11 ms·

NextDNS is my new favourite DNS service

350 points by angristan 7y ago

deleted 7y ago
[deleted]
smileysteve 7y ago
I've started using NextDns on my phone (Android) for its simplicity and thoroughness. One of the harder parts about DNS based blocking is that it's significantly more effort to unblock something like clicks from tracked deals sites than ublock browser extension. For my routers, I'm mostly happy with last week's announced 1.1.1.2 malware blocking from Cloudflare.
bitxbitxbitcoin 7y ago
NextDNS is also my new favorite DNS service - especially since they've been supporting Handshake name resolution at the click of a button since March 20th. [1] [1] https://twitter.com/nextdnsio/status/1241178358257455104 https://twitter.com/nextdnsio/status/1241178358257455104
- ignoramous 7y ago
  Sorry for being naïve: What is handshake-dns useful for-- is it like dnscrypt? Is it mainstream enough to matter yet?
  - tasuki 7y ago
    Handshake is an attempt to decentralize DNS root domains. It isn't mainstream enough to matter yet. I'm pretty excited about it though :) You can read more at https://handshake.org/ https://handshake.org/
m-p-3 7y ago
And I'm impressed at the speed they're implementing new things I didn't even know I wanted (Handshake TLD, more blocklists, etc)
sigwinch28 7y ago
I've had the complete opposite experience to the author w.r.t. PiHole and WireGuard. I run a PiHole on my home network and it's also my WireGuard "server". I will concede am lucky enough to have static IPv4/IPv6 addresses on my home connection. On my iOS devices I have two connections set up: one for "access to home + DNS", and the other for all traffic. When I'm on my home wifi the VPN connection is off, when I'm on cellular data the DNS is set to the PiHole, and when I'm on any other wifi I route all traffic via the VPN (all automatically via the WireGuard app). For my other mobile devices... well, they're Linux, so I just set the DNS server correctly and leave WireGuard always connected. It's a UDP "connection" for crying out loud. This all works flawlessly now to the point that my less technically-minded roommate has it set up on their phone, too: they can access the NAS all the time and ads are blocked in the web browser and in apps.
- WarOnPrivacy 7y ago
  pfSense + pfBlocker ~ OpenVPN because I'm pretty old - along with DNS over TLS & ICR what else. Sidebar: I also have a copy of my desktop Firefox hosted as a RemoteApp on a Win10Ent VM, for the odd time I need remote access to a credentialed account while I'm away.
  - KingFelix 7y ago
    I like remote FF setup. Any comment on Earn it act?
    - WarOnPrivacy 7y ago
      My comment on the Earn-it act is it's the natural outcome of unqualified US voters choosing unqualified politicians, thanks to largely inept news coverage. Or if you want something more topic specific, Feinstein co-sponsors it so we can fully assume it elevates the whims of The State over the welfare of us.
- ceocoder 7y ago
  I’ve got Pi-Hole and PiVPN with WireGuard setup as well, however not the two part like yours - I only turn on VPN on my iOS devices as needed, have you setup yours to auto connect based on name WiFi SSID? If so how?
middleclick 7y ago
It's also fairly easy to run your own recursive resolver in case you don't want to use an external DNS service. I use Unbound and ad-blocking lists and it works great.
XelNika 7y ago
> Despite how much I like Cloudflare and this specific service, I want to block trackers at the DNS level. 1.1.1.1 is probably the most reliable and fastest resolver there is on earth, but that does not fit my use case either. Isn't this a bit poorly timed, considering the recent Cloudflare DNS announcement? > In the coming months, we will provide the ability to define additional configuration settings for 1.1.1.1 for Families. This will include options to create specific whitelists and blacklists of certain sites. You will be able to set the times of the day when categories, such as social media, are blocked and get reports on your household's Internet usage. https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ https://blog.cloudflare.com/introducing-1-1-1-1-for-families...
- rodgerd 7y ago
  CloudFlare's blocking appears to be focused on, say, gay rights groups, while allowing access to StormFront. I'm not sure that fits the needs of OP, or indeed most families.
  - DenseComet 7y ago
    https://blog.cloudflare.com/the-mistake-that-caused-1-1-1-3-to-block-lgbtqia-sites-today/ https://blog.cloudflare.com/the-mistake-that-caused-1-1-1-3-... They made a mistake, promptly realized it, put fixes in place, and updated their procedures. Then, their CEO wrote a post apologizing. Whatever your view is on Cloudflare, it is not fair to say that they didn't react properly to this specific issue and I don't think it is fair to criticize them (again, for this specific issue).
- aaomidi 7y ago
  I doubt they're going to support adblocking as a first class citizen.
  - bjtitus 7y ago
    Why? Their business model doesn't involve advertising at all.
eeZah7Ux 7y ago
Surrendering our DNS traffic to few massively centralized services is even worse than to local ISPs.
- troquerre 7y ago
  Have you checked out Handshake? It's a new experimental protocol that's trying to decentralize DNS https://handshake.org https://handshake.org
whycombagator 7y ago
I've not used it, but Adguard also has an ad blocking DNS[0]. [0] https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html
- Rastonbury 7y ago
  You've not read the article either. Author was using adguard dns for a year before switching out
- hendersoon 7y ago
  Adguard DNS works fine out of the box, but you can't configure it and more importantly have no way to whitelist sites. If you block ads you _will_ have page damage and no way to fix it with that service. Nextdns solves that problem.
- deftturtle 7y ago
  Used Adguard for about 2.5 years, and literally switched to NextDNS yesterday after reading this article. I've got a blog post about DNS ad-blocking [0], updating stuff now and then. I hope it points out some of the different features and reasons to use one over the other. Let me know what you think! [0] https://www.calebyers.com/blog/dns-ad-blocking.html https://www.calebyers.com/blog/dns-ad-blocking.html
eloahx 7y ago
