11 ms·

Show HN: nextdns.io – A Combination of Cloudflare DNS and Pi-Hole

372 points by nextdns 7y ago

nextdns 7y ago
We've been working super hard on nextdns.io, a cloud-based private DNS service that gives you full control over what is allowed or blocked on your devices. Here is a few things you can do with it: - Block malicious websites, trackers, ads, and more by combining the most popular blocklists out there, all updated in real-time (100+ lists to choose from). - Set your own privacy requirements: you decide what type of logs are kept (and for how long) depending on the level of analytics you want. Down to absolutely NO logs. - Automatically use DNS-over-HTTPS on all networks (including cellular) with our apps for Android, iOS, Windows and macOS. They are all tiny, tightly integrated with the OS and have negligible battery usage. (Some of them are still being worked on.) - Bypass nearly all forms of government/ISP censorship without the need for a slow/costly VPN, and make it way harder for your ISP to know what you are doing on the Internet. - Get in-depth analytics and real-time query logs so you can measure the efficiency of your blocking strategy, see when the apps on your devices are calling home, etc. And choose what is logged down to absolutely no logs, you decide. - Easily protect your family (you can create as many configurations as you want on one account, each with different settings, and you can use multiple different configurations while being on the same network). It also supports all the latest DNS technologies (DNS-over-HTTPS/TLS, Query Name Minimisation, DNSSEC validation, etc.), and it's fast (for most countries, we are or will very soon be as low-latency as Google DNS, Cloudflare and the likes). There are tons of other cool stuff we built into that service (like the fact that each configuration gets its own DoH/DoT endpoint and IPv6) but that post is already way too long :) We recorded a short GIF of us browsing through the interface: https://gfycat.com/LinedVerifiableBellfrog https://gfycat.com/LinedVerifiableBellfrog You can create your first configuration and test it right away without signing up (you can sign up later and "save" it). We would really appreciate if you could try the service, tell us what you like, what you don't like, what you would add, etc. We will happily answer all questions (even the technical ones). Cheers, and thanks!
- AtHeartEngineer 7y ago
  Good on ya. How is this all being paid for? How are you making money? Is there a subscription fee?
  - nextdns 7y ago
    It's free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
    - AtHeartEngineer 7y ago
      Awesome, that sounds pretty good
    - jen729w 7y ago
      I love this model. Get people in for free, let them discover how fabulous it is, then by the time they need a pro-grade thing they're happy to throw money at you. See also: Netlify. Best of luck! Looks great.
- freedomben 7y ago
  Is your source code open? This looks really cool. I'm nervous about entrusting someone with stuff as sensitive as DNS. If this is all it appears to be, I may be a paying customer (tho I try to only use/pay for free-as-in-speech software).
  - bscphil 7y ago
    >I try to only use/pay for free-as-in-speech software I would like to see more software adopt this model. Can you give a few examples of things you support? Are they all pay-for-hosting services, or are there cases where the software itself is for sale?
    - dual_basis 7y ago
keiraarts 7y ago
This is incredibly useful and the on boarding is effortless. Great job - I'd love to know if you plan on charging for this.
- nextdns 7y ago
  Thanks! Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
AlphaWeaver 7y ago
This looks really polished, well designed, and most importantly: simple. The privacy policy [0] also shines: it's five points and very specific. [0]: https://www.nextdns.io/privacy https://www.nextdns.io/privacy
- nextdns 7y ago
  Thanks! Simple is definitely what we were aiming for.
vkdelta 7y ago
Is anyone having problem with redeeming this testflight code "AFDFPLP3" It does not accept "A" at the beginning.
- nextdns 7y ago
  Damn you're right, we have no idea why. Clicking this link in iOS will work though, for some reason: https://testflight.apple.com/join/AFDFPLP3 https://testflight.apple.com/join/AFDFPLP3
  - vkdelta 7y ago
    yes, Probably an apple bug. Will check with few folks. I typed the link manually. using it now! Great product. Have sent you few questions.
miki725 7y ago
Personally I run either pihole or something similar however setting something similar for all the friends is a bit cumbersome as it at least requires getting a raspberry pi. This seems like a really intriguing alternative although will voice similar concerns as others are expressing that the site does not indicate the source of the funding, motivations for the project, etc. As such that could be a barrier to entrust something as personal as DNS to a service without understanding their motivations and future plans. Would be great if that could be better outlined on the site.
- nextdns 7y ago
  Motivations: like most tech startups, scratching your own itch :) Funding: Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
  - underwater 7y ago
    I wouldn't know if 500k is a little or a lot.
    - Sebguer 7y ago
      Seems like it's close to what a 'normal' household would consume: https://support.opendns.com/hc/en-us/community/posts/220112648-What-s-an-average-of-Daily-DNS-requests-83k-Network-compromised- https://support.opendns.com/hc/en-us/community/posts/2201126...
    - jamesog 7y ago
      According to my nextdns analytics from the last few weeks my house has peaked at around 28,000 queries a day, 331k so far this month. Nextdns is blocking somewhere in the region of 400-600 queries each day, mostly things like Google Analytics, Apple iAd.
      - PappaPatat 7y ago
ignoramous 7y ago
