Compare commits

...

30 Commits

Author SHA1 Message Date
Leonardo Canessa
3027bc2f3a Hagezi only partially includes Steven Black's list (#87) 2025-10-22 20:47:39 -04:00
yokoffing
1a1247b10b wording
https://github.com/yokoffing/NextDNS-Config/issues/83
2025-08-27 12:59:58 -04:00
yokoffing
746a0a0fcc Bypass Age Verification 2025-08-18 00:35:09 -04:00
Cooper Hanessian
f8415b1406 Add warnings to iCloud relay blocking that it may break mail images (#78) (#80) 2025-06-16 16:52:39 -04:00
Perry Lee
68355457a2 Fix link to HaGeZi's recommendations (#79) 2025-06-16 16:48:37 -04:00
yokoffing
0fff653ffa Native Tracking Protection
https://github.com/yokoffing/NextDNS-Config/issues/76
2025-03-30 15:32:15 -04:00
yokoffing
84330e1416 security features disclaimers
https://github.com/yokoffing/NextDNS-Config/issues/74
2025-03-29 13:24:00 -04:00
yokoffing
1427a81f2f Disable Block Disguised Third-Party Trackers
https://github.com/yokoffing/NextDNS-Config/issues/75
2025-03-29 13:07:11 -04:00
yokoffing
ea8188a1f4 further remove OISD 2025-03-17 16:21:35 -04:00
yokoffing
a27da3a668 remove OISD from two tiers 2025-02-28 15:16:30 -05:00
yokoffing
4b8ca071bf remove TLD .bio
https://github.com/yokoffing/NextDNS-Config/issues/71
2024-11-20 07:49:08 -05:00
yokoffing
96b226597f fix hit counter 2024-11-04 16:30:46 -05:00
yokoffing
423801397b apple relay
https://github.com/yokoffing/NextDNS-Config/issues/70
2024-11-04 16:30:08 -05:00
Mike L.
bce21834ad Another iCloud Private Relay server (#67) 2024-09-30 21:51:23 -04:00
iam-py-test
82f7148bc9 Fix https://github.com/yokoffing/NextDNS-Config/issues/68 (#69) 2024-09-30 21:50:28 -04:00
yokoffing
99ad8b186a small format fix 2024-08-29 13:11:09 -04:00
pgbs
9ced7ba27a Possible Fastly-based Apple Relay server (#65) 2024-08-29 13:09:08 -04:00
yokoffing
ced56ff270 Typo 2024-08-11 20:19:53 -04:00
yokoffing
895e783fdd a word 2024-07-26 14:59:01 -04:00
yokoffing
31f07977b3 yet another icloud relay domain 2024-07-17 10:00:09 -04:00
yokoffing
8223aa9a9e add more private relay domains 2024-07-16 14:26:36 -04:00
Mike L
5c1369de6b Add secondary iCloud Private Relay server to denylist (#64) 2024-07-10 00:28:57 -04:00
yokoffing
6fa3329df7 spacing 2024-06-29 12:31:02 -04:00
yokoffing
b6e8daba66 fix spacing 2024-06-29 12:27:26 -04:00
yokoffing
150cb097ee add OISD to recommendations 2024-06-29 12:26:21 -04:00
yokoffing
f84eeab0d4 further edit VPN FAQ 2024-06-29 12:14:03 -04:00
yokoffing
4baa33770c remove unused text 2024-06-29 12:12:34 -04:00
yokoffing
a80252cf12 cleanup denylist and VPN FAQ 2024-06-29 12:10:45 -04:00
yokoffing
cf2cb31e06 Block access to iCloud Private Relay 2024-06-29 11:51:01 -04:00
yokoffing
c5672fedc8 xbox achievements
https://github.com/yokoffing/NextDNS-Config/issues/62
2024-06-29 11:38:41 -04:00

133
README.md
View File

@@ -1,14 +1,5 @@
[![GitHub issues](https://img.shields.io/github/issues/yokoffing/NextDNS-Config)](https://github.com/yokoffing/NextDNS-Config/issues)
![GitHub](https://img.shields.io/github/license/yokoffing/NextDNS-Config?color=blue)
![GitHub Maintained](https://img.shields.io/badge/Open%20Source-Yes-green)
![GitHub commit activity](https://img.shields.io/github/commit-activity/y/yokoffing/NextDNS-Config)
![GitHub last commit](https://img.shields.io/github/last-commit/yokoffing/NextDNS-Config)
![GitHub Maintained](https://img.shields.io/badge/maintained-yes-green)
[![Hits](https://hits.seeyoufarm.com/api/count/incr/badge.svg?url=https%3A%2F%2Fgithub.com%2Fyokoffing%2FNextDNS-Config&count_bg=%2379C83D&title_bg=%23555555&icon=&icon_color=%23E7E7E7&title=hits&edge_flat=false)](https://hits.seeyoufarm.com)
***
# Guidelines :bookmark:
1) Prevent overblocking by utilizing the [law of diminishing returns](https://web.archive.org/web/20231108092752if_/https://pmctraining.com/site/wp-content/uploads/2018/04/Law-of-Diminishing-Returns-CHART.png) (e.g., using [sane](https://www.privacyguides.org/en/basics/threat-modeling/), quality [blocklists](https://github.com/yokoffing/NextDNS-Config#blocklists-1); allowing most [TLDs](https://github.com/yokoffing/NextDNS-Config#block-top-level-domains-tlds-1-2-3-4-5-); etc.).
