Guidelines 🔖
- Prevent overblocking by utilizing the law of diminishing returns (e.g., using sane, quality blocklists; allowing most TLDs; etc.).
- Pass the girlfriend test with few exceptions. These deviations are documented throughout the guide.
Create your account
Sign up for NextDNS here!
Security 👮♂️
Security settings protect your data from harm, theft, and unauthorized use.^why does this matter?
Threat Intelligence Feeds 1
Use Threat Intelligence Feeds
AI-Driven Threat Detection
Enable AI-Driven Threat Detection
Google Safe Browsing 1 2 3 4
Enable Google Safe Browsing
Cryptojacking Protection 1
Enable Cryptojacking Protection
DNS Rebinding Protection 1 2
Enable DNS Rebinding Protection
IDN Homograph Attacks Protection
Enable Homograph Attacks Protection
Typosquatting Protection 1
Enable Typosquatting Protection
Domain Generation Algorithms (DGAs) Protection
Enable DGA Protection
Block Newly Registered Domains (NRDs) 1 2 3
⚠️ Blocking NRDs may cause false positives occasionally. Be selective when adding NRDs to your allowlist; and, if you do, NEVER give sensitive information to a NRD. If you plan to set-and-forget your configuration, disable this setting.
Block Newly Registered Domains (NRDs)
Block Dynamic DNS Hostnames 1 2 3
Enable Block Dynamic DNS Hostnames
Block Parked Domains 1
Block Parked Domains
Block Top-Level Domains (TLDs) 1 2 3 4 5 6
⚠️ Blocking TLDs may cause false positives since this feature blocks both site nagviations and subrequests. However, the entries below should allow for everyday browsing while offering protection against commonly abused TLDs. If you plan to set-and-forget your configuration, skip this setting.
.buzz
.cricket
.cyou
.discount
.gdn
.live
.loan
.loans
.ooo
.sbs
.wang
🛑 Below are additional TLDs you may block, but you may need to allowlist sites on occasion.
.work
.fit
.surf
.asia
.tokyo
.monster
---
.agency
.associates
.bid
.cam
.casa
.cf
.ci
.fun
.ga
.gq
.link
.ml
.icu
.rest
.shop
.webcam
.win
📝 If you would rather block TLDs with an adblocker (e.g., easier to troubleshoot breakage), add the first two filterlists here.
Block Child Sexual Abuse Material
Block Child Sexual Abuse Material
Privacy 🔒
Privacy features limit the amount of data that companies can collect about you. Privacy is a spectrum. What you need varies on your threat model, interest, and skillset.^why should I care? I have nothing to hide
Blocklists 1
Blocklists are community generated lists that block ads and trackers. Filters can be categorized into five tiers of coverage:
- None: no breakage; NextDNS still protects against malicious threats (à la security settings) but will allow ads and trackers
- Basic: rare breakage; prioritizes functionality over blocking; very forgiving
- Balanced: minimal breakage; largely set-and-forget but you may need to allowlist occasionally to unsubscribe from junk email
- Strict: moderate breakage; prioritizes privacy over user experience; must manage your allowlist regularly
- Aggressive: excessive breakage; use on a separate profile to lockdown single-purpose devices
Here's the suggested blocklists for each category:
| Basic | Balanced | Strict | Aggressive |
|---|---|---|---|
| 1Hosts (mini) | 1Hosts (Lite) | 1Hosts (Pro) | 1Hosts (Xtra) |
| oisd | oisd | Goodbye Ads | |
| Energized Ultimate |
💡 The Balanced tier is recommended for everyday browsing, based on my testing and user feedback.1 2 3 4 5
❓ You may wonder why other lists are not utilized. This is because many list maintainers:
- do not remove false positives and/or are no longer active 1 2 3
- already aggregate common blocklists into their own list (Easylist/Fanboy, uBlock, AdGuard, etc.) 1 2 3 4 5
- offer no meaningful additional coverage when compared with the chart combinations above 1
Native Tracking Protection 1
Add all the device brands that you use. There's no advantage in adding brands you don't have; however, there’s no disadvantage in adding unused brands, either.
Xiaomi
Huawei
Samsung
Amazon Alexa
Windows
Apple
Roku
Sonos
Block Disguised Third-Party Trackers 1 2 3 4
Block Disguised Third-Party Trackers
Allow Affiliate & Tracking Links 1 2
💡 Your IP address will automatically be hidden (via TCP proxying) to preserve your privacy.
⚠️ Disabling may cause false positives when opening some emails.