Nice. DNS has grown notoriously complex over the years and it is hard work to run a standards compliant service. Congratulations. A few suggestions: - Auto-detect OS and suggest specific setup instructions right on the landing page? - The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that? - simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard DNS on PC. You could include instructions in the Windows section for that? https://dnscrypt.info/implementations/ https://dnscrypt.info/implementations/ - Provide a generic DNS endpoint like AdGuard does? A few questions: - What's the backend that fronts DoH, DoT, and DNSCrypt queries? Is it simply relayed to Cloudflare underneath the covers? How do you do that? - Re: Privacy Policy: "We store user data following modern security standards". What user data is stored using what modern standards? I like the terse policy document, but I feel there needs to be a fine print detailing data collection and data retention. Examples: https://s3.amazonaws.com/lantern/LanternPrivacyPolicy.pdf https://s3.amazonaws.com/lantern/LanternPrivacyPolicy.pdf and https://info.ecosia.org/privacy https://info.ecosia.org/privacy Thanks.
- nextdns 7y ago
  Thanks! > Auto-detect OS and suggest specific setup instructions right on the landing page? It should already pre-select your OS tab on my.nextdns.io on the Setup page? If that's not the case, then it's probably a bug. > The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that? Weird, we will have a look. > simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard DNS on PC. You could include instructions in the Windows section for that? https://dnscrypt.info/implementations/ https://dnscrypt.info/implementations/ You can use your custom sdns:// endpoint listed on the Setup page, we assumed users using dnscrypt clients would know what this means. Good point, we will add setup instructions for it. > Provide a generic DNS endpoint like AdGuard does? We already have them, we decided to not show them on the website as it may confuse users. We may add them back. > What's the backend that fronts DoH, DoT, and DNSCrypt queries? Is it simply relayed to Cloudflare underneath the covers? How do you do that? It's a custom-made backend, and we recurse using unbound (we don't forward to cloudflare or anything like that). > Re: Privacy Policy: "We store user data following modern security standards". What user data is stored using what modern standards? I like the terse policy document, but I feel there needs to be a fine print detailing data collection and data retention. We will definitely improve that, we had to make some calls on priorities for the launch.
sstanfie 7y ago
Tried using: set my Meraki to serve up the IP address given by the dashboard. The my.nextdns.io dashboard says something like "this device is using a different configuration with nextdns". I think it happens after you configure an anonymous DNS, then you create an account. It feels like my configuration got disconnected or something. Hard to describe. Regardless, the blacklist/whitelist didn't work. Maybe a caching problem? Will try back later.
- homero 7y ago
  The router, os and browser can cache so whitelist takes a while
steve918 7y ago
I'm not sure how this is different than OpenDNS?
- shireboy 7y ago
  I’ve been using opendns but iOS doesn’t let you set dns for your cell connection and for WiFi it has to be set once per network. cloudflare 1.1.1.1 was nice in that the app set up a vpn with the dns so that it works on all connections. But they don’t give you control over dns, blacklists etc. this is the control of opendns with the convenience of the vpn app.
- jedisct1 7y ago
  https://www.nextdns.io/privacy https://www.nextdns.io/privacy vs https://www.cisco.com/c/en/us/about/legal/privacy-full.html https://www.cisco.com/c/en/us/about/legal/privacy-full.html
shireboy 7y ago
Very nice. I’ve been annoyed opendns hasn’t done similar and hoping something like this would come around.
- nextdns 7y ago
  Them getting bought by Cisco has greatly hindered their ability to innovate and stay current I guess.
sneak 7y ago
Be advised: pi-hole ignores security issues in their product. https://github.com/pi-hole/pi-hole/issues/2704 https://github.com/pi-hole/pi-hole/issues/2704
- jedberg 7y ago
  I’ve been a security professional for 20+ years and I agree with them. You’re complaining about an attack surface that would be more easily explored in a bunch of different ways. I’m not sure why you bring this up on every post vaguely related to pi-hole.
  - sneak 7y ago
    I bring it up just so that people are aware and can make their own decision about risk/benefit when choosing to deploy the software. There is obviously room for opinion on the matter and I specifically am not claiming that the project is bad or should be avoided, just that people using it in a default config out of the box know the risks that that presents. The “be advised” is just that. It’s not a big deal, and I think I only mentioned it once before.
- CraftThatBlock 7y ago
  Just to know, this isn't using Pi-Hole (from what I understand). This is a "Pi-Hole-like" service.
  - nextdns 7y ago
    Confirming that we are not using Pi-hole, the title is just a catchy way of explaining the service.
sergiomattei 7y ago
How do you make money? How can I make sure you won't sell my data?
- nextdns 7y ago
  The service is free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic. Selling data is against what we believe in and would also be counter-productive (everybody would stop using the service instantly).
  - elitistphoenix 7y ago
    Could your beta testers get a better deal? If not could we stay beta testers and get a better deal?
  - Terretta 7y ago
    Happy to pay. Your feature set is already fantastic, and love the many methods to leverage it from various devices or configurations. But has to be rock solid, and fast.
yegle 7y ago
I don't understand why any privacy conscious person would choose a hosted service instead of self-hosting your own solution. Implementing the whole thing (modulo the anycast IP, which is the only thing I did not use) is easy. I have a docker-compose file which does the whole stack: 1. Unbound DNS which provides DNS-over-TLS service at port 853. It forward request to my local pihole's 53 port. 2. Pihole forward request to my Stubby DNS server. 3. Stubby connects to Google DNS over DNS-over-TLS. 4. A separate docker container to run certbot to update certificate used by the unbound container. 5. A separate docker container with Pomerium as reverse proxy so I can remote access PiHole UI. Then you can configure your Android phone to use your unbound DNS server as the "private DNS" server. I've being using this setup for more than a month and works really well. UPDATE: I posted my docker-compose.yaml file at https://github.com/yegle/your-dns https://github.com/yegle/your-dns. I'll update the README soon.