1) Prevent overblocking by utilizing the [law of diminishing returns]() (e.g., using [sane](https://www.privacyguides.org/en/basics/threat-modeling/), quality [blocklists](https://github.com/yokoffing/NextDNS-Config#blocklists-1); allowing most [TLDs](https://github.com/yokoffing/NextDNS-Config#block-top-level-domains-tlds-1-2-3-4-5-); etc.).
2) Pass the [girlfriend test](https://www.urbandictionary.com/define.php?term=Grandma%20Test) with few exceptions. These deviations are documented throughout the guide.
***
@@ -24,18 +15,22 @@ Sign up for NextDNS [here](https://nextdns.io/?from=xujj63g5) and support this p
Security settings protect your data from harm, theft, and unauthorized use.<sup>*^[why does this matter?](https://thenewoil.org/en/guides/prologue/why)*</sup>
## Threat Intelligence Feeds <sup><sup>[1](https://github.com/nextdns/metadata/blob/6f9b6cd0670e7e31ad2ca716742088c2fc0616c2/security/threat-intelligence-feeds.json)</sup></sup>
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Use Threat Intelligence Feeds
## AI-Driven Threat Detection <sup><sup>[1](https://x.com/NextDNS/status/1440291577713233925)</sup></sup>
> [!NOTE]
> NextDNS labels this feature as [beta](https://www.vocabulary.com/dictionary/beta), although most users report it works well.
> [!CAUTION]
> Leave this feature enabled if you use something other than the [recommended blocklists](https://github.com/yokoffing/NextDNS-Config#privacy-lock) (see https://github.com/yokoffing/NextDNS-Config/issues/74).
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Enable AI-Driven Threat Detection
![Disabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/disabled.svg) Use Threat Intelligence Feeds
## AI-Driven Threat Detection <sup><sup>[1](https://x.com/NextDNS/status/1440291577713233925)</sup></sup>
NextDNS labels this feature as [beta](https://www.vocabulary.com/dictionary/beta), although most users report it works well.
![Disabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/disabled.svg) Enable AI-Driven Threat Detection
## Google Safe Browsing <sup><sup> [1](https://safebrowsing.google.com/safebrowsing/report_general/) [2](https://blog.cryptographyengineering.com/2019/10/13/dear-apple-safe-browsing-might-not-be-that-safe/) [3](https://the8-bit.com/apple-proxies-google-safe-browsing-privacy/) [4](https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)#services-we-proxy-through-brave-servers) </sup></sup>
> [!TIP]
> Unlike the version embedded in some browsers, this feature does not associate your public IP address to threats and does not allow bypassing the block.
> [!CAUTION]
> Google Safe Browsing wasn't designed as a DNS-level blocker and may flag legitimate [CNAME domains](https://en.wikipedia.org/wiki/CNAME_record) as scams. NextDNS can also take months to remove a [false positive](https://csrc.nist.gov/glossary/term/false_positive).
