5 ms·

We've been working super hard on nextdns.io, a cloud-based private DNS service that gives you full control over what is allowed or blocked on your devices. Her

We've been working super hard on nextdns.io, a cloud-based private DNS service that gives you full control over what is allowed or blocked on your devices. Here is a few things you can do with it: - Block malicious websites, trackers, ads, and more by combining the most popular blocklists out there, all updated in real-time (100+ lists to choose from). - Set your own privacy requirements: you decide what type of logs are kept (and for how long) depending on the level of analytics you want. Down to absolutely NO logs. - Automatically use DNS-over-HTTPS on all networks (including cellular) with our apps for Android, iOS, Windows and macOS. They are all tiny, tightly integrated with the OS and have negligible battery usage. (Some of them are still being worked on.) - Bypass nearly all forms of government/ISP censorship without the need for a slow/costly VPN, and make it way harder for your ISP to know what you are doing on the Internet. - Get in-depth analytics and real-time query logs so you can measure the efficiency of your blocking strategy, see when the apps on your devices are calling home, etc. And choose what is logged down to absolutely no logs, you decide. - Easily protect your family (you can create as many configurations as you want on one account, each with different settings, and you can use multiple different configurations while being on the same network). It also supports all the latest DNS technologies (DNS-over-HTTPS/TLS, Query Name Minimisation, DNSSEC validation, etc.), and it's fast (for most countries, we are or will very soon be as low-latency as Google DNS, Cloudflare and the likes). There are tons of other cool stuff we built into that service (like the fact that each configuration gets its own DoH/DoT endpoint and IPv6) but that post is already way too long :) We recorded a short GIF of us browsing through the interface: https://gfycat.com/LinedVerifiableBellfrog https://gfycat.com/LinedVerifiableBellfrog You can create your first configuration and test it right away without signing up (you can sign up later and "save" it). We would really appreciate if you could try the service, tell us what you like, what you don't like, what you would add, etc. We will happily answer all questions (even the technical ones). Cheers, and thanks!