- judge2020 7y ago
  Could you share your compose file or the images you're using?
  - yegle 7y ago
    I just posted it https://github.com/yegle/your-dns https://github.com/yegle/your-dns.
- hn-reader-123 7y ago
  A sidenote -- Anycast is trivially easy to setup; with their current host, Vultr, offering essentially turn-key solutions.
  - LogicX 7y ago
    There’s a large distinction between BGP announcing and running a properly balanced anycast network. Vultr is not designed for this, they have limited bgp community strings - so running an anycast network there will work either only with select locations, or with sinkholes pulling in traffic from far away.
- 7y ago
CraftThatBlock 7y ago
This is really great! Is their any plan to improve performance? Google and CloudFlare are both ~15ms in my location (Montreal), while nextdns seems to be around ~30ms (which isn't bad per se).
malnourish 7y ago
I would love to try this, but I don't know if I can trust the Privacy Policy, as ignoramus brought up. Could you please explain what data you store and with whom and under what circumstances it would be shared?
nyolfen 7y ago
very cool! might i recommend creating a config for dnscloak?
- jedisct1 7y ago
  DNSCloak has a built-in config editor, so you can add a static section with the DNS Stamp for your NextDNS endpoint. But yes, NextDNS should provide something that's ready to copy-and-paste.
fredsanford 7y ago
This is a service I've been looking for! But... Why do you need a shitton of javascript to load your main page? I cannot see the main page with ublock origin + umatrix blocking 3rd party and firefox finger print resistant options turned on.
- nextdns 7y ago
  It's probably the map + the chat thing (only things that are third party, and won't stay there for long), we will fix.
superasn 7y ago
I've been using adguard dns for a while and while it's an amazing service for mobile, the thing I don't like about it is that it's super aggressive at blocking malware sites and sometimes even blocks legit sites with no way to whitelist. I believe your service would also solves this problem. Congrats on the launch too!
chimen 7y ago
Nice. Congrats on the release! If you're allowing custom profiles with custom block/whitelist domains it means you're holding a database on this thing and doing lots of queries on requests. Will your product be able to scale with more users since it's free? How are you keeping all this logic from affecting your latency? I'm curious of technical implementations that's all.
polskibus 7y ago
What is the monetization plan? How have you financed the development so far?
- keybits 7y ago
  From the OP on another reply: > Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
  - polskibus 7y ago
    Would be great if they put it high on the front page. Someone privacy-focused may be worried when he sees something privacy-oriented advertised without a business plan, which could indicate that selling data to advertisers could be the secret.
egamirorrim 7y ago
Possibly a very ignorant question, this looks cool but why would I use it over Cloudflare's 1.1.1.1 with DNS-over-https (or another encrypted method)?
- philshem 7y ago
  Because it’s PiHole, you can black/whitelist custom domains, temporarily disable, see traffic, etc
- Terretta 7y ago
  That doesn't get rid of ads.
jamesog 7y ago
I've been using nextdns since I saw it posted on Twitter a few weeks ago. It's been great. I used to run something like PiHole on my home network but ultimately dnsmasq is not a good DNS server so I ditched it. I've been running CoreDNS for a while, forwarding to Google DNS and Cloudflare DNS (both using DNS over TLS) for a while and that worked fine. I'd augmented CoreDNS to serve a hosts file as a blocklist, similar to PiHole. Nextdns has replaced Google and Cloudflare as forwarders in CoreDNS and it's working really well. I've been liking the proper network-level ad-blocking and being able to use the analytics to figure out what was blocked when something doesn't work. The nextdns guys are also really responsive and helpful. One of them spent a couple of hours on live-chat with me debugging an analytics issue.
- iuguy 7y ago
  What's wrong with DNSmasq?
  - jamesog 7y ago
    It's not great as a DNS server. It has some really odd behaviour. One of the things which used to annoy me a lot when using it as a recursor is things like `dig +trace` would just stop at dnsmasq, so you'd have to bypass it by doing something like `dig +trace @8.8.8.8`. Every DNS expert I know says to avoid dnsmasq. It works fine as a DHCP server, though.
oceankid 7y ago
Really well designed and communicated. Things are kept simple and advanced knobs are made possible.
OJFord 7y ago
> A combination of CloudFlare DNS and Pi-Hole The tagline on the site is actually 'we like to think of it as ^...' Per comments here I don't think it actually uses CF or Pi-Hole, so the title's a bit off.
lepouet 7y ago
Not high priority but maybe you could explain the different blocking methods on the settings page ?
kweks 7y ago
Bypasses Turkish government blocks on Wikipedia etc, which I hadn't been able to figure out even with google/CF over HTTPS. Awesome!
- macns 7y ago
  oh wow I had no idea about this: https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey
  - canada_dry 7y ago
    Well now, we can't very well have Turkish citizens read up about their leader's election fraud - can we?!? https://en.wikipedia.org/wiki/Recep_Tayyip_Erdo%C4%9Fan#Electoral_fraud https://en.wikipedia.org/wiki/Recep_Tayyip_Erdo%C4%9Fan#Elec... And forget about reading up on the faux coup d'état. https://en.wikipedia.org/wiki/2016_Turkish_coup_d%27%C3%A9tat_attempt https://en.wikipedia.org/wiki/2016_Turkish_coup_d%27%C3%A9ta...
kissgyorgy 7y ago
