NextDNS-Config/README.md

---

Guidelines 🔖

1. Prevent overblocking by utilizing the law of diminishing returns (e.g., using sane, quality blocklists; allowing most TLDs; etc.).
2. Pass the girlfriend test with few exceptions. These deviations are documented throughout the guide.

---

Security 👮‍♂️

Security settings protect your data from harm, theft, and unauthorized use.^{^why does this matter?}

Threat Intelligence Feeds ¹

Use Threat Intelligence Feeds

AI-Driven Threat Detection

Enable AI-Driven Threat Detection

Google Safe Browsing ^{1 2 3}

Enable Google Safe Browsing

Cryptojacking Protection ¹

Enable Cryptojacking Protection

DNS Rebinding Protection ^{1 2}

Enable DNS Rebinding Protection

IDN Homograph Attacks Protection

Enable Homograph Attacks Protection

Typosquatting Protection ¹

Enable Typosquatting Protection

Domain Generation Algorithms (DGAs) Protection

Enable DGA Protection

Block Newly Registered Domains (NRDs) ^{1 2 3}

⚠️ Blocking NRDs may cause false positives occasionally. Be selective when adding NRDs to your allowlist; and, if you do, NEVER give sensitive information to a NRD. If you plan to set-and-forget your configuration, disable this setting.

Block Newly Registered Domains (NRDs)

Block Dynamic DNS Hostnames ^{1 2 3}

Enable Block Dynamic DNS Hostnames

Block Parked Domains ¹

Block Parked Domains

Block Top-Level Domains (TLDs) ^{1 2 3 4 5 6}

⚠️ Blocking TLDs may cause false positives since this feature blocks both site nagviations and subrequests. However, the entries below should allow for everyday browsing while offering protection against commonly abused TLDs. If you plan to set-and-forget your configuration, skip this setting.

.buzz
.cricket
.discount
.gdn
.live
.loan
.loans
.ooo
.sbs
.wang

🛑 Below are additional TLDs you may block, but you may need to allowlist sites on occasion.

.work
.fit
.surf
.asia
.tokyo
---
.agency
.associates
.bid
.cam
.casa
.cf
.ci
.fit
.fun
.ga
.gq
.link
.monster
.ml
.icu
.rest
.shop
.webcam
.win

📝 If you would rather block TLDs with an adblocker (e.g., easier to troubleshoot breakage), add the first two filterlists here.

Block Child Sexual Abuse Material

Block Child Sexual Abuse Material

---

Privacy 🔒

Privacy features limit the amount of data that companies can collect about you. Privacy is a spectrum. What you need varies on your threat model, interest, and skillset.^{^why should I care? I have nothing to hide}

(You can watch this short video to understand the difference between security and privacy.)

Blocklists ¹

Blocklists are community generated lists that block ads and trackers. Filters can be categorized into five tiers of coverage:

1. None: no breakage; NextDNS still protects against malicious threats (à la security settings) but will allow ads and trackers
2. Basic: rare breakage; prioritizes functionality over blocking; very forgiving
3. Balanced: minimal breakage; largely set-and-forget but you may need to allowlist occasionally to unsubscribe from junk email
4. Strict: moderate breakage; prioritizes privacy over user experience; must manage your allowlist regularly
5. Aggressive: excessive breakage; use on a separate profile to lockdown single-purpose devices

Here's the suggested blocklists for each category:

Basic	Balanced	Strict	Aggressive
1Hosts (mini)	1Hosts (Lite)	1Hosts (Pro)	1Hosts (Xtra)
	oisd	oisd	Goodbye Ads
	notracking		Energized Ultimate

💡 The Balanced tier is recommended for everyday browsing, based on my testing and user feedback.^{1 2 3 4}

❓ You may wonder why other lists are not utilized. This is because many list maintainers:

• do not remove false positives and/or are no longer active ^{1 2}
• already aggregate common blocklists into their own list (Easylist/Fanboy, uBlock, AdGuard, etc.) ^{1 2 3 4 5}
• offer no meaningful additional coverage when compared with the chart combinations above

Native Tracking Protection ¹

Add all the device brands that you use. There's no advantage in adding brands you don't have; however, there’s no disadvantage in adding unused brands, either.