NextDNS is great for all my devices. let's me access Handshake domains easily from https://dns.live https://dns.live The default blacklist for NextDNS is really good too; stops a lot of Windows phone home stuff too, and can easily see all that. Don't add a bunch of blacklists though or websites break
- 7ewis 7y ago
  What are Handshake domains?
  - jimmydorry 7y ago
    Crypto secured domains, I assume. First google result is namebase, which is a familiar name in such a field. https://www.namebase.io/ https://www.namebase.io/
    - blackRust 7y ago
      Here's the 101 I found: https://www.namebase.io/handshake101 https://www.namebase.io/handshake101 Edit: more: https://handshake.org/ https://handshake.org/
  - eloahx 7y ago
    https://dns.live/start.html https://dns.live/start.html https://www.namebase.io/blog/how-to-access-handshake-domains/ https://www.namebase.io/blog/how-to-access-handshake-domains...
- Ayesh 7y ago
  I'm fairly well-versed in DNS, and aware of Handshake protocol as well, but I have absolutely no idea what DNS.live is about.
  - eloahx 7y ago
    I went over their site. I'm a big fan of the nextdns project and the handshake project. DNS.live is a hub that lists top sites hosted with the TLDS from Handshake and offers free stuff. Basically the Handshake gTLD directory to make it easy to check out other people's sites as decentralized DNS evolves and see when names become available. Websites instead of being http://whatever.com http://whatever.com are just http://whatever/ http://whatever/ It offers free free NS Hosting, free web hosting, free blog hostting, and free URL redirection for Handshake.org TLDs. No account is required (as per their website): https://dns.live/hosting.html https://dns.live/hosting.html is the free hosting link To learn more about it they have a start page: https://dns.live/start.html https://dns.live/start.html And here are two excellent turorials on it: https://www.namebase.io/blog/how-to-access-handshake-domains/ https://www.namebase.io/blog/how-to-access-handshake-domains... and from Namebase.io (the ONLY TLD auction) has a good write up on NextDNS and how to get it going: https://www.namebase.io/blog/how-to-access-handshake-domains/ https://www.namebase.io/blog/how-to-access-handshake-domains... Namebase.io is like the auction system to obtain the domains, dns.live lists them and offer hosting For me I just enabled Nextdns on all my devices and checked the handshake slider so I can see websites like http://ix http://ix Regular dns works as it should and it blocks trackers etc.
Havoc 7y ago
Interesting - just found weird behaviour in pihole. It's asking upstream to resolve "pi.hole" according to nextdns. That shouldn't be happening
- DavideNL 7y ago
  Check /etc/pihole/local.list It should have something like x.x.x.x pi.hole where x.x.x.x is your pihole's local ip.
  - Havoc 7y ago
    It's in a docker container so any changes will just get wiped on next version upgrade. I just checked and it does have the right IP in it though (IP of device hosting pihole). So doesn't seem to be obviously misconfigured. Weird. .hole doesn't seem to be a valid TLD so not much of a security risk
lazzlazzlazz 7y ago
I deployed NextDNS for my family months ago. The Handshake resolver locked in NextDNS for my home network. I've been considering setting up PiHole as well — Handshake resolution would lock that in.
StavrosK 7y ago
This looks great, but unfortunately CloudFlare has 1ms ping for me but NextDNS has 50ms. I'm not quite sure how it can reply in 1ms, but that's what I'm getting.
- angristan 7y ago
  Have you tried running an actual DNS query against 1.1.1.1? Some ISP were known to filter/blackhole/reroute 1.1.1.1: https://blog.cloudflare.com/fixing-reachability-to-1-1-1-1-globally/ https://blog.cloudflare.com/fixing-reachability-to-1-1-1-1-g... maybe you're concerned. Otherwise, that's a pretty insane latency!
  - StavrosK 7y ago
    I use it as my DNS server, so it's working fine, but that's a good idea. Unfortunately, my home router intercepts all DNS queries and reroutes them to its own dnsmasq (which forwards to 1.1.1.1), so I can't do a proper benchmark unless I disable it. I do wonder what's going on, but here's my traceroute to 1.1.1.1: https://www.pastery.net/zppyhe/ https://www.pastery.net/zppyhe/ EDIT: I disabled my DNS interception and it looks like I do, indeed, get 1 ms latency: https://www.pastery.net/bykmcp/ https://www.pastery.net/bykmcp/
    - angristan 7y ago
      Interesting. Looks like I have the same thing going on at home, because I have 2.8 ms to 1.0.0.1 and 0.5 ms (!) to 1.1.1.1: https://i.imgur.com/5qpMbuh.png https://i.imgur.com/5qpMbuh.png. Both answer to DNS queries, though.
  - deleted 7y ago
    [deleted]
- axaxs 7y ago
  1 ms... Do you live in their datacenter? I sadly don't even get that kinda RTT inside my own house.
yegle 7y ago
I'm hosting my own DNS server with DoT/DoH as reverse proxy of PiHole server. The latency might not as impressive as NextDNS' (7~10ms on my phone via TMobile), and I can have full control of the stack. https://github.com/yegle/your-dns https://github.com/yegle/your-dns
- ignoramous 7y ago
  > The latency might not as impressive as NextDNS'... For just DoH and low latencies, see Stackpath: https://news.ycombinator.com/item?id=19514791 https://news.ycombinator.com/item?id=19514791 With fly.io, one could run DoT, too: https://fly.io/docs/app-guides/run-a-private-dns-over-https-service/ https://fly.io/docs/app-guides/run-a-private-dns-over-https-... (that's a tutorial on DoH, though). I use Cloudflare Workers (their generous free-tier covers 3 devices worth DNS queries, with much room to spare), but the 128MiB RAM limit restricts the number of domains in my blocklists: https://news.ycombinator.com/item?id=22208988 https://news.ycombinator.com/item?id=22208988
troquerre 7y ago
We use NextDNS to access Handshake domain names and it's been working great. The privacy features are great too, although email links sometimes don't work because of them (more of a feature than a bug imo).
bmn__ 7y ago
I tested the ipv6 latency to nextdns https://my.nextdns.io https://my.nextdns.io and opennic https://servers.opennic.org https://servers.opennic.org –– I'm impressed with the newcomer, with 21㎳ median it's very close to the 17㎳ median I currently enjoy.