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Enable Google Safe Browsing
![Disabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/disabled.svg) Enable Google Safe Browsing
## Cryptojacking Protection <sup><sup>[1](https://github.com/nextdns/metadata/blob/6f9b6cd0670e7e31ad2ca716742088c2fc0616c2/security/cryptojacking.json)</sup></sup>
> [!CAUTION]
@@ -45,8 +40,10 @@ Security settings protect your data from harm, theft, and unauthorized use.<sup>
## DNS Rebinding Protection <sup><sup>[1](https://help.nextdns.io/t/35hmval/what-is-dns-rebinding-protection) [2](https://www.reddit.com/r/nextdns/comments/t0ne8r/does_dns_rebinding_protection_block_remote_access/?context=3)</sup></sup>
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Enable DNS Rebinding Protection
## IDN Homograph Attacks Protection <sup><sup>[1](https://web.archive.org/web/20230325073817/https://blog.riotsecurityteam.com/idn-homograph-attacksprevention) [2](https://akamai.com/blog/security/watch-your-step-the-prevalence-of-idn-homograph-attacks)</sup></sup>
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Enable Homograph Attacks Protection
## Typosquatting Protection <sup><sup>[1](https://github.com/nextdns/metadata/blob/6f9b6cd0670e7e31ad2ca716742088c2fc0616c2/security/typosquatting/protected-domains)</sup></sup>
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Enable Typosquatting Protection
## Domain Generation Algorithms (DGAs) Protection
@@ -66,7 +63,6 @@ Security settings protect your data from harm, theft, and unauthorized use.<sup>
## Block Parked Domains <sup><sup>[1](https://github.com/nextdns/metadata/blob/6f9b6cd0670e7e31ad2ca716742088c2fc0616c2/security/parked-domains-cname)</sup></sup>
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Block Parked Domains
## Block Top-Level Domains (TLDs) <sup><sup>[1](https://webtribunal.net/blog/tld-statistics/) [2](https://www.spamhaus.org/reputation-statistics/cctlds/domains/) [3](https://bleepingcomputer.com/news/security/verified-twitter-accounts-hacked-to-send-fake-suspension-notices/) [4](https://github.com/DandelionSprout/adfilt/blob/master/Dandelion%20Sprout's%20Anti-Malware%20List.txt) [5](https://github.com/DandelionSprout/adfilt/issues/659#issuecomment-1284845803) </sup></sup>
*Updated: 18 March 2024* <p>
> [!IMPORTANT]
> Blocking [TLDs](https://www.geeksforgeeks.org/components-of-a-url) risks blocking legitimate sites along with malicious ones, since this feature stops both site navigations and subrequests. However, the entries below should allow for everyday browsing while offering protection against commonly abused TLDs.
@@ -77,7 +73,6 @@ Security settings protect your data from harm, theft, and unauthorized use.<sup>
.autos
.best
.bid
.bio
.boats
.boston
.boutique
@@ -125,21 +120,21 @@ We recommend you **remove** the [NextDNS Ads & Trackers Blocklist](https://githu
A great question to ask is: "How much do I want to deal with the inconveniences of [false positives](https://csrc.nist.gov/glossary/term/false_positive)?"
Here are the suggested blocklists, based on past [issues](https://github.com/hagezi/dns-blocklists/issues?q=author%3Ayokoffing) and observations:
Here are the suggested blocklists, based on past issues and observations:
| **Blocklist** | **Rationale** |
| **Blocklists** | **Rationale** |
|:--------------------:|:--------------------------------------------------------------------------------------:|
| HaGeZi - Multi **NORMAL**<sup>[1](https://github.com/hagezi/dns-blocklists/blob/main/statistics.md#multi)</sup> | Block tracker, ad, and badware requests without issues ([set-and-forget](https://glosbe.com/en/en/set-and-forget)). |
| HaGeZi - Multi **PRO**<sup>[2](https://github.com/hagezi/dns-blocklists/blob/main/statistics.md#pro)</sup> | Block more requests, usually without issues (recommended). |
| HaGeZi - Multi **PRO++**<sup>[3](https://github.com/hagezi/dns-blocklists/blob/main/statistics.md#proplus)</sup> | Block more requests at the risk of site breakage. <br> [Report](https://github.com/hagezi/dns-blocklists/issues/new/choose) occasional site and app issues. |
| HaGeZi - <br>Multi **NORMAL**<sup>[1](https://github.com/hagezi/dns-blocklists/blob/main/statistics.md#multi)</sup> <br>+ <br>OISD<sup>[2](https://www.reddit.com/r/nextdns/comments/1ia9bz0/comment/mdy61v9/)</sup> | Block tracker, ad, and badware requests without issues ([set-and-forget](https://glosbe.com/en/en/set-and-forget)). |
| HaGeZi - <br>Multi **PRO**<sup>[3](https://github.com/hagezi/dns-blocklists/blob/main/statistics.md#pro)</sup> | Block more requests, usually without issues (recommended). |
| HaGeZi - <br>Multi **PRO++**<sup>[4](https://github.com/hagezi/dns-blocklists/blob/main/statistics.md#proplus)</sup> | Block more requests at the risk of site breakage. <br> [Report](https://github.com/hagezi/dns-blocklists/issues/new/choose) occasional site and app issues. |
> [!TIP]
> Use different blocklists on separate DNS profiles (e.g., NORMAL for your router and PRO++ for your web browser).