Xiaomi
Huawei
Samsung
Amazon Alexa
Windows
Apple
Roku
Sonos

Block Disguised Third-Party Trackers ^{1 2 3 4}

Block Disguised Third-Party Trackers

Allow Affiliate & Tracking Links ^{1 2}

💡 Your IP address will automatically be hidden (via TCP proxying) to preserve your privacy.

Allow Affiliate & Tracking Links

---

Parental Control 👨‍👩‍👦

YouTube Restricted Mode

Enforce YouTube Restricted Mode

Block Bypass Methods ¹

Block Bypass Methods

---

Denylist ⛔

Denylist entries block any requests from that source. The entries below may further harden Balanced blocklist profiles while not interfering with everyday browsing.

Google crap

device-provisioning.googleapis.com
firebaseinstallations.googleapis.com* (may cause breakage)
firebaselogging-pa.googleapis.com
googletagmanager.com

Twitter tracker

syndication.twitter.com

NVIDIA Gefore Experience ¹

events.gfe.nvidia.com

Junk surveillance software

spappmonitoring.com
a-spy.com
alltracker.org
aispyer.com

---

Allowlist ✅

Allowlist entries override any blocks. These entries may be needed for Strict and Aggressive blocklist profiles.

Facebook / Instagram ¹

graph.facebook.com
graph.instagram.com
i.instagram.com

Apple device updates ¹ / Apple Music ²

xp.apple.com

Apple iMessage GIFs ¹ / Spotlight Search ²

smoot.apple.com

Apple Store ¹

amp-api-edge.apps.apple.com
amp-api-search-edge.apps.apple.com

Xiaomi device updates ¹

update.intl.miui.com

Spectrum login ¹

pov.spectrum.net

Zoom ^{1 2}

logfiles.zoom.us
us04logfiles.zoom.us
us04zpns.zoom.us

YouTube history ¹

s.youtube.com

Hulu ¹

ads-fa-darwin.hulustream.com

Epic Games Launcher ¹

eulatracking-public-service-prod06.ol.epicgames.com

NVIDIA Gefore Experience ¹

gfe.nvidia.com
nvgs.nvidia.cn

imgur ^{1 2}

js.media-lab.ai

CBS News livestream ¹

production-cmp.isgprivacy.cbsi.com

FiveThirtyEight videos / National Geographic website ¹

dcf.espn.com

Men's Health videos ¹

glimmer.hearstapps.com

---

Settings ⚙️

Logs

Storage location → Switzerland

Block Page

Enable Block Page → ⚠️ Enabling may cause breakage if the NextDNS Root CA is not on your devices

Anonymized EDNS Client Subnet ¹

Enable Anonymized EDNS Client Subnet

Cache Boost ¹

Enable Cache Boost

CNAME Flattening ^{1 2 3}

Enable CNAME Flattening

Web3 ^{1 2}

Enable Web3

(optional)

---

FAQ ❓

How do I signup for NextDNS?

Click here!

Can I block YouTube ads with NextDNS only?

No, you can't block first-party ads using only DNS-level blocking (see below).

Do I still need an adblocker with NextDNS? ¹

Yes. On desktops, Firefox with uBlock Origin is highly recommended:

• Cosmetic filters to hide first-party ads (e.g., YouTube ads), ad-placeholders, web annoyances, etc.
• Block DNS requests from being sent in the first place (Firefox only) ¹
• Read the full list of advantages here

Does NextDNS hide internet activity from my Internet Service Provider (ISP)?

No. NextDNS is only concerned about DNS traffic. You would need a quality VPN to hide all activity from your ISP.

---

Mentions 📚

User Comments: 1 2 3 4

Guides

• FMHY: DNS Adblocking → NextDNS → Guide

Contributions

• 1Hosts
• Easylist
• AdGuard
• uBlock Origin

---

23 July 2022