[](https://github.com/yokoffing/NextDNS-Config/issues)
[](https://github.com/yokoffing/NextDNS-Config/issues?q=is%3Aissue+is%3Aclosed)
[](https://hits.seeyoufarm.com)
***
# Guidelines :bookmark:
1) Prevent overblocking by utilizing the [law of diminishing returns](https://pmctraining.com/site/wp-content/uploads/2018/04/Law-of-Diminishing-Returns-CHART.png) (e.g., using [sane](https://www.privacyguides.org/basics/threat-modeling/), quality [blocklists](https://github.com/yokoffing/NextDNS-Config#blocklists-1); allowing most [TLDs](https://github.com/yokoffing/NextDNS-Config#block-top-level-domains-tlds-1-2-3-4-5); etc.).
2) Pass the [girlfriend test](https://www.urbandictionary.com/define.php?term=Grandma%20Test) with few exceptions. These deviations are documented throughout the guide.
***
# Security :cop:
### Threat Intelligence Feeds [1](https://github.com/nextdns/metadata/blob/master/security/threat-intelligence-feeds.json)
 Use Threat Intelligence Feeds
### AI-Driven Threat Detection
 Enable AI-Driven Threat Detection
### Google Safe Browsing [1](https://safebrowsing.google.com/safebrowsing/report_general/) [2](https://user-images.githubusercontent.com/11689349/107696360-d8dde800-6c7f-11eb-9882-cccc8d2065c5.jpg) [3](https://the8-bit.com/apple-proxies-google-safe-browsing-privacy/) [4](https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)#services-we-proxy-through-brave-servers)
 Enable Google Safe Browsing
### Cryptojacking Protection [1](https://github.com/nextdns/metadata/blob/master/security/cryptojacking.json)
 Enable Cryptojacking Protection
### DNS Rebinding Protection [1](https://help.nextdns.io/t/35hmval/what-is-dns-rebinding-protection) [2](https://www.reddit.com/r/nextdns/comments/t0ne8r/does_dns_rebinding_protection_block_remote_access/?context=3)
 Enable DNS Rebinding Protection
### IDN Homograph Attacks Protection
 Enable Homograph Attacks Protection
### Typosquatting Protection [1](https://github.com/nextdns/metadata/blob/master/security/typosquatting/protected-domains)
 Enable Typosquatting Protection
### Domain Generation Algorithms (DGAs) Protection
 Enable DGA Protection
### Block Newly Registered Domains (NRDs) [1](https://www.malwarebytes.com/glossary/phishing) [2](https://old.reddit.com/r/uBlockOrigin/comments/w64sqt/comment/ihboutk/?context=3) [3](https://www.boldgrid.com/instagram-influencer-accounts-are-being-hacked-phishing-attacks/)
:warning: Blocking NRDs may cause false positives [occasionally](https://old.reddit.com/r/InternetIsBeautiful/comments/w2wdro/comment/iguvg8y/?context=3). Be selective when adding NRDs to your allowlist; and, when you do this, **NEVER** give [sensitive information](https://www.egnyte.com/guides/governance/sensitive-information) to a NRD. *If you plan to [set-and-forget](https://glosbe.com/en/en/set-and-forget) your configuration, disable this setting.*
 Block Newly Registered Domains (NRDs)
### Block Dynamic DNS Hostnames [1](https://github.com/nextdns/metadata/blob/master/security/ddns/suffixes) [2](https://twitter.com/NextDNS/status/1541740963760144386?cxt=HHwWhIC8iZ7PruUqAAAA) [3](https://www.phishing.org/what-is-phishing)
 Enable Block Dynamic DNS Hostnames
### Block Parked Domains [1](https://github.com/nextdns/metadata/blob/master/security/parked-domains-cname)
 Block Parked Domains
### Block Top-Level Domains (TLDs) [1](https://www.gomyitguy.com/blog-news-updates/malicious-domain-extensions) [2](https://www.spamhaus.org/statistics/tlds/) [3](https://thrivemyway.com/info-websites/) [4](https://www.bleepingcomputer.com/news/security/verified-twitter-accounts-hacked-to-send-fake-suspension-notices/) [5](https://github.com/iam-py-test/my_filters_001/blob/main/enhanced_protection.txt)
:warning: Blocking TLDs will cause false positives. This list may be unusable if you often visit domains that use these blocked TLDs. Add sites affected to your allowlist if they are not malicious. *If you plan to [set-and-forget](https://glosbe.com/en/en/set-and-forget) your configuration, skip this setting.*
```
.work
.fit
.surf
.cn
.info
-
.agency
.bid
.cam
.cf
.ci
.cricket
.fun
.ga
.gq
.loan
.ml
.monster
.online
.ooo
.tk
.top
.win
```
### Block Child Sexual Abuse Material
 Block Child Sexual Abuse Material
***
# Privacy :lock:
### Blocklists [1](https://github.com/nextdns/metadata/tree/master/privacy/blocklists)
Here's a compliation of popular blocklists available in NextDNS:
- **Balanced:** no breakage; [set-and-forget](https://glosbe.com/en/en/set-and-forget); doesn't interfere with user experience
- **Strict:** minimal breakage; prioritizes privacy over user experience; allowlist occasionally
- **Aggressive:** excessive breakage; use on a separate profile to [lockdown single-purpose devices](https://old.reddit.com/r/nextdns/comments/uqap3n/comment/i8q8alf/?context=3)
| Balanced | Strict | Aggressive |
|:---------------------------------: |:------------------------------: |:----------------------------------------: |
| 1Hosts (Lite) | 1Hosts (Pro) | 1Hosts (Xtra) |
| oisd | Lightswitch05 - Ads & Tracking | Energized Ultimate |
| AdGuard DNS filter | Lightswitch05 - Tracking Aggressive | Goodbye Ads |
| notracking | NextDNS Ads & Trackers Blocklist | |
| NoTrack Tracker Blocklist | | |
#### Highly Recommended:
1) [NextDNS Ads & Trackers Blocklist](https://github.com/nextdns/metadata/blob/master/privacy/blocklists/nextdns-recommended.json)
2) [oisd](https://raw.githubusercontent.com/sjhgvr/oisd/main/dblw_full.txt) [1](https://oisd.nl/includedlists/full) [2](https://oisd.nl/excludes.php?excludedfrom=allincluded)
3) [1Hosts (Pro)](https://o0.pages.dev/Xtra/wildcards.txt) [1](https://github.com/badmojr/1Hosts/blob/master/-data/lists/assets.txt)
### Native Tracking Protection [1](https://github.com/nextdns/metadata/tree/master/privacy/native)
Add these brands according to what devices you use. There's no advantage in adding brands you don't own; however, there’s no disadvantage in adding unused brands either.