There is a very important use-case which you can do on a local network but can't with this: setting up a DHCP server and pushing a default DNS server address even to clients which network settings you don't have access to, is possible locally. Xbox, streaming devices, non-geek friends devices, etc. Pihole can do this and ohmygod it's life changing!
- deleted 7y ago
  [deleted]
- 713233eb 7y ago
  And you can also redirect all port 53 traffic to PiHole on the gateway and let only PiHole query DNS to circumvent clients that use hardcoded IP addresses (e.g. 8.8.8.8 by default)
- Terretta 7y ago
  This works with this service. You can associate your public IP (your router's WAN) with a custom blocking configuration. Then you put their AnyCast IP address in your DHCP server's DNS server list. The local devices will use that address, be seen from your public IP, and get the custom config you want.
- dual_basis 7y ago
  This doesn't have anything to do with running a local PiHole, it's just a feature of having a local DHCP server. Any typical home router also has a local DHCP server, and if you change the DNS associated with the internet connection on the router this will be passed on to any device which connects via DHCP.
- homero 7y ago
  No any router supports doing that
neonhz 7y ago
I suggest just to use pihole at home on a rpi device. Granting a new and small company may be orders of magnitude worse than giving info to the 'evil' unicorns. The big fishes are continuously monitored by a wide community and from the governments as well. I wouldn't give such a private information to anyone not proving that all my private data is treated as it deserves. The only way I can see this happening would be to have them release everything to the Foss community.
FullMetalBitch 7y ago
I was going to implement pi-hole for a non-profit organization I may use this instead.
- nextdns 7y ago
  Please reach out to us in the future, we will definitely have some discount, or be free, for serious non-profits.
t0astbread 7y ago
Sounds interesting but what benefits does this solution have over just blacklisting via /etc/hosts?
deleted 7y ago
[deleted]
dual_basis 7y ago
This seems great! I've been wanting to try out Pi-Hole for some time now, but I was concerned about how it might impact the other members of the family who would get annoyed if it made other services stop working. Thanks for making a free beta available as well! Your setup page is fantastic! Especially appreciate the status indicating if it is set up correctly on the device I am using. I set it up on Linux, which I notice you don't have a tab for, but that should be pretty straightforward to add. (Even though Linux users may, typically, know how to do this themselves, it might be nice to include Linux as a signal that it is truly cross-platform.) I noticed inconsistent results on Android depending on whether I had it set up via Intra or as DNS-over-TLS in the native Android settings. Internet browsing was similar to on desktop, either way, but my concern is mostly related to video apps, specifically the ones my family use (Hulu, YouTube, CWSeed). On Intra, all the video apps seemed to work but there were still ads in all of them. For DNS-over-TLS CWSeed stopped working entirely, saying "video playback failed". Hulu and YouTube still worked but they also still had ads, while on Desktop they did not! These are the sort of issues I was concerned about when considering using PiHole for the whole house. Are these things that can be mitigated on your end, or will they require per-device apps to be installed, and potentially even require rooting the device? (Incidentally, how is it that YouTube and Hulu get around the ad blocker on Android?)
- mthoms 7y ago
  FWIW I bought a Raspberry Pi and installed Pi-Hole a few months back. It's been almost flawless for us. Adding to the domain whitelist and/or disabling the DNS blocking temporarily (in case of issues) is dead simple for anyone in the family. You just need to provide them with the local IP address of your Pi. The GUI - at least for these simple tasks - is quite straight forward. I agree though, this service looks very promising.
pssflops 7y ago
I'm in no-way a power user in this space so the simplicity and descriptions were very helpful and I'm looking forward to supporting this when you release a payment model. Excellent results so far, only a few pages had trouble loading and a simple reload fixed it.
sc_ 7y ago
I use unbound + dnscrypt-proxy + https://github.com/oznu/dns-zone-blacklist https://github.com/oznu/dns-zone-blacklist to do pretty much this. WireGuard also adds another layer & sets DNS easily per client. Hosted on a $5/month VPS, works very well.
raghavdua_cse18 7y ago
Really Cool, I have set up something similar for my family and is paying $20 every month for VPS, I have tried NextDNS and found it be really useful and considering the pricing structure which you mentioned in the comments, your product seems to be a far more affordable option. A few suggestions: 1) Consider launching an App for managing configurations or at least make the current web app a PWA 2) Allow users to create duplicate configurations 3) In the logs section of the analytics page, I saw that some blocked domains were being resolved, it was saying that the domains were manually whitelisted(they were not) 4) Allow adding custom hosts file sources 5) You can create a Windows/MacOS app for updating dynamic IP address(similar to the one provided by OpenDNS) 6) You can give a button to whitelist domains in the log section, just like the one provided by the PiHole in the Query page of its web UI 7) Allow adding multiple domains to whitelist & blacklist at once 8) Allow regex and wildcard blocking 9) Mobile UI is not 100% responsive
novaleaf 7y ago
would be perfect with scheduling.
lucasverra 7y ago
I've implemented on my iPhone and still get ads on youtube native app. How to remove them ?
aembleton 7y ago
When i use nextDNS I can't cast from the YouTube Android app to my Chromecast. This is with nothing being blocked. I can cast from the Netflix and iPlayer apps. Just not from Youtube. It works again as soon as I switch back to a different DNS provider. Has anyone else seen this?