Allow Affiliate & Tracking Links
Parental Control 👨👩👦
YouTube Restricted Mode
Enforce YouTube Restricted Mode
Block Bypass Methods 1
⚠️ Enabling may cause unintended breakage.
Block Bypass Methods
Denylist ⛔
Denylist entries block any requests from that source. The entries below may further harden Balanced blocklist profiles while not interfering with everyday browsing.
Apple tracking domains 1 2 3 4
Not currently in NextDNS's Native Tracking Protection list:
xp.apple.com
acfeedbackws.icloud.com
api-adservices.apple.com
ca.iadsdk.apple.com
cf.iadsdk.apple.com
feedbackws.icloud.com
iadsdk.apple.com
notes-analytics-events.apple.com
tr.iadsdk.apple.com
weather-analytics-events.apple.com
Twitter tracker
syndication.twitter.com
NVIDIA Gefore Experience 1
events.gfe.nvidia.com
Junk surveillance software
spappmonitoring.com
a-spy.com
alltracker.org
aispyer.com
Allowlist ✅
Allowlist entries override any blocks. These entries may be needed for Strict and Aggressive blocklist profiles.
Facebook / Instagram 1
graph.facebook.com
graph.instagram.com
i.instagram.com
Apple iMessage GIFs 1 / Spotlight Search 2
smoot.apple.com
Apple Store 1
amp-api-edge.apps.apple.com
amp-api-search-edge.apps.apple.com
Xiaomi device updates 1
update.intl.miui.com
Spectrum login 1
pov.spectrum.net
Zoom 1 2
logfiles.zoom.us
us04logfiles.zoom.us
us04zpns.zoom.us
YouTube history 1
s.youtube.com
Hulu 1
ads-fa-darwin.hulustream.com
Epic Games Launcher 1
eulatracking-public-service-prod06.ol.epicgames.com
NVIDIA Gefore Experience 1
gfe.nvidia.com
nvgs.nvidia.cn
imgur 1 2
js.media-lab.ai
CBS News livestream 1
production-cmp.isgprivacy.cbsi.com
FiveThirtyEight videos / National Geographic website 1
dcf.espn.com
Men's Health videos 1
glimmer.hearstapps.com
Settings ⚙️
Logs
Storage location → Switzerland
Block Page
Enable Block Page
⚠️ Enabling may cause breakage if the NextDNS Root CA is not on your devices. This setting also breaks iCloud Private Relay.1
Anonymized EDNS Client Subnet 1
Enable Anonymized EDNS Client Subnet
Cache Boost 1
Enable Cache Boost
CNAME Flattening 1 2 3
Enable CNAME Flattening
Web3 1 2
Enable Web3 → (optional)
FAQ ❓
How do I signup for NextDNS?
Click here!
Is it redundant to set DoH at browser-level if I'm already using it at system-level?
Unless you use a separate profile for the browser, it is not neccessary, and it should not slow down your web browsing.1 However, I recommend setting it in your web browser anyway.
If I have a profile for my router and another profile for my device, which one will my device use?
The device will use the profile set by the NextDNS app or the installed root CA. However, if the device has not been configured to use a separate profile, then it will use the wifi/router configuration.1
Can I block YouTube ads with NextDNS only?
No, you can't block first-party ads using only DNS-level blocking. You will need an adblocker.
What browser should I use that has adblocking?
- Brave is a great choice, especially if you prefer Chrome, want uninstrusive fingerprint protection, and don't enjoy doing a lot of tweaking.1
- Firefox with uBlock Origin1 and configured using Betterfox.
- Orion is a promising, up-and-coming browser for Apple devices.
Here are the suggested browsers for each operating system:
| Browser | Windows | macOS | Linux | iOS | Android |
|---|---|---|---|---|---|
| Brave | x | x | x | x | x |
| Firefox | x | x | x | ||
| Orion | x | x |
What is the difference between security, privacy, and anonymity?
Does NextDNS hide activity from my Internet Service Provider (ISP)?
No. NextDNS is only concerned about DNS traffic. You would need a quality VPN to hide all activity from your ISP.
Mentions 📚
Guides
- FMHY: DNS Adblocking → NextDNS → Guide
Contributions
Support ❤️
I’m a one-person operation, working in mental health and running this page as a passion project in my time off. If you enjoy my work, please leave a tip! Your support is incredibly appreciated and allows me to dedicate time to this project 😊
Bitcoin: 334gaiEjn6wY1VksQvYe5L668JjtPEPyiM
PayPal: paypal.me (forthcoming)