8 ms·

NextDNS API

138 points by andrewinardeer 4y ago

0JzW 4y ago
do you have any context for this? why is this API interesting?
- iampims 4y ago
  1. It’s new. You had to make those changes manually before 2. You can now automate a lot of things. Example: block twitter/fb/social media after 9pm for everyone.
  - operator-name 4y ago
    Your second example would be subject to TTLs right?
    - vladvasiliu 4y ago
      Sure, but I'd expect those to be short enough to not matter for this purpose. The cutoff may happen at 9:05 istead of 9 sharp, which is close enough. drill facebook.com @8.8.8.8 ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 34092 ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; facebook.com. IN A ;; ANSWER SECTION: facebook.com. 300 IN A 157.240.21.35
politelemon 4y ago
This was one of the most requested features ever since launch. Glad to see it happen. The documentation seems to be missing instructions on how to obtain an API key.
- k0stas 4y ago
  I was just trying out the API and noticed the same thing. I found the API key near the bottom on my https://my.nextdns.io/account https://my.nextdns.io/account page.
teekert 4y ago
Sorry I'm lazy, but can I use this to get valid certs for services on my lan :) ?
- buro9 4y ago
  Via DNS?
- cassianoleal 4y ago
  NextDNS is not a DNS hosting service - it's a DNS server you can use for queries, like OpenDNS, or Cloudflare's 1.1.1.1, etc. What you're looking for is a DNS hosting service with an API that can be used from an ACME client. I use LuaDNS for that, their service is excellent and you can store your zone files in git (and auto-update DNS with a webhook on push).
hiram112 4y ago
I've been using this service on my dev laptop, tablet, and phone for a few years now. It works well, and every time I turn it off, I immediately notice a huge difference as it blocks so much garbage that brings my phone's browser, especially, to a crawl. I have never paid a cent for it. I still don't understand how they can make money... unless I'm actually the product being sold (which I was always under the impression that they didn't sell or share user data). Who knows.
- infecto 4y ago
  I pay for it, the cap of 300k queries a month on the free tier was far too little for a household of two. Depends on what type of devices are running on you network of course but I hit 845,809 queries for the last 30 days. I assume a number of people are paying for it. easier than running a pihole locally.
  - Quarrel 4y ago
    I pay for it too. The 300k is super easy to hit in a house with a few devices in it.
  - Fritsdehacker 4y ago
    Same here. And it is not expensive.
  - haswell 4y ago
    Just recently started using NextDNS, and yeah, I hit those 300K pretty quickly. I noticed that some apps/devices would continue querying pretty aggressively after being blocked, and this seemed to eat through the available queries pretty quickly. But $20/year is such a great deal IMO it was an insta-buy for me.
  - ranguna 4y ago
    I was far from hitting the limit and I started paying for it either way, this feels like one of those project that should get all the money it can get.
- pstadler 4y ago
throw0101a 4y ago
If anyone wants a generic utility for interfacing with various DNS APIs, see lexicon: * https://github.com/AnalogJ/lexicon https://github.com/AnalogJ/lexicon For CLI and Python. Such a utility is handy if you want to use the dns-01 method for ACME/Let's Encrypt via DNS aliasing: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://news.ycombinator.com/item?id=28256326 https://news.ycombinator.com/item?id=28256326 (2020) Deep dive on how ACME DNS validation works: * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... Some folks have also written 'minimalist' DNS servers for DNS validation (delegate to a sub-domain that you control if your provider does not have an API): * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns
- newman314 4y ago
  There are also the following: * dnscontrol - https://stackexchange.github.io/dnscontrol/ https://stackexchange.github.io/dnscontrol/ * octodns - https://github.com/octodns/octodns https://github.com/octodns/octodns
- haswell 4y ago
  These are all great resources, but a bit off topic, no? NextDNS is essentially Pi-hole-as-a-service, and its APIs are not focused on managing DNS in the traditional sense. Instead, they provide visibility into NextDNS's lookup/block analytics, managing settings, etc.
- remram 4y ago
  It seems that lexicon is handy to use dns-01 instead of DNS aliasing. If you do aliasing, you can serve the DNS challenge from the server you want and that you fully control. You don't need to interface with your registrar, you just add an NS record once (manually). You need lexicon if you want to serve the challenge from your registrar instead, and lexicon is the tool that will allow you to talk to many registrars.
superchink 4y ago
It might be cool to use this API to temporarily unblock a domain in use by the current site. Might require a browser extension, but is it possible?
- hamandcheese 4y ago
  They specifically call out adding domains to the deny list as an example: > …or add a domain to the Denylist by POST‘ing at: https://api.nextdns.io/profiles/:profile/denylist https://api.nextdns.io/profiles/:profile/denylist So I assume the same can be done for allowlists.
  - haswell 4y ago
    I recently started using NextDNS, and it's great, but was thinking about exactly this use case as I went to my allow-list yet again to add a domain so I could use some app/site, I forget which. NextDNS is great, but occasionally breaks things depending on the blocklists enabled, so I was toying with the idea of building a utility that would show the last n blocked domains with an easy option to click-to-add a specific domain to the allow-list. As far as I can tell, the API has what's needed.
quyleanh 4y ago
Already posted on HN https://news.ycombinator.com/item?id=31579149 https://news.ycombinator.com/item?id=31579149
- deleted 4y ago
  [deleted]
seaghost 4y ago
I still can’t believe you can’t change profiles based on different WiFi networks, i.e home or work.
- firloop 4y ago
  I’m planning on building this sort of functionality with the iOS Shortcuts and the NextDNS API. Very excited about this.
todsacerdoti 4y ago
We just added the ability to automate DNS management with NextDNS using Pipedream - https://pipedream.com/apps/nextdns/ https://pipedream.com/apps/nextdns/
Melatonic 4y ago
Hell YEAH Now can we just get an easy way in the GUI to import/export our custom blocklists / allow lists ? And bulk adding/removing things to both would be nice as well through the GUI.
blaydator 4y ago
I would love to disable filtering for a limited time (eg when opening a TechCrunch article which doesn’t load with nextDns enable), but the api doesn’t seems to provide a way to achieve this. So I need to open the app and disable NextDns, then I forget toi re-enable it..
- LilBytes 4y ago
  Depending on what machine you're running with issues against. I got a work around by using YogaDNS and setting it to point to CloudFlare DNS, you can use any external DNS service to this affect. So when I hit issues with NextDNS where my block list is too strict or it has to be amended but want to hit another website rather than wait for the allow list to update. I launch YogaDNS so my DNS servers are temporarily changed, rather than disable NextDNS. Then I disable YogaDNS a few moments later when I expect my settings in NextDNS have updated/refreshed. You still have the same problem, you have to remember to disable YogaDNS but I find it to be a lot easier, turning on and off the YogaDNS app.