You can also check out Hagezi's own [recommendations](https://github.com/hagezi/dns-blocklists/tree/main#whatshouldiuse).
You can also check out Hagezi's own [recommendations](https://github.com/hagezi/dns-blocklists/wiki/FAQ#whatshouldiuse).
### Why Hagezi?
[Hagezi](https://github.com/hagezi/dns-blocklists) block ads, trackers, native device trackers, and badware. He maintains a sensible allowlist, handles false positives quickly, and communicates known issues to blocklists maintainers. Hagezi's primary DNS lists combine multiple [sources](https://github.com/hagezi/dns-blocklists/wiki/FAQ#-which-sources-are-used-for-the-lists-and-how-are-the-lists-compiled-on-the-basis-of-these-sources) including respected community blocklists like [OISD](https://oisd.nl/), [Steven Black](https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts), [1Hosts](https://github.com/badmojr/1Hosts#safeguard-your-devices-against-pesky-ads-trackers-and-malware), [notrack](https://gitlab.com/quidsup/notrack#notrack), and [more](https://github.com/hagezi/dns-blocklists/blob/main/sources.md).
[Hagezi](https://github.com/hagezi/dns-blocklists) block ads, trackers, native device trackers, and badware. He maintains a sensible allowlist, handles false positives quickly, and communicates known issues to blocklists maintainers. Hagezi builds his blocklists using many of the same original [sources](https://github.com/hagezi/dns-blocklists/blob/main/sources.md) that feed into other popular lists like OISD and 1Hosts. He also adds his own unique sources, rather than just repackaging other combined blocklists.
You may also wonder why other lists are not utilized. This is because many list maintainers:
* do not remove [false positives](https://csrc.nist.gov/glossary/term/false_positive) and/or are no longer active <sup>[1](https://github.com/lightswitch05/hosts/issues/356) [2](https://github.com/EnergizedProtection/block/issues/916)</sup>
@@ -147,8 +142,10 @@ You may also wonder why other lists are not utilized. This is because many list
* offer no meaningful additional coverage when compared with the chart combinations above
## Native Tracking Protection <sup><sup>[1](https://github.com/nextdns/native-tracking-domains/tree/main/domains)</sup></sup>
> [!CAUTION]
> Leave this feature enabled if you use something other than the [recommended blocklists](https://github.com/yokoffing/NextDNS-Config#privacy-lock) (see https://github.com/yokoffing/NextDNS-Config/issues/76).
Add all the device brands you use.
If you decide to use this feature, then add all the device brands that you use.
<details>
@@ -164,14 +161,16 @@ Add all the device brands you use.
</details>
## Block Disguised Third-Party Trackers <sup><sup>[1](https://github.com/nextdns/cname-cloaking-blocklist/blob/master/domains) [2](https://www.reddit.com/r/nextdns/comments/10nenu3/disguised_trackers_are_blocked_regardless_of) [3](https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a) [4](https://arxiv.org/pdf/2102.09301.pdf) [5](https://tma.ifip.org/2020/wp-content/uploads/sites/9/2020/06/tma2020-camera-paper66.pdf) </sup></sup>
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Block Disguised Third-Party Trackers
![Disabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/disabled.svg) Block Disguised Third-Party Trackers
The domain [list](https://github.com/nextdns/cname-cloaking-blocklist/blob/master/domains) hasn't been updated in years, and it blocks some referral domains that **Allow Affiliate & Tracking Links** doesn't unblock. NextDNS blocks [CNAME records](https://en.wikipedia.org/wiki/CNAME_record) by default, even with this list disabled.
## Allow Affiliate & Tracking Links <sup><sup>[1](https://github.com/nextdns/click-tracking-domains) [2](https://x.com/NextDNS/status/1539229377560461312) </sup></sup>
> [!TIP]
> Your IP address will automatically be hidden (via [TCP](https://educba.com/what-is-tcp-ip) [proxying](https://en.wikipedia.org/wiki/Proxy_server#/media/File:Proxy_concept_en.svg)) to preserve your privacy.<p>
> [!WARNING]
> Disabling this setting causes prevent site navgiation when opening some email links.
> Disabling this setting prevents some email links from opening properly.