sciurus 7y ago
One thing that gives me some confidence in NextDNS is that they have joined Mozilla's Trusted Recursive Resolver program. Choosing it within Firefox's setting won't enable any of the filtering the article mentions, though. You need a custom config for that. https://blog.mozilla.org/blog/2019/12/17/firefox-announces-new-partner-in-delivering-private-and-secure-dns-services-to-users/ https://blog.mozilla.org/blog/2019/12/17/firefox-announces-n... https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy
- tialaramex 7y ago
  Also, one extra nice thing about using NextDNS via DoH (as you would with Firefox) is that now everything except the fact you're talking to NextDNS is concealed from eavesdroppers even if you do have custom config. If you use other methods, NextDNS needs to figure out which custom config is yours, and there's no way to hide that from an eavesdropper (at least not yet). For example with DoT the customisation is hidden as a server name, and travels plaintext in SNI during TLS connection. But with DoH that indication is in the URL path component, which is just more encrypted data in DoH and so an eavesdropper can no more discover which (if any) customisation you use than they can discover my Hacker News password when I log in here.
hendersoon 7y ago
NextDNS is excellent, I have my family and non-techie friends using it. Personally I just wireguard to my home network and use pihole. Hopefully Windows, Linux, iOS, and MacOS natively support DoH soon. It's a pain setting up proxies. Even worse, iOS forces you to use a fake VPN to change DNS servers at all on cellular!
- sahaskatta 7y ago
  I was pleasntly surprised and happy to see that I could use this service or Cloudflare on the latest version of Android natively by just typing in a URL into the settings rather than having to install a 3rd party app!
- JoshuaRLi 7y ago
  > Even worse, iOS forces you to use a fake VPN to change DNS servers at all on cellular! This is a major pain point for me - I'm trying to use both NextDNS and Tailscale on my iPhone SE 2016, and confirmed that they clash with each other. :(
ksec 7y ago
Been using NextDNS for a few months now, I cant even find a single flaw. DNS is fast, Both founder must be expert in networking, I have tried literally all the third party DNS services, Ad blocking or not and NextDNS is actually one of the best / fastest DNS services. And I often think of myself as having latency intolerance so it is very good. Despite what I thought 300,000 DNS queries/month was low it turns out I never exceeded that limit. And its Dashboard / Control Panel, it is very fast, extremely responsive. Basically I love everything about NextDNS, from DNS Speed, Ease of use and Design. Anyone who want Ad blocking should give it a go. Edit: Not affiliate with NextDNS, just personal opinion. Not sure why the downvote.
- commandersaki 7y ago
  It really isn't hard to provide "fast DNS". Most of the speed-ups come thanks to caching anyway.
  - ignoramous 7y ago
    > Most of the speed-ups come thanks to caching anyway. I'm afraid you trivially dismiss how hard this is. For e2e response times as low as 10s from any location, one needs a global footprint behind an anycast network. Both these things aren't easy to do (on your own), especially for something as ubiquitous as name resolution which needs near 100% uptime and consistently low latencies. Fast isn't the only thing here though, nextdns provides custom configuration and logging over multiple endpoints (including ipv4) served from 33 points of presence. I'm sure keeping lights on with this setup gets tricky pretty quick, let alone implementing features at the pace that they have been. Romain Contepas and Olivier Poitrus are the only reasons nextdns is what it is-- They are world-class experts in building such systems.
    - commandersaki 7y ago
      > I'm afraid you trivially dismiss how hard this is. I ask, in what world do you have "slow DNS"? The choices out there is ISP run which virtually always low latency, an anycast run service, or running your own. I don't care what technology you throw at the problem or who designed it, there really isn't "slow DNS", just bad choices of DNS servers that incur a round-trip latency penalty. I will assert again what keeps DNS "fast" is the aggressive caching of responses.
Havoc 7y ago
Doesn't seem to be catching much that uBlock and pihole aren't. 0.07%. Not super surprising I guess edit...and noscript
- aeosynth 7y ago
  There are multiple blocklists you can enable.
  - Havoc 7y ago
    Yeah I don't think it's a flaw with NextDNS. Just means my existing setup is already doing a decent job. Another layer is always good though I did have a look at additional blocking lists on there though - some good options there. Added "Block Child Sexual Abuse Material" and gambling.
homero 7y ago
It really is incredible, first time I couldn't think of any improvements a product could add
agumonkey 7y ago
can pdnsd (persistent/cache) work with nextdns ?
mgiampapa 7y ago
PiHole at it's core is easy access to a bunch of blocklists. Why not just run a local resolver and import the blocklists if your usecase is mobile and you don't want to vpn your traffic?
- garren 7y ago
  I’ve moved from a local resolver with regular block list updating to NextDNS - here’s why I’d recommend it over a diy solution: 1. Easy to turn on and off. My block lists were pretty aggressive and worked beautifully 90% of the time. However, occasionally I’d need to hit a site that was registered in a list that wasn’t immediately obvious. The O’Reilly site is (was) a good example - they were loading a script on their login page at one point that failed because I’d blocked the source. I’ve encountered other site that fail in similar ways. Being able to temporarily disable adblocking (OSX via the app) is tremendously convenient. 2. The blacklists and blocking categories offered by NextDNS are at least as good as what I’d managed to pull together (I was pretty proud of mine), they update frequently, and again it’s very easy to opt-in/opt-out 3. CName cloaking - unless you update your own lists very frequently, there’s a good chance you won’t be as effective at catching third-party trackers masquerading as first parties. I had fun running a local resolver and updating it from various block list sources with a cron job. I’d add new entries manually as I encountered them, but after a while it got old. Additionally, I wanted the same protection outside of my network. The same setup on a FreeBSD droplet worked well, but was more maintenance. NextDNS does at least as good a job, and it’s way more convenient.