372 points by nextdns 7y ago

We've been working super hard on nextdns.io, a cloud-based private DNS service that gives you full control over what is allowed or blocked on your devices. Here is a few things you can do with it: - Block malicious websites, trackers, ads, and more by combining the most popular blocklists out there, all updated in real-time (100+ lists to choose from). - Set your own privacy requirements: you decide what type of logs are kept (and for how long) depending on the level of analytics you want. Down to absolutely NO logs. - Automatically use DNS-over-HTTPS on all networks (including cellular) with our apps for Android, iOS, Windows and macOS. They are all tiny, tightly integrated with the OS and have negligible battery usage. (Some of them are still being worked on.) - Bypass nearly all forms of government/ISP censorship without the need for a slow/costly VPN, and make it way harder for your ISP to know what you are doing on the Internet. - Get in-depth analytics and real-time query logs so you can measure the efficiency of your blocking strategy, see when the apps on your devices are calling home, etc. And choose what is logged down to absolutely no logs, you decide. - Easily protect your family (you can create as many configurations as you want on one account, each with different settings, and you can use multiple different configurations while being on the same network). It also supports all the latest DNS technologies (DNS-over-HTTPS/TLS, Query Name Minimisation, DNSSEC validation, etc.), and it's fast (for most countries, we are or will very soon be as low-latency as Google DNS, Cloudflare and the likes). There are tons of other cool stuff we built into that service (like the fact that each configuration gets its own DoH/DoT endpoint and IPv6) but that post is already way too long :) We recorded a short GIF of us browsing through the interface: https://gfycat.com/LinedVerifiableBellfrog https://gfycat.com/LinedVerifiableBellfrog You can create your first configuration and test it right away without signing up (you can sign up later and "save" it). We would really appreciate if you could try the service, tell us what you like, what you don't like, what you would add, etc. We will happily answer all questions (even the technical ones). Cheers, and thanks!

AtHeartEngineer 7y ago
Good on ya. How is this all being paid for? How are you making money? Is there a subscription fee?
- nextdns 7y ago
  It's free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
  - AtHeartEngineer 7y ago
    Awesome, that sounds pretty good
  - jen729w 7y ago
    I love this model. Get people in for free, let them discover how fabulous it is, then by the time they need a pro-grade thing they're happy to throw money at you. See also: Netlify. Best of luck! Looks great.
freedomben 7y ago
Is your source code open? This looks really cool. I'm nervous about entrusting someone with stuff as sensitive as DNS. If this is all it appears to be, I may be a paying customer (tho I try to only use/pay for free-as-in-speech software).
- bscphil 7y ago
  >I try to only use/pay for free-as-in-speech software I would like to see more software adopt this model. Can you give a few examples of things you support? Are they all pay-for-hosting services, or are there cases where the software itself is for sale?
  - dual_basis 7y ago

keiraarts 7y ago

This is incredibly useful and the on boarding is effortless. Great job - I'd love to know if you plan on charging for this.

nextdns 7y ago
Thanks! Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.

AlphaWeaver 7y ago

This looks really polished, well designed, and most importantly: simple. The privacy policy [0] also shines: it's five points and very specific. [0]: https://www.nextdns.io/privacy https://www.nextdns.io/privacy

nextdns 7y ago
Thanks! Simple is definitely what we were aiming for.

vkdelta 7y ago

Is anyone having problem with redeeming this testflight code "AFDFPLP3" It does not accept "A" at the beginning.

nextdns 7y ago
Damn you're right, we have no idea why. Clicking this link in iOS will work though, for some reason: https://testflight.apple.com/join/AFDFPLP3 https://testflight.apple.com/join/AFDFPLP3
- vkdelta 7y ago
  yes, Probably an apple bug. Will check with few folks. I typed the link manually. using it now! Great product. Have sent you few questions.

miki725 7y ago

Personally I run either pihole or something similar however setting something similar for all the friends is a bit cumbersome as it at least requires getting a raspberry pi. This seems like a really intriguing alternative although will voice similar concerns as others are expressing that the site does not indicate the source of the funding, motivations for the project, etc. As such that could be a barrier to entrust something as personal as DNS to a service without understanding their motivations and future plans. Would be great if that could be better outlined on the site.

nextdns 7y ago
Motivations: like most tech startups, scratching your own itch :) Funding: Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
- underwater 7y ago
  I wouldn't know if 500k is a little or a lot.
  - Sebguer 7y ago
    Seems like it's close to what a 'normal' household would consume: https://support.opendns.com/hc/en-us/community/posts/220112648-What-s-an-average-of-Daily-DNS-requests-83k-Network-compromised- https://support.opendns.com/hc/en-us/community/posts/2201126...
  - jamesog 7y ago
    According to my nextdns analytics from the last few weeks my house has peaked at around 28,000 queries a day, 331k so far this month. Nextdns is blocking somewhere in the region of 400-600 queries each day, mostly things like Google Analytics, Apple iAd.
    - PappaPatat 7y ago

ignoramous 7y ago

Nice. DNS has grown notoriously complex over the years and it is hard work to run a standards compliant service. Congratulations. A few suggestions: - Auto-detect OS and suggest specific setup instructions right on the landing page? - The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that? - simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard DNS on PC. You could include instructions in the Windows section for that? https://dnscrypt.info/implementations/ https://dnscrypt.info/implementations/ - Provide a generic DNS endpoint like AdGuard does? A few questions: - What's the backend that fronts DoH, DoT, and DNSCrypt queries? Is it simply relayed to Cloudflare underneath the covers? How do you do that? - Re: Privacy Policy: "We store user data following modern security standards". What user data is stored using what modern standards? I like the terse policy document, but I feel there needs to be a fine print detailing data collection and data retention. Examples: https://s3.amazonaws.com/lantern/LanternPrivacyPolicy.pdf https://s3.amazonaws.com/lantern/LanternPrivacyPolicy.pdf and https://info.ecosia.org/privacy https://info.ecosia.org/privacy Thanks.