Xiaomi
Huawei
Samsung
Amazon Alexa
Windows
Apple
Roku
Sonos
### Block Disguised Third-Party Trackers [1](https://github.com/nextdns/cname-cloaking-blocklist/blob/master/domains) [2](https://medium.com/nextdns/cname-cloaking-the-dangerous-disguise-of-third-party-trackers-195205dc522a) [3](https://arxiv.org/pdf/2102.09301.pdf) [4](https://tma.ifip.org/2020/wp-content/uploads/sites/9/2020/06/tma2020-camera-paper66.pdf)
 Block Disguised Third-Party Trackers
### Allow Affiliate & Tracking Links [1](https://github.com/nextdns/metadata/blob/master/privacy/affiliate-tracking-domains) [2](https://twitter.com/NextDNS/status/1539229377560461312)
:warning: *If you plan to [set-and-forget](https://glosbe.com/en/en/set-and-forget) your configuration, enable this setting.*
 Allow Affiliate & Tracking Links
***
# Parental Control :family:
### YouTube Restricted Mode
 Enforce YouTube Restricted Mode
### Block Bypass Methods [1](https://github.com/nextdns/metadata/tree/master/parentalcontrol)
 Block Bypass Methods
***
# Denylist :no_entry:
N/A
***
# Allowlist :white_check_mark:
### Facebook / Instagram
graph.facebook.com
graph.instagram.com
i.instagram.com
### Apple device updates [1](https://github.com/badmojr/1Hosts/issues/536) / Apple Music [2](https://old.reddit.com/r/nextdns/comments/vz9kla/at_last_nextdns_added_the_1host_xtra/ig8zsnn/)
xp.apple.com
### Apple iMessage GIFs [1](https://github.com/badmojr/1Hosts/issues/560) / Spotlight Search [2](https://github.com/badmojr/1Hosts/issues/562)
smoot.apple.com
### Zoom [1](https://oisd.nl/excludes.php?w=log.zoom.us) [2](https://oisd.nl/excludes.php?w=us04logfiles.zoom.us)
logfiles.zoom.us
us04logfiles.zoom.us
us04zpns.zoom.us
### [CBS](https://www.cbsnews.com/live/#x) News livestream [1](https://github.com/nextdns/metadata/issues/1030)
production-cmp.isgprivacy.cbsi.com
### FiveThirtyEight
dcf.espn.com
### Microsoft Office 365 [1](https://github.com/badmojr/1Hosts/issues/565) [2](https://oisd.nl/excludes.php?w=mobile.pipe.aria.microsoft.com)
:warning: Blocking these requests may only break Office collaboration features. Only allowlist them if you experience breakage.
self.events.data.microsoft.com
mobile.pipe.aria.microsoft.com
### Xbox Live achievements [1](https://github.com/lightswitch05/hosts/issues/161#issuecomment-614973289) [2](https://discourse.pi-hole.net/t/commonly-whitelisted-domains/212#xbox-live-18) / Microsoft "Your Phone" [3](https://github.com/lightswitch05/hosts/issues/161#issuecomment-838590100)
:warning: I don't use these, so I can't confirm the requests. Only allowlist them if you experience breakage.
v10.events.data.microsoft.com
v20.events.data.microsoft.com
***
# Settings :gear:
### Block Page
 Enable Block Page → :radioactive: *Enabling may cause breakage if the [NextDNS Root CA](https://help.nextdns.io/t/g9hmv0a/how-to-install-and-trust-nextdns-root-ca) is not on your devices*
### Anonymized EDNS Client Subnet [1](https://help.nextdns.io/t/m1hmv04/what-is-edns-client-subnet-ecs)
 Enable Anonymized EDNS Client Subnet
### Cache Boost [1](https://old.reddit.com/r/nextdns/comments/girmcf/new_setting_cache_boost/)
 Enable Cache Boost
### CNAME Flattening [1](https://medium.com/nextdns/nextdns-added-cname-uncloaking-support-becomes-the-first-cross-platform-solution-to-the-problem-e3f437f84342) [2](https://developers.cloudflare.com/dns/additional-options/cname-flattening) [3](https://advancedweb.hu/what-is-cname-flattening-and-how-it-helps-redirecting-the-apex-domain/)
 Enable CNAME Flattening
### Web3 [1](https://twitter.com/NextDNS/status/1491034351391305731) [2](https://gabygoldberg.notion.site/f7050e62461143d49345e7b46eb5576b)
 Enable Web3
(optional)
***
# Credit :books:
Forked from the [crssi](https://github.com/crssi/NextDNS-Config#readme) config. Some inspiration came from the [scafroglia93](https://github.com/scafroglia93/nextdns-setting/blob/master/nextdns-setting.txt) config while other ideas are my own.
***
23 July 2022