allenbrunson 7y ago
also a fan of NextDNS. i have been using the service for a few weeks, since i saw them mentioned on twitter. looks like the aggregate number of queries from the many devices on my home network will exceed 300,000 per month, so i am happy to start paying as soon as they start charging.
yuz 7y ago
How do ads get blocked in the DNS level?
- aemreunal 7y ago
  When the browser tries to load an ad, let's say from "ads.com", the DNS service responds to that domain with 0.0.0.0, which prevents the ad from loading. You enable lists to customize which domains should be considered ad domains and can optionally blacklist other domains.
  - b3n 7y ago
    Are any ad networks bypassing this yet by serving ads from a static IP?
- pests 7y ago
  IP lookups for known ad-serving domains are instead given a bad response or an IP of a (local) address showing a block page / no response.
aemreunal 7y ago
Started using NextDNS a week ago and it's quite good so far. One of my concerns was how hard it would be to debug websites/services that stop working but it their logging being instant made it superbly easy. I can turn on logging, go to the website/app that doesn't work correctly, go right back to the NextDNS logs to see the requests instantly. You can then filter for the blocked ones too.
6510 7y ago
Support is also great. It accidentally a Dutch government website (probably had reasons) it was fixed < 24 h after my email. I think its brilliant. Using client side ad-blockers on shitty hardware [to make things less slow] adds a good bit of overhead.
KingOfCoders 7y ago
I've been using DNS Made Easy for some years now, can someone who knows both, fill me in on the main differences? Any need to change?
- tecleandor 7y ago
  DNS Made Easy (Which, by the way, is great and fast, although I'm using HE for some domains) is for your domains. NextDNS is for your devices. Is a DNS provider for your network and devices that allows you to block ads, custom configs and the like. Seems an advanced version of what OpenDNS used to offer back in the day (not sure if they still do it after Cisco acquisition).
  - KingOfCoders 7y ago
    Thanks that helped!
codeisawesome 7y ago
wow this is great! Now I want Apple to acquire them and provide this natively on the iPhone.
_-___________-_ 7y ago
I tried NextDNS out recently, and had a few technical questions about how it was interacting with some specialised DNS software I was testing. I clicked the livechat button on the website and was connected within seconds to someone who understood DNS at the protocol level. It was... unexpected and amazing.
- mcherm 7y ago
  Now THAT is the most impressive thing I have heard about them.
  - vlovich123 7y ago
    For now. That level of support is inevitable for a small startup and generally unsustainable beyond that stage.
- ignoramous 7y ago
  Same. I got on the chat, which was answered by Romain (one of the founders), to request them to add yhosts [0] to the blocklists, and it was in production in less than 10 mins. [0] yhosts (https://github.com/nextdns/metadata/blob/master/privacy/blocklists/yhosts.json https://github.com/nextdns/metadata/blob/master/privacy/bloc...) blocks most tracking domains belonging to various Chinese OEMs that weren't in other blocklists.
ykevinator 7y ago
What a great write up. If they can get over the technical fear for the average user this is a huge idea and the price is fair.
ThinkBeat 7y ago
I am using this on and off. I have some trouble with its adblocknig etc. Some apps and some sites do not work well. You could easily say that this is due to the pages or app itself and I agree. Still. I have to use some of them.
- ignoramous 7y ago
  > Some apps and some sites do not work well. You might have enabled some pretty aggressive blocklists with nextdns. If you can't be bothered, Adguard DNS is more accommodating but configuration-less, give it a try [0]. As for sites, I use startpage's anonymous-view [1] or brow.sh [2] at times. [0] https://news.ycombinator.com/item?id=18788410 https://news.ycombinator.com/item?id=18788410 [1] https://www.startpage.com/en/anonymous-view/ https://www.startpage.com/en/anonymous-view/ [2] https://news.ycombinator.com/item?id=17487552 https://news.ycombinator.com/item?id=17487552
albybisy 7y ago
I'll give a try :) but it's a little bit suspicious that there is not a single bad comment about NextDNS......
hiram112 7y ago
I've been using NextDNS on my laptop, two phones, and a tablet for months now, after hearing about it from a poster here on HN. Love it. I'm just worried that there is something a bit more nefarious going on. If you're not paying, you're the product being sold. Are we still just in the 'growth and acquire' phase here, where paid subscriptions will eventually be required?
mderazon 7y ago
NextDNS works great for me, I use it as a second layer to ublock origin and it still catches things. Only downside I have is when something does break, and it happens occasionally, I have to whitelist the domain on their dashboard. You can only whitelist the domain for all requests, which is not what I would like. Would prefer to whitelist it on a specific page and for a temporary time. Otherwise when something break I have to go to their dashboard, whitelist the domain, use the website and then go back and blacklist it again. Would be nice if they had a browser extension that can do that in the browser without having to go to their dashboard
deleted 7y ago
[deleted]
JoshuaRLi 7y ago
I switched from pointing various things to cloudflare to simply using NextDNS a while ago, and it's just excellent. The onboarding flow was way faster and easier than I thought it would be (fantastic setup documentation). Configurations are really great for customization at per-device granularity. Extremely slick and fast web UI. Great DNS latency + performance overall. I was planning on setting up my own recursive resolver one day (tm) but NextDNS really just makes everything so seamless + easy.