nextdns 7y ago
Thanks! > Auto-detect OS and suggest specific setup instructions right on the landing page? It should already pre-select your OS tab on my.nextdns.io on the Setup page? If that's not the case, then it's probably a bug. > The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that? Weird, we will have a look. > simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard DNS on PC. You could include instructions in the Windows section for that? https://dnscrypt.info/implementations/ https://dnscrypt.info/implementations/ You can use your custom sdns:// endpoint listed on the Setup page, we assumed users using dnscrypt clients would know what this means. Good point, we will add setup instructions for it. > Provide a generic DNS endpoint like AdGuard does? We already have them, we decided to not show them on the website as it may confuse users. We may add them back. > What's the backend that fronts DoH, DoT, and DNSCrypt queries? Is it simply relayed to Cloudflare underneath the covers? How do you do that? It's a custom-made backend, and we recurse using unbound (we don't forward to cloudflare or anything like that). > Re: Privacy Policy: "We store user data following modern security standards". What user data is stored using what modern standards? I like the terse policy document, but I feel there needs to be a fine print detailing data collection and data retention. We will definitely improve that, we had to make some calls on priorities for the launch.

sstanfie 7y ago

Tried using: set my Meraki to serve up the IP address given by the dashboard. The my.nextdns.io dashboard says something like "this device is using a different configuration with nextdns". I think it happens after you configure an anonymous DNS, then you create an account. It feels like my configuration got disconnected or something. Hard to describe. Regardless, the blacklist/whitelist didn't work. Maybe a caching problem? Will try back later.

homero 7y ago
The router, os and browser can cache so whitelist takes a while

steve918 7y ago

I'm not sure how this is different than OpenDNS?

shireboy 7y ago
I’ve been using opendns but iOS doesn’t let you set dns for your cell connection and for WiFi it has to be set once per network. cloudflare 1.1.1.1 was nice in that the app set up a vpn with the dns so that it works on all connections. But they don’t give you control over dns, blacklists etc. this is the control of opendns with the convenience of the vpn app.
jedisct1 7y ago
https://www.nextdns.io/privacy https://www.nextdns.io/privacy vs https://www.cisco.com/c/en/us/about/legal/privacy-full.html https://www.cisco.com/c/en/us/about/legal/privacy-full.html

shireboy 7y ago

Very nice. I’ve been annoyed opendns hasn’t done similar and hoping something like this would come around.

nextdns 7y ago
Them getting bought by Cisco has greatly hindered their ability to innovate and stay current I guess.

sneak 7y ago

Be advised: pi-hole ignores security issues in their product. https://github.com/pi-hole/pi-hole/issues/2704 https://github.com/pi-hole/pi-hole/issues/2704

jedberg 7y ago
I’ve been a security professional for 20+ years and I agree with them. You’re complaining about an attack surface that would be more easily explored in a bunch of different ways. I’m not sure why you bring this up on every post vaguely related to pi-hole.
- sneak 7y ago
  I bring it up just so that people are aware and can make their own decision about risk/benefit when choosing to deploy the software. There is obviously room for opinion on the matter and I specifically am not claiming that the project is bad or should be avoided, just that people using it in a default config out of the box know the risks that that presents. The “be advised” is just that. It’s not a big deal, and I think I only mentioned it once before.
CraftThatBlock 7y ago
Just to know, this isn't using Pi-Hole (from what I understand). This is a "Pi-Hole-like" service.
- nextdns 7y ago
  Confirming that we are not using Pi-hole, the title is just a catchy way of explaining the service.

sergiomattei 7y ago

How do you make money? How can I make sure you won't sell my data?

nextdns 7y ago
The service is free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic. Selling data is against what we believe in and would also be counter-productive (everybody would stop using the service instantly).
- elitistphoenix 7y ago
  Could your beta testers get a better deal? If not could we stay beta testers and get a better deal?
- Terretta 7y ago
  Happy to pay. Your feature set is already fantastic, and love the many methods to leverage it from various devices or configurations. But has to be rock solid, and fast.

yegle 7y ago

I don't understand why any privacy conscious person would choose a hosted service instead of self-hosting your own solution. Implementing the whole thing (modulo the anycast IP, which is the only thing I did not use) is easy. I have a docker-compose file which does the whole stack: 1. Unbound DNS which provides DNS-over-TLS service at port 853. It forward request to my local pihole's 53 port. 2. Pihole forward request to my Stubby DNS server. 3. Stubby connects to Google DNS over DNS-over-TLS. 4. A separate docker container to run certbot to update certificate used by the unbound container. 5. A separate docker container with Pomerium as reverse proxy so I can remote access PiHole UI. Then you can configure your Android phone to use your unbound DNS server as the "private DNS" server. I've being using this setup for more than a month and works really well. UPDATE: I posted my docker-compose.yaml file at https://github.com/yegle/your-dns https://github.com/yegle/your-dns. I'll update the README soon.