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Allow Affiliate & Tracking Links
@@ -181,6 +180,7 @@ Add all the device brands you use.
## YouTube Restricted Mode
![Disabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/disabled.svg) Enforce YouTube Restricted Mode
## Block Bypass Methods <sup><sup>[1](https://github.com/nextdns/dns-bypass-methods)</sup></sup>
Block tools that can bypass NextDNS filtering, such as VPNs, proxies, Tor software, and encrypted DNS services.
> [!CAUTION]
> Enabling this setting causes unintended behavior.
@@ -190,33 +190,29 @@ Add all the device brands you use.
# Denylist :no_entry:
Denylist entries are always blocked. The entries below may further harden some profiles while not interfering with everyday browsing.
Denylist entries are always blocked. These entries may further harden some profiles while not interfering with everyday browsing.
<details>
### iCloud Private Relay
### Apple tracking domains <sup><sup>[1](https://unofficialbird.com/mysk_co/status/1588308341780262912) [2](https://github.com/nextdns/metadata/pull/1132) [3](https://github.com/badmojr/1Hosts/issues/536) [4](https://gizmodo.com/apple-iphone-analytics-tracking-even-when-off-app-store-1849757558)</sup></sup>
Not currently in NextDNS's [Native Tracking Protection](https://github.com/yokoffing/NextDNS-Config#native-tracking-protection-1) [list](https://github.com/nextdns/native-tracking-domains/blob/main/domains/apple): <sup>[1](https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/native.apple.txt)</sup>
[iCloud Private Relay](https://support.apple.com/en-us/102602) can override DNS settings on devices, preventing NextDNS from protecting them.
xp.apple.com (unblock for device updates!)
acfeedbackws.icloud.com
api-adservices.apple.com
feedbackws.fe.apple-dns.net
feedbackws.icloud.com
iadsdk.apple.com
notes-analytics-events.apple.com
notes-analytics-events.news.apple-dns.net
weather-analytics-events.apple.com
weather-analytics-events.news.apple-dns.net
### Twitter tracker
Some DoH providers block this feature automatically.
syndication.twitter.com
mask.icloud.com
mask-h2.icloud.com
mask-canary.icloud.com
### NVIDIA Gefore Experience <sup><sup>[1](https://github.com/badmojr/1Hosts/issues/650)</sup></sup>
> [!CAUTION]
> The domains below may prevent external images from loading in Apple mail clients. You don't need these unless you're running a very aggressive profile.
events.gfe.nvidia.com
And possibly:
</details>
apple-relay.cloudflare.com
apple-relay.fastly-edge.com
doh.dns.apple.com
doh.dns.apple.com.v.aaplimg.com
mask-api.icloud.com
mask.apple-dns.net
***
@@ -224,14 +220,14 @@ Not currently in NextDNS's [Native Tracking Protection](https://github.com/yokof
Allowlist entries always resolve. These entries may be needed for aggressive DNS profiles to relax their rules.
<details>
### NextDNS
Just in case a filterlist goes [haywire](https://help.nextdns.io/t/m1hs207/energized-ultimate-lists-blocking-nextdns) and blocks your access
Allow NextDNS itself in case a filterlist goes [haywire](https://help.nextdns.io/t/m1hs207/energized-ultimate-lists-blocking-nextdns) and blocks your access.
nextdns.io
<details><summary>Click here to view more entries</summary>
### Facebook / Instagram <sup><sup>[1](https://github.com/jerryn70/GoodbyeAds/issues/309)</sup></sup>
graph.facebook.com
@@ -249,7 +245,7 @@ If you're still having issues, try [these](https://raw.githubusercontent.com/hag
### Apple device updates <sup><sup>[1](https://github.com/badmojr/1Hosts/issues/536) [2](https://github.com/badmojr/1Hosts/issues/562) [3](https://github.com/nextdns/metadata/pull/1132#issuecomment-1331733770)
A [known tracking domain](https://gizmodo.com/apple-iphone-analytics-tracking-even-when-off-app-store-1849757558), but it's needed for device updates
A [known tracking domain](https://gizmodo.com/apple-iphone-analytics-tracking-even-when-off-app-store-1849757558), but it's needed for device updates.