350 points by angristan 7y ago

deleted 7y ago

[deleted]

I've started using NextDns on my phone (Android) for its simplicity and thoroughness. One of the harder parts about DNS based blocking is that it's significantly more effort to unblock something like clicks from tracked deals sites than ublock browser extension. For my routers, I'm mostly happy with last week's announced 1.1.1.2 malware blocking from Cloudflare.

bitxbitxbitcoin 7y ago

NextDNS is also my new favorite DNS service - especially since they've been supporting Handshake name resolution at the click of a button since March 20th. [1] [1] https://twitter.com/nextdnsio/status/1241178358257455104 https://twitter.com/nextdnsio/status/1241178358257455104

ignoramous 7y ago
Sorry for being naïve: What is handshake-dns useful for-- is it like dnscrypt? Is it mainstream enough to matter yet?
- tasuki 7y ago
  Handshake is an attempt to decentralize DNS root domains. It isn't mainstream enough to matter yet. I'm pretty excited about it though :) You can read more at https://handshake.org/ https://handshake.org/

m-p-3 7y ago

And I'm impressed at the speed they're implementing new things I didn't even know I wanted (Handshake TLD, more blocklists, etc)

sigwinch28 7y ago

I've had the complete opposite experience to the author w.r.t. PiHole and WireGuard. I run a PiHole on my home network and it's also my WireGuard "server". I will concede am lucky enough to have static IPv4/IPv6 addresses on my home connection. On my iOS devices I have two connections set up: one for "access to home + DNS", and the other for all traffic. When I'm on my home wifi the VPN connection is off, when I'm on cellular data the DNS is set to the PiHole, and when I'm on any other wifi I route all traffic via the VPN (all automatically via the WireGuard app). For my other mobile devices... well, they're Linux, so I just set the DNS server correctly and leave WireGuard always connected. It's a UDP "connection" for crying out loud. This all works flawlessly now to the point that my less technically-minded roommate has it set up on their phone, too: they can access the NAS all the time and ads are blocked in the web browser and in apps.

WarOnPrivacy 7y ago
pfSense + pfBlocker ~ OpenVPN because I'm pretty old - along with DNS over TLS & ICR what else. Sidebar: I also have a copy of my desktop Firefox hosted as a RemoteApp on a Win10Ent VM, for the odd time I need remote access to a credentialed account while I'm away.
- KingFelix 7y ago
  I like remote FF setup. Any comment on Earn it act?
  - WarOnPrivacy 7y ago
    My comment on the Earn-it act is it's the natural outcome of unqualified US voters choosing unqualified politicians, thanks to largely inept news coverage. Or if you want something more topic specific, Feinstein co-sponsors it so we can fully assume it elevates the whims of The State over the welfare of us.
ceocoder 7y ago
I’ve got Pi-Hole and PiVPN with WireGuard setup as well, however not the two part like yours - I only turn on VPN on my iOS devices as needed, have you setup yours to auto connect based on name WiFi SSID? If so how?

middleclick 7y ago

It's also fairly easy to run your own recursive resolver in case you don't want to use an external DNS service. I use Unbound and ad-blocking lists and it works great.

XelNika 7y ago

> Despite how much I like Cloudflare and this specific service, I want to block trackers at the DNS level. 1.1.1.1 is probably the most reliable and fastest resolver there is on earth, but that does not fit my use case either. Isn't this a bit poorly timed, considering the recent Cloudflare DNS announcement? > In the coming months, we will provide the ability to define additional configuration settings for 1.1.1.1 for Families. This will include options to create specific whitelists and blacklists of certain sites. You will be able to set the times of the day when categories, such as social media, are blocked and get reports on your household's Internet usage. https://blog.cloudflare.com/introducing-1-1-1-1-for-families/ https://blog.cloudflare.com/introducing-1-1-1-1-for-families...

rodgerd 7y ago
CloudFlare's blocking appears to be focused on, say, gay rights groups, while allowing access to StormFront. I'm not sure that fits the needs of OP, or indeed most families.
- DenseComet 7y ago
  https://blog.cloudflare.com/the-mistake-that-caused-1-1-1-3-to-block-lgbtqia-sites-today/ https://blog.cloudflare.com/the-mistake-that-caused-1-1-1-3-... They made a mistake, promptly realized it, put fixes in place, and updated their procedures. Then, their CEO wrote a post apologizing. Whatever your view is on Cloudflare, it is not fair to say that they didn't react properly to this specific issue and I don't think it is fair to criticize them (again, for this specific issue).
aaomidi 7y ago
I doubt they're going to support adblocking as a first class citizen.
- bjtitus 7y ago
  Why? Their business model doesn't involve advertising at all.

eeZah7Ux 7y ago

Surrendering our DNS traffic to few massively centralized services is even worse than to local ISPs.

troquerre 7y ago
Have you checked out Handshake? It's a new experimental protocol that's trying to decentralize DNS https://handshake.org https://handshake.org

whycombagator 7y ago

I've not used it, but Adguard also has an ad blocking DNS[0]. [0] https://adguard.com/en/adguard-dns/overview.html https://adguard.com/en/adguard-dns/overview.html

Rastonbury 7y ago
You've not read the article either. Author was using adguard dns for a year before switching out
hendersoon 7y ago
Adguard DNS works fine out of the box, but you can't configure it and more importantly have no way to whitelist sites. If you block ads you _will_ have page damage and no way to fix it with that service. Nextdns solves that problem.
deftturtle 7y ago
Used Adguard for about 2.5 years, and literally switched to NextDNS yesterday after reading this article. I've got a blog post about DNS ad-blocking [0], updating stuff now and then. I hope it points out some of the different features and reasons to use one over the other. Let me know what you think! [0] https://www.calebyers.com/blog/dns-ad-blocking.html https://www.calebyers.com/blog/dns-ad-blocking.html

eloahx 7y ago

NextDNS is great for all my devices. let's me access Handshake domains easily from https://dns.live https://dns.live The default blacklist for NextDNS is really good too; stops a lot of Windows phone home stuff too, and can easily see all that. Don't add a bunch of blacklists though or websites break