AtHeartEngineer 7y ago
Good on ya. How is this all being paid for? How are you making money? Is there a subscription fee?
- nextdns 7y ago
  It's free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
  - AtHeartEngineer 7y ago
    Awesome, that sounds pretty good
  - jen729w 7y ago
    I love this model. Get people in for free, let them discover how fabulous it is, then by the time they need a pro-grade thing they're happy to throw money at you. See also: Netlify. Best of luck! Looks great.
freedomben 7y ago
Is your source code open? This looks really cool. I'm nervous about entrusting someone with stuff as sensitive as DNS. If this is all it appears to be, I may be a paying customer (tho I try to only use/pay for free-as-in-speech software).
- bscphil 7y ago
  >I try to only use/pay for free-as-in-speech software I would like to see more software adopt this model. Can you give a few examples of things you support? Are they all pay-for-hosting services, or are there cases where the software itself is for sale?
  - dual_basis 7y ago
    What does "free-as-in-speech" mean in the context of software? A strict interpretation would suggest something along the lines of "we don't censor what the customers of our software do with it", which is true for almost all software (aside from social media platforms). I don't see how this would apply here, since this software isn't being used for the creation of anything. A looser interpretation would suggest that, if the software is used to access content (eg. web browser) then, aside from technical limitations, it doesn't censor content that it could otherwise display. I can see how this might apply to a DNS. I don't see, however, how "free-as-in-speech" has any reference to open or closed source. (Not sure if that was what was meant.)
    - bscphil 7y ago
      "free-as-in-speech" is usually intended to contrast with "free-as-in-beer", thereby disambiguating the word "free" in English. Some software is "free-as-in-speech", which means you aren't limited with what you can do with it or its code -- "free" means that the user has certain rights. I think Stallman introduced this way of talking about software; people sometimes use "libre" instead. https://ssd.eff.org/en/glossary/open-source-software https://ssd.eff.org/en/glossary/open-source-software
      - 7y ago
vkdelta 7y ago
1. How would you compare your service with paid service "Circle" https://meetcircle.com/ https://meetcircle.com/ 2. How effective is it at blocking apps? 3. Will you OpenSource it? 4. Can you add some kind of Bash/scripts to configure profiles/settings on OpenSource routers such as OpenWRT, etc? 5. Will there be an API to control settings?
brians 7y ago
What about client subnet?
- nextdns 7y ago
  Right now it's disabled for everyone, it will be supported with an option to disable it.
terragon 7y ago
I tried using it. I'm in India, and while Cloudflare and Google DNS consistently resolve in 60-70ms, nextdns takes between 400-700ms for the first resolution and consistently 250ms for the same query repeated (I presume it caches the results?) Should I assume you've gotten a huge spike in traffic because of this HN post? If yes, I don't mind trying again in a few days, but unless things improve, I wouldn't be able to use it despite loving it in concept (the UI of your implementation is great too). I don't want to discourage you folks, since you've done a great job with the rest of it. Thanks for your efforts.
- miyuru 7y ago
  Try to do MTR and check for the routing. I am from Sri Lanka and I get following over IPv6 using dig, 80-120ms for Nextdns (92ms avg ping) 75-140ms for Google (61ms avg ping) 70-90ms for Cloudflare (75ms avg ping)
- nextdns 7y ago
  It's not the spike, it's probably a combination of: - a routing imperfection (this things need to be tweaked over time). - the fact that we didn't deploy our PoP in India yet (coming this month). Can you talk to us on the chat if you have some time? It would help to do some debugging.
  - Terretta 7y ago
    Great idea for service, but it has to be lightning fast to be in the middle of thousands of requests a minute as someone is surfing the web without making the web feel sluggish. In NYC on the largest metro ISP. Earlier in the day, was getting 25-43 msec to the typical major DNS providers (1.1.1.1, 4.4.4.4, 8.8.8.8, 9.9.9.9, as well as AdGuard), and usually 71 - 73 msec to you. After a while, started getting as slow as 280 msec to you. Last hour or so, mostly just getting timeouts to you, making the web, as well as apps, unusable. Had to revert. AdGuard DNS: dig @176.103.130.130 news.ycombinator.com ; <<>> DiG 9.10.6 <<>> @176.103.130.130 news.ycombinator.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6879 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;news.ycombinator.com. IN A ;; ANSWER SECTION: news.ycombinator.com. 56 IN A 209.216.230.240 ;; Query time: 29 msec ;; SERVER: 176.103.130.130#53(176.103.130.130) ;; WHEN: Sun May 26 15:32:11 EDT 2019 ;; MSG SIZE rcvd: 85 nextdns.io dig @5.182.208.100 news.ycombinator.com ; <<>> DiG 9.10.6 <<>> @5.182.208.100 news.ycombinator.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14810 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;news.ycombinator.com. IN A ;; ANSWER SECTION: news.ycombinator.com. 0 IN A 209.216.230.240 ;; Query time: 282 msec ;; SERVER: 5.182.208.100#53(5.182.208.100) ;; WHEN: Sun May 26 15:32:17 EDT 2019 ;; MSG SIZE rcvd: 85
cromka 7y ago
How about geoblocking? Have you considered adding a smart DNS like functionality?
cromka 7y ago
I am in the East Coast with 100Mbit fiber: dig @5.182.208.203 google.com ;; Query time: 390 msec
- nextdns 7y ago
  Could be a routing issue (this things need to be tweaked over time). Can you talk to us via the chat on the website so we can debug?
  - AtHeartEngineer 7y ago
    273msec in DC
  - 7ewis 7y ago
    468ms in the UK. 9ms on Cloudflare, 10ms on Google.
    - jamesog 7y ago
      There seems to be some routing oddities going on. I'm also in the UK (on AAISP). Sometimes I get ~48ms response, other times 200-300ms. Looking at mtr I'm occasionally routed to Dallas, Texas. Other times it's correctly routing over my ISP's peering to Vultr.
      - 7ewis 7y ago
        What command did you run in mtr to see the routing locations? Or just a normal report, then lookup the IP location?
        jamesog 7y ago
        By default mtr will do reverse DNS lookups on all hops. Several of the traces I ran showed the route to nextdns's /24 transiting over NTT and from the DNS name you can figure out where each router is.
lucasverra 7y ago
i was expecting this since ~ a year. congrats. main pain point for me : ads on my ios device on cellular. you solved it. only turn down : mi iphone SE ( os last versions) seems to get little pics of heat
savrajsingh 7y ago
Do you support time-based blocking? Aka no reddit during working hours?
- Proven 7y ago
  During working hours where?
- jedisct1 7y ago
  dnscrypt-proxy can be used to securely access nextdns, and it supports time-based blocking https://github.com/jedisct1/dnscrypt-proxy/wiki/Filters#time-based-filters https://github.com/jedisct1/dnscrypt-proxy/wiki/Filters#time...