judge2020 7y ago
Could you share your compose file or the images you're using?
- yegle 7y ago
  I just posted it https://github.com/yegle/your-dns https://github.com/yegle/your-dns.
hn-reader-123 7y ago
A sidenote -- Anycast is trivially easy to setup; with their current host, Vultr, offering essentially turn-key solutions.
- LogicX 7y ago
  There’s a large distinction between BGP announcing and running a properly balanced anycast network. Vultr is not designed for this, they have limited bgp community strings - so running an anycast network there will work either only with select locations, or with sinkholes pulling in traffic from far away.
7y ago

CraftThatBlock 7y ago

This is really great! Is their any plan to improve performance? Google and CloudFlare are both ~15ms in my location (Montreal), while nextdns seems to be around ~30ms (which isn't bad per se).

malnourish 7y ago

I would love to try this, but I don't know if I can trust the Privacy Policy, as ignoramus brought up. Could you please explain what data you store and with whom and under what circumstances it would be shared?

nyolfen 7y ago

very cool! might i recommend creating a config for dnscloak?

jedisct1 7y ago
DNSCloak has a built-in config editor, so you can add a static section with the DNS Stamp for your NextDNS endpoint. But yes, NextDNS should provide something that's ready to copy-and-paste.

fredsanford 7y ago

This is a service I've been looking for! But... Why do you need a shitton of javascript to load your main page? I cannot see the main page with ublock origin + umatrix blocking 3rd party and firefox finger print resistant options turned on.

nextdns 7y ago
It's probably the map + the chat thing (only things that are third party, and won't stay there for long), we will fix.

superasn 7y ago

I've been using adguard dns for a while and while it's an amazing service for mobile, the thing I don't like about it is that it's super aggressive at blocking malware sites and sometimes even blocks legit sites with no way to whitelist. I believe your service would also solves this problem. Congrats on the launch too!

chimen 7y ago

Nice. Congrats on the release! If you're allowing custom profiles with custom block/whitelist domains it means you're holding a database on this thing and doing lots of queries on requests. Will your product be able to scale with more users since it's free? How are you keeping all this logic from affecting your latency? I'm curious of technical implementations that's all.

polskibus 7y ago

What is the monetization plan? How have you financed the development so far?

keybits 7y ago
From the OP on another reply: > Free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
- polskibus 7y ago
  Would be great if they put it high on the front page. Someone privacy-focused may be worried when he sees something privacy-oriented advertised without a business plan, which could indicate that selling data to advertisers could be the secret.

egamirorrim 7y ago

Possibly a very ignorant question, this looks cool but why would I use it over Cloudflare's 1.1.1.1 with DNS-over-https (or another encrypted method)?

philshem 7y ago
Because it’s PiHole, you can black/whitelist custom domains, temporarily disable, see traffic, etc
Terretta 7y ago
That doesn't get rid of ads.

jamesog 7y ago

I've been using nextdns since I saw it posted on Twitter a few weeks ago. It's been great. I used to run something like PiHole on my home network but ultimately dnsmasq is not a good DNS server so I ditched it. I've been running CoreDNS for a while, forwarding to Google DNS and Cloudflare DNS (both using DNS over TLS) for a while and that worked fine. I'd augmented CoreDNS to serve a hosts file as a blocklist, similar to PiHole. Nextdns has replaced Google and Cloudflare as forwarders in CoreDNS and it's working really well. I've been liking the proper network-level ad-blocking and being able to use the analytics to figure out what was blocked when something doesn't work. The nextdns guys are also really responsive and helpful. One of them spent a couple of hours on live-chat with me debugging an analytics issue.

iuguy 7y ago
What's wrong with DNSmasq?
- jamesog 7y ago
  It's not great as a DNS server. It has some really odd behaviour. One of the things which used to annoy me a lot when using it as a recursor is things like `dig +trace` would just stop at dnsmasq, so you'd have to bypass it by doing something like `dig +trace @8.8.8.8`. Every DNS expert I know says to avoid dnsmasq. It works fine as a DHCP server, though.

oceankid 7y ago

Really well designed and communicated. Things are kept simple and advanced knobs are made possible.

OJFord 7y ago

> A combination of CloudFlare DNS and Pi-Hole The tagline on the site is actually 'we like to think of it as ^...' Per comments here I don't think it actually uses CF or Pi-Hole, so the title's a bit off.

lepouet 7y ago

Not high priority but maybe you could explain the different blocking methods on the settings page ?

kweks 7y ago

Bypasses Turkish government blocks on Wikipedia etc, which I hadn't been able to figure out even with google/CF over HTTPS. Awesome!

macns 7y ago
oh wow I had no idea about this: https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey
- canada_dry 7y ago
  Well now, we can't very well have Turkish citizens read up about their leader's election fraud - can we?!? https://en.wikipedia.org/wiki/Recep_Tayyip_Erdo%C4%9Fan#Electoral_fraud https://en.wikipedia.org/wiki/Recep_Tayyip_Erdo%C4%9Fan#Elec... And forget about reading up on the faux coup d'état. https://en.wikipedia.org/wiki/2016_Turkish_coup_d%27%C3%A9tat_attempt https://en.wikipedia.org/wiki/2016_Turkish_coup_d%27%C3%A9ta...