7ewis 7y ago
What are Handshake domains?
- jimmydorry 7y ago
  Crypto secured domains, I assume. First google result is namebase, which is a familiar name in such a field. https://www.namebase.io/ https://www.namebase.io/
  - blackRust 7y ago
    Here's the 101 I found: https://www.namebase.io/handshake101 https://www.namebase.io/handshake101 Edit: more: https://handshake.org/ https://handshake.org/
- eloahx 7y ago
  https://dns.live/start.html https://dns.live/start.html https://www.namebase.io/blog/how-to-access-handshake-domains/ https://www.namebase.io/blog/how-to-access-handshake-domains...
Ayesh 7y ago
I'm fairly well-versed in DNS, and aware of Handshake protocol as well, but I have absolutely no idea what DNS.live is about.
- eloahx 7y ago
  I went over their site. I'm a big fan of the nextdns project and the handshake project. DNS.live is a hub that lists top sites hosted with the TLDS from Handshake and offers free stuff. Basically the Handshake gTLD directory to make it easy to check out other people's sites as decentralized DNS evolves and see when names become available. Websites instead of being http://whatever.com http://whatever.com are just http://whatever/ http://whatever/ It offers free free NS Hosting, free web hosting, free blog hostting, and free URL redirection for Handshake.org TLDs. No account is required (as per their website): https://dns.live/hosting.html https://dns.live/hosting.html is the free hosting link To learn more about it they have a start page: https://dns.live/start.html https://dns.live/start.html And here are two excellent turorials on it: https://www.namebase.io/blog/how-to-access-handshake-domains/ https://www.namebase.io/blog/how-to-access-handshake-domains... and from Namebase.io (the ONLY TLD auction) has a good write up on NextDNS and how to get it going: https://www.namebase.io/blog/how-to-access-handshake-domains/ https://www.namebase.io/blog/how-to-access-handshake-domains... Namebase.io is like the auction system to obtain the domains, dns.live lists them and offer hosting For me I just enabled Nextdns on all my devices and checked the handshake slider so I can see websites like http://ix http://ix Regular dns works as it should and it blocks trackers etc.

Havoc 7y ago

Interesting - just found weird behaviour in pihole. It's asking upstream to resolve "pi.hole" according to nextdns. That shouldn't be happening

DavideNL 7y ago
Check /etc/pihole/local.list It should have something like x.x.x.x pi.hole where x.x.x.x is your pihole's local ip.
- Havoc 7y ago
  It's in a docker container so any changes will just get wiped on next version upgrade. I just checked and it does have the right IP in it though (IP of device hosting pihole). So doesn't seem to be obviously misconfigured. Weird. .hole doesn't seem to be a valid TLD so not much of a security risk

lazzlazzlazz 7y ago

I deployed NextDNS for my family months ago. The Handshake resolver locked in NextDNS for my home network. I've been considering setting up PiHole as well — Handshake resolution would lock that in.

StavrosK 7y ago

This looks great, but unfortunately CloudFlare has 1ms ping for me but NextDNS has 50ms. I'm not quite sure how it can reply in 1ms, but that's what I'm getting.

angristan 7y ago
Have you tried running an actual DNS query against 1.1.1.1? Some ISP were known to filter/blackhole/reroute 1.1.1.1: https://blog.cloudflare.com/fixing-reachability-to-1-1-1-1-globally/ https://blog.cloudflare.com/fixing-reachability-to-1-1-1-1-g... maybe you're concerned. Otherwise, that's a pretty insane latency!
- StavrosK 7y ago
  I use it as my DNS server, so it's working fine, but that's a good idea. Unfortunately, my home router intercepts all DNS queries and reroutes them to its own dnsmasq (which forwards to 1.1.1.1), so I can't do a proper benchmark unless I disable it. I do wonder what's going on, but here's my traceroute to 1.1.1.1: https://www.pastery.net/zppyhe/ https://www.pastery.net/zppyhe/ EDIT: I disabled my DNS interception and it looks like I do, indeed, get 1 ms latency: https://www.pastery.net/bykmcp/ https://www.pastery.net/bykmcp/
  - angristan 7y ago
    Interesting. Looks like I have the same thing going on at home, because I have 2.8 ms to 1.0.0.1 and 0.5 ms (!) to 1.1.1.1: https://i.imgur.com/5qpMbuh.png https://i.imgur.com/5qpMbuh.png. Both answer to DNS queries, though.
- deleted 7y ago
  [deleted]
axaxs 7y ago
1 ms... Do you live in their datacenter? I sadly don't even get that kinda RTT inside my own house.

yegle 7y ago

I'm hosting my own DNS server with DoT/DoH as reverse proxy of PiHole server. The latency might not as impressive as NextDNS' (7~10ms on my phone via TMobile), and I can have full control of the stack. https://github.com/yegle/your-dns https://github.com/yegle/your-dns

ignoramous 7y ago
> The latency might not as impressive as NextDNS'... For just DoH and low latencies, see Stackpath: https://news.ycombinator.com/item?id=19514791 https://news.ycombinator.com/item?id=19514791 With fly.io, one could run DoT, too: https://fly.io/docs/app-guides/run-a-private-dns-over-https-service/ https://fly.io/docs/app-guides/run-a-private-dns-over-https-... (that's a tutorial on DoH, though). I use Cloudflare Workers (their generous free-tier covers 3 devices worth DNS queries, with much room to spare), but the 128MiB RAM limit restricts the number of domains in my blocklists: https://news.ycombinator.com/item?id=22208988 https://news.ycombinator.com/item?id=22208988

troquerre 7y ago

We use NextDNS to access Handshake domain names and it's been working great. The privacy features are great too, although email links sometimes don't work because of them (more of a feature than a bug imo).