xp.apple.com
@@ -268,6 +264,11 @@ This [request](https://oisd.nl/excludes.php?w=settings-win.data.microsoft.com) i
settings-win.data.microsoft.com
### Xbox achievements
v10.events.data.microsoft.com
v20.events.data.microsoft.com
### Xiaomi device updates
update.intl.miui.com
@@ -384,6 +385,9 @@ Users have [reported](https://www.reddit.com/r/nextdns/comments/v84ag6/paramount
![Disabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/disabled.svg) Enable CNAME Flattening
## Bypass Age Verification
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Bypass Age Verification
## Web3 <sup><sup> [1](https://x.com/NextDNS/status/1491034351391305731) [2](https://gabygoldberg.notion.site/f7050e62461143d49345e7b46eb5576b)</sup></sup>
![Enabled](https://raw.githubusercontent.com/yokoffing/NextDNS-Config/main/icons/enabled.svg) Enable Web3 → (optional)
@@ -431,22 +435,20 @@ The device will use the profile set by the [NextDNS](https://nextdns.io/?from=xu
See [article](https://thenewoil.org/en/guides/prologue/secprivanon/) | [video](https://www.youtube.com/watch?v=Wpkh-hfULgE)
## Does NextDNS hide activity from my Internet Service Provider (ISP)?
DNS protocols like DoH/DoT/DoQ are designed to increase privacy and security by encrypting DNS queries. They prevent your ISP from seeing your web searches and browsing history, which significantly contributes to protecting your privacy.
Encrypted DNS queries boost privacy and security. This encryption stops your ISP from seeing what websites you search for and visit.
However, encrypted DNS does not hide the IP addresses of the websites you visit from your ISP. So while they cannot see the content of the encrypted DNS query (i.e., your ISP can't see what specific domain you're trying to access), they can see that you're making a request to a particular DNS server like Cloudflare or AWS. And if you're constantly sending packets to a particular IP address, it's likely that you're visiting a website hosted at that address.
However, encrypted DNS does not hide website IP addresses from your ISP. While your ISP cannot see the specific domain you want to access, they can see that you contact DNS servers like Cloudflare or AWS. If you repeatedly send data to a certain IP address, your ISP can guess you are visiting a website at that address.
That being said, IVPN [argues](https://www.ivpn.net/blog/why-you-dont-need-a-vpn/) that you only need a VPN for three reasons:
## Do I need a VPN?
IVPN [argues](https://www.ivpn.net/blog/why-you-dont-need-a-vpn/) you only need a VPN for three reasons. Mainly, in order to:
<details>
1. Hide your real IP address from websites and peer-to-peer networks, which prevents ISPs and mobile carriers from tracking your online activity.
1. Maintaining control over your privacy by hiding your real IP address from websites and peer-to-peer nodes, preventing ISPs and mobile network operators from tracking the domains and IPs you visit.
2. Guard against [man in the middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) and other [common attacks](https://en.wikipedia.org/wiki/Evil_twin_(wireless_networks)) on public Wi-Fi networks in places like airports, hotels, cafes, and libraries.
2. Protecting your connection from [man in the middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) and other [common attacks](https://en.wikipedia.org/wiki/Evil_twin_(wireless_networks)) on untrusted networks, such as Wi-Fi in airports, hotels, cafes, and libraries.
3. Bypass censorship or geographic restrictions, allowing you to access blocked websites and content.
3. Circumventing censorship or geographical blocks on websites and content, allowing you to retrieve otherwise inaccessible information and media.
</details>
You don't need a VPN unless your [threat model](https://thenewoil.org/en/guides/prologue/threat-model/) demands it. Here are VPN suggestions from [Techlore](https://www.techlore.tech/vpn.html) and [Tom Spark Reviews](https://www.vpntierlist.com/vpn-tier-list-2024) if it does.
Ultimately, you don't need a VPN unless your [threat model](https://thenewoil.org/en/guides/prologue/threat-model/) demands it. Here are VPN suggestions from [Techlore](https://www.techlore.tech/vpn.html) and [Tom Spark Reviews](https://www.vpntierlist.com/vpn-tier-list-2024) if it does.
***
# Mentions :books:
@@ -472,6 +474,3 @@ You don't need a VPN unless your [threat model](https://thenewoil.org/en/guides/
* [Easylist](https://github.com/easylist/easylist/issues?q=author%3Ayokoffing)
* [uBlock Origin](https://github.com/uBlockOrigin/uAssets/issues?q=author%3Ayokoffing)
* [AdGuard](https://github.com/AdguardTeam/AdguardFilters/issues?q=author%3Ayokoffing)
<div align='center'><a href='https://websitecounterfree.com'><img src='https://websitecounterfree.com/c.php?d=9&id=19651&s=1' border='0' alt='Free Website Counter'></a><br / ></div>
<div align='center'>since 23 July 2022</div>