AtHeartEngineer 7y ago

Good on ya. How is this all being paid for? How are you making money? Is there a subscription fee?

nextdns 7y ago
It's free during beta, then freemium with low pricing tiers (something like free up to 500,000 DNS queries a month, then $0.99/month). We will tweak later based on actual costs at scale, but it will follow this logic.
- AtHeartEngineer 7y ago
  Awesome, that sounds pretty good
- jen729w 7y ago
  I love this model. Get people in for free, let them discover how fabulous it is, then by the time they need a pro-grade thing they're happy to throw money at you. See also: Netlify. Best of luck! Looks great.

freedomben 7y ago

Is your source code open? This looks really cool. I'm nervous about entrusting someone with stuff as sensitive as DNS. If this is all it appears to be, I may be a paying customer (tho I try to only use/pay for free-as-in-speech software).

bscphil 7y ago
>I try to only use/pay for free-as-in-speech software I would like to see more software adopt this model. Can you give a few examples of things you support? Are they all pay-for-hosting services, or are there cases where the software itself is for sale?
- dual_basis 7y ago
  What does "free-as-in-speech" mean in the context of software? A strict interpretation would suggest something along the lines of "we don't censor what the customers of our software do with it", which is true for almost all software (aside from social media platforms). I don't see how this would apply here, since this software isn't being used for the creation of anything. A looser interpretation would suggest that, if the software is used to access content (eg. web browser) then, aside from technical limitations, it doesn't censor content that it could otherwise display. I can see how this might apply to a DNS. I don't see, however, how "free-as-in-speech" has any reference to open or closed source. (Not sure if that was what was meant.)
  - bscphil 7y ago
    "free-as-in-speech" is usually intended to contrast with "free-as-in-beer", thereby disambiguating the word "free" in English. Some software is "free-as-in-speech", which means you aren't limited with what you can do with it or its code -- "free" means that the user has certain rights. I think Stallman introduced this way of talking about software; people sometimes use "libre" instead. https://ssd.eff.org/en/glossary/open-source-software https://ssd.eff.org/en/glossary/open-source-software
    - 7y ago

vkdelta 7y ago

1. How would you compare your service with paid service "Circle" https://meetcircle.com/ https://meetcircle.com/ 2. How effective is it at blocking apps? 3. Will you OpenSource it? 4. Can you add some kind of Bash/scripts to configure profiles/settings on OpenSource routers such as OpenWRT, etc? 5. Will there be an API to control settings?

brians 7y ago

What about client subnet?

nextdns 7y ago
Right now it's disabled for everyone, it will be supported with an option to disable it.

terragon 7y ago

I tried using it. I'm in India, and while Cloudflare and Google DNS consistently resolve in 60-70ms, nextdns takes between 400-700ms for the first resolution and consistently 250ms for the same query repeated (I presume it caches the results?) Should I assume you've gotten a huge spike in traffic because of this HN post? If yes, I don't mind trying again in a few days, but unless things improve, I wouldn't be able to use it despite loving it in concept (the UI of your implementation is great too). I don't want to discourage you folks, since you've done a great job with the rest of it. Thanks for your efforts.