bmn__ 7y ago

I tested the ipv6 latency to nextdns https://my.nextdns.io https://my.nextdns.io and opennic https://servers.opennic.org https://servers.opennic.org –– I'm impressed with the newcomer, with 21㎳ median it's very close to the 17㎳ median I currently enjoy.

sciurus 7y ago

One thing that gives me some confidence in NextDNS is that they have joined Mozilla's Trusted Recursive Resolver program. Choosing it within Firefox's setting won't enable any of the filtering the article mentions, though. You need a custom config for that. https://blog.mozilla.org/blog/2019/12/17/firefox-announces-new-partner-in-delivering-private-and-secure-dns-services-to-users/ https://blog.mozilla.org/blog/2019/12/17/firefox-announces-n... https://wiki.mozilla.org/Security/DOH-resolver-policy https://wiki.mozilla.org/Security/DOH-resolver-policy

tialaramex 7y ago
Also, one extra nice thing about using NextDNS via DoH (as you would with Firefox) is that now everything except the fact you're talking to NextDNS is concealed from eavesdroppers even if you do have custom config. If you use other methods, NextDNS needs to figure out which custom config is yours, and there's no way to hide that from an eavesdropper (at least not yet). For example with DoT the customisation is hidden as a server name, and travels plaintext in SNI during TLS connection. But with DoH that indication is in the URL path component, which is just more encrypted data in DoH and so an eavesdropper can no more discover which (if any) customisation you use than they can discover my Hacker News password when I log in here.

hendersoon 7y ago

NextDNS is excellent, I have my family and non-techie friends using it. Personally I just wireguard to my home network and use pihole. Hopefully Windows, Linux, iOS, and MacOS natively support DoH soon. It's a pain setting up proxies. Even worse, iOS forces you to use a fake VPN to change DNS servers at all on cellular!

sahaskatta 7y ago
I was pleasntly surprised and happy to see that I could use this service or Cloudflare on the latest version of Android natively by just typing in a URL into the settings rather than having to install a 3rd party app!
JoshuaRLi 7y ago
> Even worse, iOS forces you to use a fake VPN to change DNS servers at all on cellular! This is a major pain point for me - I'm trying to use both NextDNS and Tailscale on my iPhone SE 2016, and confirmed that they clash with each other. :(

ksec 7y ago

Been using NextDNS for a few months now, I cant even find a single flaw. DNS is fast, Both founder must be expert in networking, I have tried literally all the third party DNS services, Ad blocking or not and NextDNS is actually one of the best / fastest DNS services. And I often think of myself as having latency intolerance so it is very good. Despite what I thought 300,000 DNS queries/month was low it turns out I never exceeded that limit. And its Dashboard / Control Panel, it is very fast, extremely responsive. Basically I love everything about NextDNS, from DNS Speed, Ease of use and Design. Anyone who want Ad blocking should give it a go. Edit: Not affiliate with NextDNS, just personal opinion. Not sure why the downvote.

commandersaki 7y ago
It really isn't hard to provide "fast DNS". Most of the speed-ups come thanks to caching anyway.
- ignoramous 7y ago
  > Most of the speed-ups come thanks to caching anyway. I'm afraid you trivially dismiss how hard this is. For e2e response times as low as 10s from any location, one needs a global footprint behind an anycast network. Both these things aren't easy to do (on your own), especially for something as ubiquitous as name resolution which needs near 100% uptime and consistently low latencies. Fast isn't the only thing here though, nextdns provides custom configuration and logging over multiple endpoints (including ipv4) served from 33 points of presence. I'm sure keeping lights on with this setup gets tricky pretty quick, let alone implementing features at the pace that they have been. Romain Contepas and Olivier Poitrus are the only reasons nextdns is what it is-- They are world-class experts in building such systems.
  - commandersaki 7y ago
    > I'm afraid you trivially dismiss how hard this is. I ask, in what world do you have "slow DNS"? The choices out there is ISP run which virtually always low latency, an anycast run service, or running your own. I don't care what technology you throw at the problem or who designed it, there really isn't "slow DNS", just bad choices of DNS servers that incur a round-trip latency penalty. I will assert again what keeps DNS "fast" is the aggressive caching of responses.

Havoc 7y ago

Doesn't seem to be catching much that uBlock and pihole aren't. 0.07%. Not super surprising I guess edit...and noscript

aeosynth 7y ago
There are multiple blocklists you can enable.
- Havoc 7y ago
  Yeah I don't think it's a flaw with NextDNS. Just means my existing setup is already doing a decent job. Another layer is always good though I did have a look at additional blocking lists on there though - some good options there. Added "Block Child Sexual Abuse Material" and gambling.

homero 7y ago

It really is incredible, first time I couldn't think of any improvements a product could add

agumonkey 7y ago

can pdnsd (persistent/cache) work with nextdns ?

mgiampapa 7y ago

PiHole at it's core is easy access to a bunch of blocklists. Why not just run a local resolver and import the blocklists if your usecase is mobile and you don't want to vpn your traffic?

garren 7y ago
I’ve moved from a local resolver with regular block list updating to NextDNS - here’s why I’d recommend it over a diy solution: 1. Easy to turn on and off. My block lists were pretty aggressive and worked beautifully 90% of the time. However, occasionally I’d need to hit a site that was registered in a list that wasn’t immediately obvious. The O’Reilly site is (was) a good example - they were loading a script on their login page at one point that failed because I’d blocked the source. I’ve encountered other site that fail in similar ways. Being able to temporarily disable adblocking (OSX via the app) is tremendously convenient. 2. The blacklists and blocking categories offered by NextDNS are at least as good as what I’d managed to pull together (I was pretty proud of mine), they update frequently, and again it’s very easy to opt-in/opt-out 3. CName cloaking - unless you update your own lists very frequently, there’s a good chance you won’t be as effective at catching third-party trackers masquerading as first parties. I had fun running a local resolver and updating it from various block list sources with a cron job. I’d add new entries manually as I encountered them, but after a while it got old. Additionally, I wanted the same protection outside of my network. The same setup on a FreeBSD droplet worked well, but was more maintenance. NextDNS does at least as good a job, and it’s way more convenient.

