryptojacking Protection ^¹

> [!CAUTION]
> Leave this feature enabled if you use something other than the recommended blocklists (see ).

!Disabled Enable Cryptojacking Protection

DNS Rebinding Protection ^{^{1 2}}

!Enabled Enable DNS Rebinding Protection

IDN Homograph Attacks Protection ^{^{1 2}}

!Enabled Enable Homograph Attacks Protection

Typosquatting Protection ^¹

!Enabled Enable Typosquatting Protection

Domain Generation Algorithms (DGAs) Protection

!Enabled Enable DGA Protection

Block Newly Registered Domains (NRDs) ^¹

> [!WARNING]
> Blocking NRDs may cause false positives occasionally. Be selective when adding NRDs to your allowlist; and, if you do, NEVER give sensiti to a NRD. *If you plan to set-and-forget your configuration, disable this setting.*

!Enabled Block Newly Registered Domains (NRDs)

Block Dynamic DNS Hostnames ^{^{1 2}}

> [!TIP]
> Dynamic DNS (DDNS) services can still access their own website and update API when you use this setting.

!Enabled Enable Block Dynamic DNS Hostnames

Block Parked Domains ^¹

!Enabled Block Parked Domains

Block Top-Le (TLDs) ^{^{1 2 3 4 5}}

> [!IMPORTANT]
> Blocking TLDs risks blocking legitimate sites along with malicious ones, since this feature stops both site na and subrequests. However, the entries below should allow for e browsing while offering protection against commonly abused TLDs.

<details><summary>Click me to view TLDs</summary>

</details>

You can find additional entries on Most Abused TLDs, but you may need to allowlist sites on occasion. *If you plan to set-and-forget your configuration, skip this step.*

Block Child Sexual Abuse Material

!Enabled Block Child Sexual Abuse Material

***

Privacy :lock:

Privacy features limit the amount of data companies can collect about you.

Because privacy is a spectrum, what you need on your threat model, interest, and skillset.^{^*why should I care? I ha to hide*}

Blocklists ^¹

Blocklists filter out ads, trackers, and malicious sites. Hundreds of contribute to these lists in the open-source community, and they are the underco who make blocking ads at scale possible.

We recommend you remove the NextDNS Ads & Trackers Blocklist and add the minimum number of useful lists.

Which blocklist should I use?

A great question to ask is: "How much do I want to deal with the incon of false positives?"

Here are the suggested blocklists, based on past issues and obser:

| Blocklists | Rationale |
|:--------------------:|:--------------------------------------------------------------------------------------:|
| HaGeZi - <br>Multi NORMAL¹ <br>+ <br>OISD² | Block tracker, ad, and badware requests without issues (set-and-forget). |
| HaGeZi - <br>Multi PRO³ | Block more requests, usually without issues (recommended). |
| HaGeZi - <br>Multi PRO++⁴ | Block more requests at the risk of site breakage. <br> Report occasional site and app issues. |

> [!TIP]
> Use different blocklists on separate DNS profiles (e.g., NORMAL for your router and PRO++ for your web browser).

You can also check out Hagezi's own recommendations.

Why Hagezi?

Hagezi block ads, trackers, nati trackers, and badware. He maintains a sensible allowlist, handles false positi, and communicates known issues to blocklists maintainers. Hagezi builds his blocklists using many of the same original sources that feed into other popular lists like OISD and 1Hosts. He also adds his own unique sources, rather than just repackaging other combined blocklists.

You may also wonder why other lists are not utilized. This is because many list maintainers:
* do not remove false positives and/or are no longer active ^{1 2}
* already aggregate common blocklists into their own list (Easylist/Fanboy, AdGuard, Ste, etc.) ^{1 2 3 4}
* offer no meaningful additional co when compared with the chart combinations above

Nati Protection ^¹

> [!CAUTION]
> Leave this feature enabled if you use something other than the recommended blocklists (see ).

If you decide to use this feature, then add all the device brands that you use.

<details>

Windows
Apple
Samsung
Xiaomi
Huawei
Amazon Alexa
Roku
Sonos

</details>

Block Disguised Third-Party Trackers ^{^{1 2 3 4 5}}

!Disabled Block Disguised Third-Party Trackers

The domain list hasn't been updated in years, and it blocks some referral domains that Allow Affiliate & Tracking Links doesn't unblock. NextDNS blocks CNAME records by default, even with this list disabled.

