Guidelines 🔖
- Prevent overblocking by utilizing the law of diminishing returns (e.g., using sane, quality blocklists; allowing most TLDs; etc.).
- Pass the girlfriend test with few exceptions. These deviations are documented throughout the guide.
Security 👮♂️
Security settings protect your data from harm, theft, and unauthorized use.
Threat Intelligence Feeds 1
Use Threat Intelligence Feeds
AI-Driven Threat Detection
Enable AI-Driven Threat Detection
Google Safe Browsing 1 2 3
Enable Google Safe Browsing
Cryptojacking Protection 1
Enable Cryptojacking Protection
DNS Rebinding Protection 1 2
Enable DNS Rebinding Protection
IDN Homograph Attacks Protection
Enable Homograph Attacks Protection
Typosquatting Protection 1
Enable Typosquatting Protection
Domain Generation Algorithms (DGAs) Protection
Enable DGA Protection
Block Newly Registered Domains (NRDs) 1 2 3
⚠️ Blocking NRDs may cause false positives occasionally. Be selective when adding NRDs to your allowlist; and, if you do, NEVER give sensitive information to a NRD. If you plan to set-and-forget your configuration, disable this setting.
Block Newly Registered Domains (NRDs)
Block Dynamic DNS Hostnames 1 2 3
Enable Block Dynamic DNS Hostnames
Block Parked Domains 1
Block Parked Domains
Block Top-Level Domains (TLDs) 1 2 3 4 5
⚠️ Blocking TLDs may cause false positives since this feature blocks both site nagviations and subrequests. However, the entries below should allow for everyday browsing while offering protection against commonly abused TLDs. If you plan to set-and-forget your configuration, skip this setting.
.associates
.bid
.buzz
.cricket
.discount
.gdn
.live
.loan
.loans
.ooo
.rest
.sbs
.wang
.webcam
🛑 Here are additional TLDs you may block, but you may need to allowlist sites on occasion:
.work
.fit
.surf
.asia
.tokyo
---
.agency
.cam
.casa
.cf
.ci
.fit
.fun
.ga
.gq
.monster
.ml
.icu
.shop
.win
Block Child Sexual Abuse Material
Block Child Sexual Abuse Material
Privacy 🔒
Privacy features block certain requests so that companies cannot track your information and browsing history.1
Privacy is a spectrum. What you need varies on your threat model, interest, and skillset. (You can watch this short video to understand the difference between security and privacy, and read this as to why it matters.)
Blocklists 1
Blocklists are community generated lists that block ads and trackers. Filters can be categorized into five tiers of coverage:
- None: no breakage; NextDNS still protects against malicious threats (à la security settings) but will allow ads and trackers
- Basic: rare breakage; prioritizes functionality over blocking; very forgiving; ideal for router profiles
- Balanced: minimal breakage; should not interfere with everyday browsing; largely set-and-forget but you may need to allowlist occasionally
- Strict: moderate breakage; prioritizes privacy over user experience; must manage your allowlist regularly
- Aggressive: excessive breakage; use on a separate profile to lockdown single-purpose devices
Here's a compliation of popular blocklists available in NextDNS:
| Basic | Balanced | Strict | Aggressive |
|---|---|---|---|
| 1Hosts (mini) | 1Hosts (Lite) | 1Hosts (Pro) | 1Hosts (Xtra) |
| oisd | oisd | NextDNS Ads & Trackers Blocklist | Goodbye Ads |
| Lightswitch05 - Ads & Tracking | Energized Ultimate |
💡 The Balanced tier is recommended for the average user, based on my testing and user feedback.1 2 3 4
Native Tracking Protection 1
Add all the device brands that you use. There's no advantage in adding brands you don't have; however, there’s no disadvantage in adding unused brands, either.
Xiaomi
Huawei
Samsung
Amazon Alexa
Windows
Apple
Roku
Sonos
Block Disguised Third-Party Trackers 1 2 3 4
Block Disguised Third-Party Trackers
Allow Affiliate & Tracking Links 1 2
💡 Your IP address will automatically be hidden (via TCP proxying) to preserve your privacy.
Allow Affiliate & Tracking Links
Parental Control 👨👩👦
YouTube Restricted Mode
Enforce YouTube Restricted Mode
Block Bypass Methods 1
Block Bypass Methods
Denylist ⛔
Denylist entries block any requests from that source.
Junk surveillance software
spappmonitoring.com
a-spy.com
alltracker.org
aispyer.com
Allowlist ✅
Allowlist entries override any blocks. These entries may be needed for Strict and Aggressive blocklists.
Facebook / Instagram 1
graph.facebook.com
graph.instagram.com
i.instagram.com
Apple device updates 1 / Apple Music 2
xp.apple.com
Apple iMessage GIFs 1 / Spotlight Search 2
smoot.apple.com
Apple Store 1
amp-api-edge.apps.apple.com
amp-api-search-edge.apps.apple.com
Xiaomi device updates 1
update.intl.miui.com
Zoom 1 2
logfiles.zoom.us
us04logfiles.zoom.us
us04zpns.zoom.us
YouTube history 1
s.youtube.com
Hulu 1
ads-fa-darwin.hulustream.com
Epic Games Launcher 1
eulatracking-public-service-prod06.ol.epicgames.com
NVIDIA Gefore Experience 1
gfe.nvidia.com
nvgs.nvidia.cn
imgur 1
js.media-lab.ai
Spectrum login 1
pov.spectrum.net
CBS News livestream 1
production-cmp.isgprivacy.cbsi.com
FiveThirtyEight videos / National Geographic website
dcf.espn.com
Men's Health videos 1
glimmer.hearstapps.com
Settings ⚙️
Block Page
Enable Block Page → ⚠️ Enabling may cause breakage if the NextDNS Root CA is not on your devices
Anonymized EDNS Client Subnet 1
Enable Anonymized EDNS Client Subnet
Cache Boost 1
Enable Cache Boost
CNAME Flattening 1 2 3
Enable CNAME Flattening
Web3 1 2
Enable Web3
(optional)
FAQ ❓
How do I signup for NextDNS?
Click here!
Can I block YouTube ads with NextDNS only?
No, you can't block them using only DNS-level blocking (see below).
Do I still need an adblocker with NextDNS? 1
Yes. On desktops, Firefox with uBlock Origin is highly recommended:
- Cosmetic filters to hide first-party ads (e.g., YouTube ads), ad-placeholders, web annoyances, etc.
- Block DNS requests from being sent in the first place (Firefox only) 1
- Read the full list of advantages here
Mentions 📚
Guides
- FMHY: DNS Adblocking → NextDNS → Guide