kissgyorgy 7y ago

There is a very important use-case which you can do on a local network but can't with this: setting up a DHCP server and pushing a default DNS server address even to clients which network settings you don't have access to, is possible locally. Xbox, streaming devices, non-geek friends devices, etc. Pihole can do this and ohmygod it's life changing!

deleted 7y ago
[deleted]
713233eb 7y ago
And you can also redirect all port 53 traffic to PiHole on the gateway and let only PiHole query DNS to circumvent clients that use hardcoded IP addresses (e.g. 8.8.8.8 by default)
Terretta 7y ago
This works with this service. You can associate your public IP (your router's WAN) with a custom blocking configuration. Then you put their AnyCast IP address in your DHCP server's DNS server list. The local devices will use that address, be seen from your public IP, and get the custom config you want.
dual_basis 7y ago
This doesn't have anything to do with running a local PiHole, it's just a feature of having a local DHCP server. Any typical home router also has a local DHCP server, and if you change the DNS associated with the internet connection on the router this will be passed on to any device which connects via DHCP.
homero 7y ago
No any router supports doing that

neonhz 7y ago

I suggest just to use pihole at home on a rpi device. Granting a new and small company may be orders of magnitude worse than giving info to the 'evil' unicorns. The big fishes are continuously monitored by a wide community and from the governments as well. I wouldn't give such a private information to anyone not proving that all my private data is treated as it deserves. The only way I can see this happening would be to have them release everything to the Foss community.

FullMetalBitch 7y ago

I was going to implement pi-hole for a non-profit organization I may use this instead.

nextdns 7y ago
Please reach out to us in the future, we will definitely have some discount, or be free, for serious non-profits.

t0astbread 7y ago

Sounds interesting but what benefits does this solution have over just blacklisting via /etc/hosts?

deleted 7y ago

[deleted]

dual_basis 7y ago

This seems great! I've been wanting to try out Pi-Hole for some time now, but I was concerned about how it might impact the other members of the family who would get annoyed if it made other services stop working. Thanks for making a free beta available as well! Your setup page is fantastic! Especially appreciate the status indicating if it is set up correctly on the device I am using. I set it up on Linux, which I notice you don't have a tab for, but that should be pretty straightforward to add. (Even though Linux users may, typically, know how to do this themselves, it might be nice to include Linux as a signal that it is truly cross-platform.) I noticed inconsistent results on Android depending on whether I had it set up via Intra or as DNS-over-TLS in the native Android settings. Internet browsing was similar to on desktop, either way, but my concern is mostly related to video apps, specifically the ones my family use (Hulu, YouTube, CWSeed). On Intra, all the video apps seemed to work but there were still ads in all of them. For DNS-over-TLS CWSeed stopped working entirely, saying "video playback failed". Hulu and YouTube still worked but they also still had ads, while on Desktop they did not! These are the sort of issues I was concerned about when considering using PiHole for the whole house. Are these things that can be mitigated on your end, or will they require per-device apps to be installed, and potentially even require rooting the device? (Incidentally, how is it that YouTube and Hulu get around the ad blocker on Android?)

mthoms 7y ago
FWIW I bought a Raspberry Pi and installed Pi-Hole a few months back. It's been almost flawless for us. Adding to the domain whitelist and/or disabling the DNS blocking temporarily (in case of issues) is dead simple for anyone in the family. You just need to provide them with the local IP address of your Pi. The GUI - at least for these simple tasks - is quite straight forward. I agree though, this service looks very promising.

pssflops 7y ago

I'm in no-way a power user in this space so the simplicity and descriptions were very helpful and I'm looking forward to supporting this when you release a payment model. Excellent results so far, only a few pages had trouble loading and a simple reload fixed it.

sc_ 7y ago

I use unbound + dnscrypt-proxy + https://github.com/oznu/dns-zone-blacklist https://github.com/oznu/dns-zone-blacklist to do pretty much this. WireGuard also adds another layer & sets DNS easily per client. Hosted on a $5/month VPS, works very well.

raghavdua_cse18 7y ago

Really Cool, I have set up something similar for my family and is paying $20 every month for VPS, I have tried NextDNS and found it be really useful and considering the pricing structure which you mentioned in the comments, your product seems to be a far more affordable option. A few suggestions: 1) Consider launching an App for managing configurations or at least make the current web app a PWA 2) Allow users to create duplicate configurations 3) In the logs section of the analytics page, I saw that some blocked domains were being resolved, it was saying that the domains were manually whitelisted(they were not) 4) Allow adding custom hosts file sources 5) You can create a Windows/MacOS app for updating dynamic IP address(similar to the one provided by OpenDNS) 6) You can give a button to whitelist domains in the log section, just like the one provided by the PiHole in the Query page of its web UI 7) Allow adding multiple domains to whitelist & blacklist at once 8) Allow regex and wildcard blocking 9) Mobile UI is not 100% responsive

novaleaf 7y ago

would be perfect with scheduling.

lucasverra 7y ago

I've implemented on my iPhone and still get ads on youtube native app. How to remove them ?

aembleton 7y ago

When i use nextDNS I can't cast from the YouTube Android app to my Chromecast. This is with nothing being blocked. I can cast from the Netflix and iPlayer apps. Just not from Youtube. It works again as soon as I switch back to a different DNS provider. Has anyone else seen this?