Allow Affiliate & Tracking Links ^{^{1 2}}

> [!TIP]
> Your IP address will automatically be hidden (via TCP proxying) to preserve your privacy.<p>

> [!WARNING]
> Disabling this setting prevents some email links from opening properly.

!Enabled Allow Affiliate & Tracking Links

***

Parental Control :family_man_woman_boy:

YouTube Restricted Mode

!Disabled Enforce YouTube Restricted Mode

Block Bypass Methods ^¹

Block tools that can bypass NextDNS filtering, such as VPNs, proxies, Tor software, and encrypted DNS services.
> [!CAUTION]
> Enabling this setting causes unintended behavior.

!Disabled Block Bypass Methods

***

Denylist :no_entry:

Denylist entries are always blocked. These entries may further harden some profiles while not interfering with e browsing.

iCloud Private Relay

iCloud Private Relay can o DNS settings on devices, pre NextDNS from protecting them.

Some DoH pro block this feature automatically.

mask.icloud.com

> [!CAUTION]
> The domains below may prevent external images from loading in Apple mail clients. You don't need these unless you're running a very aggressi.

And possibly:

apple-relay.cloudflare.com
apple-relay.fastly-edge.com
doh.dns.apple.com
doh.dns.apple.com..com
mask-api.icloud.com
mask-h2.icloud.com
mask-canary.icloud.com
mask.apple-dns.net

***

Allowlist :white_check_mark:

Allowlist entries always resol entries may be needed for aggressive DNS profiles to relax their rules.

NextDNS

Allow NextDNS itself in case a filterlist goes haywire and blocks your access.

nextdns.io

<details><summary>Click here to view more entries</summary>

Facebook / Instagram ^¹

graph.facebook.com
graph.instagram.com
i.instagram.com
b-graph.facebook.com

If you're still having issues, try these:

connect.facebook.com
connect.facebook.net
graph-fallback.facebook.com
z-m-graph.facebook.com
graph-fallback.instagram.com

Apple device updates <sup><sup>1 2 3

A known tracking domain, but it's needed for device updates.

xp.apple.com

Apple iMessage GIFs ^¹ / Spotlight Search ^²

smoot.apple.com

Apple Store ^¹

amp-api-edge.apps.apple.com
amp-api-search-edge.apps.apple.com

Windows

This request is blocked when using NextDNS' Nati list (Windows)

settings-win.data.microsoft.com

Xbox achie

v10.events.data.microsoft.com
v20.events.data.microsoft.com

Xiaomi device updates

update.intl.miui.com

Xiaomi USB debugging (Security settings)

srv.sec.intl.miui.com

Google Nest usage metrics ^¹

logsink.devices.nest.com

Yahoo Mail ^¹

consent.yahoo.com
guce.oath.com
pr.comet.yahoo.com

Spectrum login ^¹

po.net

Zoom ^{^{1 2}}

logfiles.zoom.us
us04logfiles.zoom.us
us04zpns.zoom.us

YouTube history

s.youtube.com

Hulu ^¹

ads-fa-darwin.hulustream.com

Epic Games Launcher ^¹

eulatracking-public-ser.ol.epicgames.com

NVIDIA Gefore Experience ^¹

gfe.nvidia.com
n.cn

Chick-Fil-A App ^¹

tmetrix.my.chick-fil-a.com

imgur ^{^{1 2}}

js.media-lab.ai

CBS News li ^{^{1 2}}

doppler-config.cbsivideo.com
production-cmp.isgprivacy.cbsi.com
pubads.g.doubleclick.net
tags.tiqcdn.com

Paramount+

Paramount+ uses certain domains to display ads. These domains must be accessible to allow Paramount+ content to load (even for with ad-free plans).

:warning: However, because many sites use these domains for ads, allowing them could result in more ads being shown on other sites you visit.

imasdk.googleapis.com
pubads.g.doubleclick.net

Users have reported that the following domains also may need to be allowed:

cbsaavideo.com
cbsi.com
conviva.com
convivia.com
demdex.net
dns-clientinfo.cbsivideo.com
partnerad.l.doubleclick.net
saa.cbsi.com
summerhamster.com (yes, really)
udm.scorecardresearch.com

Fi / National Geographic website ^¹

dcf.espn.com

Men's Health ^¹

glimmer.hearstapps.com

</details>

***

Settings :gear:

Logs

Storage location → Switzerland

Block Page

> [!CAUTION]
> Enabling this setting may cause site na issues if the NextDNS Root CA is not on your devices. Also, this setting breaks Paypal 2FA, iCloud Private Relay, Microsoft Teams, Yahoo! Mail, the NAVER app, Hoyolab app, and possibly banking apps.