allenbrunson 7y ago

also a fan of NextDNS. i have been using the service for a few weeks, since i saw them mentioned on twitter. looks like the aggregate number of queries from the many devices on my home network will exceed 300,000 per month, so i am happy to start paying as soon as they start charging.

yuz 7y ago

How do ads get blocked in the DNS level?

aemreunal 7y ago
When the browser tries to load an ad, let's say from "ads.com", the DNS service responds to that domain with 0.0.0.0, which prevents the ad from loading. You enable lists to customize which domains should be considered ad domains and can optionally blacklist other domains.
- b3n 7y ago
  Are any ad networks bypassing this yet by serving ads from a static IP?
pests 7y ago
IP lookups for known ad-serving domains are instead given a bad response or an IP of a (local) address showing a block page / no response.

aemreunal 7y ago

Started using NextDNS a week ago and it's quite good so far. One of my concerns was how hard it would be to debug websites/services that stop working but it their logging being instant made it superbly easy. I can turn on logging, go to the website/app that doesn't work correctly, go right back to the NextDNS logs to see the requests instantly. You can then filter for the blocked ones too.

6510 7y ago

Support is also great. It accidentally a Dutch government website (probably had reasons) it was fixed < 24 h after my email. I think its brilliant. Using client side ad-blockers on shitty hardware [to make things less slow] adds a good bit of overhead.

KingOfCoders 7y ago

I've been using DNS Made Easy for some years now, can someone who knows both, fill me in on the main differences? Any need to change?

tecleandor 7y ago
DNS Made Easy (Which, by the way, is great and fast, although I'm using HE for some domains) is for your domains. NextDNS is for your devices. Is a DNS provider for your network and devices that allows you to block ads, custom configs and the like. Seems an advanced version of what OpenDNS used to offer back in the day (not sure if they still do it after Cisco acquisition).
- KingOfCoders 7y ago
  Thanks that helped!

codeisawesome 7y ago

wow this is great! Now I want Apple to acquire them and provide this natively on the iPhone.

_-___________-_ 7y ago

I tried NextDNS out recently, and had a few technical questions about how it was interacting with some specialised DNS software I was testing. I clicked the livechat button on the website and was connected within seconds to someone who understood DNS at the protocol level. It was... unexpected and amazing.

mcherm 7y ago
Now THAT is the most impressive thing I have heard about them.
- vlovich123 7y ago
  For now. That level of support is inevitable for a small startup and generally unsustainable beyond that stage.
ignoramous 7y ago
Same. I got on the chat, which was answered by Romain (one of the founders), to request them to add yhosts [0] to the blocklists, and it was in production in less than 10 mins. [0] yhosts (https://github.com/nextdns/metadata/blob/master/privacy/blocklists/yhosts.json https://github.com/nextdns/metadata/blob/master/privacy/bloc...) blocks most tracking domains belonging to various Chinese OEMs that weren't in other blocklists.

ykevinator 7y ago

What a great write up. If they can get over the technical fear for the average user this is a huge idea and the price is fair.

ThinkBeat 7y ago

I am using this on and off. I have some trouble with its adblocknig etc. Some apps and some sites do not work well. You could easily say that this is due to the pages or app itself and I agree. Still. I have to use some of them.

ignoramous 7y ago
> Some apps and some sites do not work well. You might have enabled some pretty aggressive blocklists with nextdns. If you can't be bothered, Adguard DNS is more accommodating but configuration-less, give it a try [0]. As for sites, I use startpage's anonymous-view [1] or brow.sh [2] at times. [0] https://news.ycombinator.com/item?id=18788410 https://news.ycombinator.com/item?id=18788410 [1] https://www.startpage.com/en/anonymous-view/ https://www.startpage.com/en/anonymous-view/ [2] https://news.ycombinator.com/item?id=17487552 https://news.ycombinator.com/item?id=17487552

albybisy 7y ago

I'll give a try :) but it's a little bit suspicious that there is not a single bad comment about NextDNS......

hiram112 7y ago

I've been using NextDNS on my laptop, two phones, and a tablet for months now, after hearing about it from a poster here on HN. Love it. I'm just worried that there is something a bit more nefarious going on. If you're not paying, you're the product being sold. Are we still just in the 'growth and acquire' phase here, where paid subscriptions will eventually be required?

mderazon 7y ago

NextDNS works great for me, I use it as a second layer to ublock origin and it still catches things. Only downside I have is when something does break, and it happens occasionally, I have to whitelist the domain on their dashboard. You can only whitelist the domain for all requests, which is not what I would like. Would prefer to whitelist it on a specific page and for a temporary time. Otherwise when something break I have to go to their dashboard, whitelist the domain, use the website and then go back and blacklist it again. Would be nice if they had a browser extension that can do that in the browser without having to go to their dashboard

deleted 7y ago

[deleted]

JoshuaRLi 7y ago

I switched from pointing various things to cloudflare to simply using NextDNS a while ago, and it's just excellent. The onboarding flow was way faster and easier than I thought it would be (fantastic setup documentation). Configurations are really great for customization at per-device granularity. Extremely slick and fast web UI. Great DNS latency + performance overall. I was planning on setting up my own recursive resolver one day (tm) but NextDNS really just makes everything so seamless + easy.