miyuru 7y ago
Try to do MTR and check for the routing. I am from Sri Lanka and I get following over IPv6 using dig, 80-120ms for Nextdns (92ms avg ping) 75-140ms for Google (61ms avg ping) 70-90ms for Cloudflare (75ms avg ping)
nextdns 7y ago
It's not the spike, it's probably a combination of: - a routing imperfection (this things need to be tweaked over time). - the fact that we didn't deploy our PoP in India yet (coming this month). Can you talk to us on the chat if you have some time? It would help to do some debugging.
- Terretta 7y ago
  Great idea for service, but it has to be lightning fast to be in the middle of thousands of requests a minute as someone is surfing the web without making the web feel sluggish. In NYC on the largest metro ISP. Earlier in the day, was getting 25-43 msec to the typical major DNS providers (1.1.1.1, 4.4.4.4, 8.8.8.8, 9.9.9.9, as well as AdGuard), and usually 71 - 73 msec to you. After a while, started getting as slow as 280 msec to you. Last hour or so, mostly just getting timeouts to you, making the web, as well as apps, unusable. Had to revert. AdGuard DNS: dig @176.103.130.130 news.ycombinator.com ; <<>> DiG 9.10.6 <<>> @176.103.130.130 news.ycombinator.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6879 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;news.ycombinator.com. IN A ;; ANSWER SECTION: news.ycombinator.com. 56 IN A 209.216.230.240 ;; Query time: 29 msec ;; SERVER: 176.103.130.130#53(176.103.130.130) ;; WHEN: Sun May 26 15:32:11 EDT 2019 ;; MSG SIZE rcvd: 85 nextdns.io dig @5.182.208.100 news.ycombinator.com ; <<>> DiG 9.10.6 <<>> @5.182.208.100 news.ycombinator.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14810 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;news.ycombinator.com. IN A ;; ANSWER SECTION: news.ycombinator.com. 0 IN A 209.216.230.240 ;; Query time: 282 msec ;; SERVER: 5.182.208.100#53(5.182.208.100) ;; WHEN: Sun May 26 15:32:17 EDT 2019 ;; MSG SIZE rcvd: 85

cromka 7y ago

How about geoblocking? Have you considered adding a smart DNS like functionality?

cromka 7y ago

I am in the East Coast with 100Mbit fiber: dig @5.182.208.203 google.com ;; Query time: 390 msec

nextdns 7y ago
Could be a routing issue (this things need to be tweaked over time). Can you talk to us via the chat on the website so we can debug?
- AtHeartEngineer 7y ago
  273msec in DC
- 7ewis 7y ago
  468ms in the UK. 9ms on Cloudflare, 10ms on Google.
  - jamesog 7y ago
    There seems to be some routing oddities going on. I'm also in the UK (on AAISP). Sometimes I get ~48ms response, other times 200-300ms. Looking at mtr I'm occasionally routed to Dallas, Texas. Other times it's correctly routing over my ISP's peering to Vultr.
    - 7ewis 7y ago
      What command did you run in mtr to see the routing locations? Or just a normal report, then lookup the IP location?
      - jamesog 7y ago
        By default mtr will do reverse DNS lookups on all hops. Several of the traces I ran showed the route to nextdns's /24 transiting over NTT and from the DNS name you can figure out where each router is.

lucasverra 7y ago

i was expecting this since ~ a year. congrats. main pain point for me : ads on my ios device on cellular. you solved it. only turn down : mi iphone SE ( os last versions) seems to get little pics of heat

savrajsingh 7y ago

Do you support time-based blocking? Aka no reddit during working hours?

Proven 7y ago
During working hours where?
jedisct1 7y ago
dnscrypt-proxy can be used to securely access nextdns, and it supports time-based blocking https://github.com/jedisct1/dnscrypt-proxy/wiki/Filters#time-based-filters https://github.com/jedisct1/dnscrypt-proxy/wiki/Filters#time...