!Disabled Enable Block Page

Anonymized EDNS Client Subnet ^¹

!Enabled Enable Anonymized EDNS Client Subnet

Cache Boost ^¹

!Enabled Enable Cache Boost

CNAME Flattening ^{^{1 2 3}}

> [!WARNING]
> Enabling this feature may break compatibility with Yahoo! Mail and cause issues with certain blocklists.

!Disabled Enable CNAME Flattening

Bypass Age

!Enabled Bypass Age

Web3 ^{^{1 2}}

!Disabled Enable Web3
<p>
Lea unless you use crypto-related stuff.

***

FAQ :question:

How do I signup for NextDNS?

Click here to get started.

Why am I still seeing ads?

Not all ads can be blocked at the DNS level.^{1 2} You will need an ad blocker to block what's leftover.

This is because not all ads come from third-party domains; some ads come directly from the site you're , like YouTube. DNS blockers stop the resolution of a domain, and content blockers filter page content. Click here to easily install a lightweight ad blocker.

I need a browser with ad blocking. Which one should I choose?

Choosing a browser is about as intimate as choosing a starter Pokémon, so here's a few caveats:
* The best browser on paper may not work well in real world usage.
* Browsers are tools! Use a of browsers depending on what you need to do.
* You should use browsers (or browser profiles) for different areas of life (e.g., work, school, personal).

We based the recommendations below on a combination of effecti, resource efficiency, features, and ease of use.

| OS | Browser | Content Blocker |
|---|---|---|
| iOS | Safari | wBlock, uBlock Origin Lite, or AdGuard |
| Android | Brave | Built-in blocker |
| Windows <br> macOS <br> Linux | Firefox (with Betterfox) <p><p> Brave <p><p> Helium | uBlock Origin <p><p> Built-in blocker or uBlock Origin | |

At the end of the day, if you're using NextDNS + any browser with an ad blocker, you have more co than most people.

Should I pay for NextDNS?

For the rich features it provides, NextDNS is very affordable at $19.90/year for unlimited devices. NextDNS pays for itself if it saves my family from a malicious incident.

Does the amount of features enabled affect the speed of NextDNS?^{1 2}

The number of settings you toggle on will not affect your DNS latency.

Do I need to set DoH at browser-level if I already use NextDNS at system-level?

Unless you use a separate profile for the browser, it is not neccessary. However, I recommend setting it in your web browser anyway.

I have a router profile and a device profile. Which one does my device use?

The device will use the profile set by the NextDNS app or the installed root CA. However, if the device has not been configured to use a separate profile, then it will use the wifi/router configuration.¹

What is the difference between security, privacy, and anonymity?

See article | video

Does NextDNS hide activity from my Internet Service Provider (ISP)?

Encrypted DNS queries boost privacy and security. This encryption stops your ISP from seeing what websites you search for and visit.

However, encrypted DNS does not hide website IP addresses from your ISP. While your ISP cannot see the specific domain you want to access, they can see that you contact DNS servers like Cloudflare or AWS. If you repeatedly send data to a certain IP address, your ISP can guess you are a website at that address.

Do I need a VPN?

IVPN argues you only need a VPN for three reasons. Mainly, in order to:

1. Hide your real IP address from websites and peer-to-peer networks, which prevents ISPs and mobile carriers from tracking your online activity.

2. Guard against man in the middle and other common attacks) on public Wi-Fi networks in places like airports, hotels, cafes, and libraries.

3. Bypass censorship or geographic restrictions, allowing you to access blocked websites and content.

Ultimately, you don't need a your threat model demands it. Here are from Techlore and Tom Spark Reviews if it does.

***

Mentions :books:

User Comments

* See here

YouTube

* The ULTIMATE Guide to Mastering NextDNS! | clarifications (July 2023)

Articles

* Knot Resolver — with ad blocking (Dec 2022)
* Privacy Toolkit: NextDNS (Sept 2022)

Guides

* A comprehensi to setting up NextDNS (Sept 2023)
* FMHY: DNS Adblocking → NextDNS → Guide
* hagezi/dns-blocklists → Online DNS Services

Contributions

* Hagezi | mentions
* 1Hosts
* Easylist
* uBlock Origin
* AdGuard

项目信息

开发语言：未知

Star 数：3176

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Setup guide for NextDNS, a DoH proxy with advanced capabilities展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。