0JzW 4y ago

do you have any context for this? why is this API interesting?

iampims 4y ago
1. It’s new. You had to make those changes manually before 2. You can now automate a lot of things. Example: block twitter/fb/social media after 9pm for everyone.
- operator-name 4y ago
  Your second example would be subject to TTLs right?
  - vladvasiliu 4y ago
    Sure, but I'd expect those to be short enough to not matter for this purpose. The cutoff may happen at 9:05 istead of 9 sharp, which is close enough. drill facebook.com @8.8.8.8 ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 34092 ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; facebook.com. IN A ;; ANSWER SECTION: facebook.com. 300 IN A 157.240.21.35

This was one of the most requested features ever since launch. Glad to see it happen. The documentation seems to be missing instructions on how to obtain an API key.

k0stas 4y ago
I was just trying out the API and noticed the same thing. I found the API key near the bottom on my https://my.nextdns.io/account https://my.nextdns.io/account page.

teekert 4y ago

Sorry I'm lazy, but can I use this to get valid certs for services on my lan :) ?

buro9 4y ago
Via DNS?
cassianoleal 4y ago
NextDNS is not a DNS hosting service - it's a DNS server you can use for queries, like OpenDNS, or Cloudflare's 1.1.1.1, etc. What you're looking for is a DNS hosting service with an API that can be used from an ACME client. I use LuaDNS for that, their service is excellent and you can store your zone files in git (and auto-update DNS with a webhook on push).

hiram112 4y ago

I've been using this service on my dev laptop, tablet, and phone for a few years now. It works well, and every time I turn it off, I immediately notice a huge difference as it blocks so much garbage that brings my phone's browser, especially, to a crawl. I have never paid a cent for it. I still don't understand how they can make money... unless I'm actually the product being sold (which I was always under the impression that they didn't sell or share user data). Who knows.

infecto 4y ago
I pay for it, the cap of 300k queries a month on the free tier was far too little for a household of two. Depends on what type of devices are running on you network of course but I hit 845,809 queries for the last 30 days. I assume a number of people are paying for it. easier than running a pihole locally.
- Quarrel 4y ago
  I pay for it too. The 300k is super easy to hit in a house with a few devices in it.
- Fritsdehacker 4y ago
  Same here. And it is not expensive.
- haswell 4y ago
  Just recently started using NextDNS, and yeah, I hit those 300K pretty quickly. I noticed that some apps/devices would continue querying pretty aggressively after being blocked, and this seemed to eat through the available queries pretty quickly. But $20/year is such a great deal IMO it was an insta-buy for me.
- ranguna 4y ago
  I was far from hitting the limit and I started paying for it either way, this feels like one of those project that should get all the money it can get.
pstadler 4y ago

throw0101a 4y ago

If anyone wants a generic utility for interfacing with various DNS APIs, see lexicon: * https://github.com/AnalogJ/lexicon https://github.com/AnalogJ/lexicon For CLI and Python. Such a utility is handy if you want to use the dns-01 method for ACME/Let's Encrypt via DNS aliasing: * https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ https://dan.langille.org/2019/02/01/acme-domain-alias-mode/ * https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... * https://news.ycombinator.com/item?id=28256326 https://news.ycombinator.com/item?id=28256326 (2020) Deep dive on how ACME DNS validation works: * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... Some folks have also written 'minimalist' DNS servers for DNS validation (delegate to a sub-domain that you control if your provider does not have an API): * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns

newman314 4y ago
There are also the following: * dnscontrol - https://stackexchange.github.io/dnscontrol/ https://stackexchange.github.io/dnscontrol/ * octodns - https://github.com/octodns/octodns https://github.com/octodns/octodns
haswell 4y ago
These are all great resources, but a bit off topic, no? NextDNS is essentially Pi-hole-as-a-service, and its APIs are not focused on managing DNS in the traditional sense. Instead, they provide visibility into NextDNS's lookup/block analytics, managing settings, etc.
remram 4y ago
It seems that lexicon is handy to use dns-01 instead of DNS aliasing. If you do aliasing, you can serve the DNS challenge from the server you want and that you fully control. You don't need to interface with your registrar, you just add an NS record once (manually). You need lexicon if you want to serve the challenge from your registrar instead, and lexicon is the tool that will allow you to talk to many registrars.

superchink 4y ago

It might be cool to use this API to temporarily unblock a domain in use by the current site. Might require a browser extension, but is it possible?

hamandcheese 4y ago
They specifically call out adding domains to the deny list as an example: > …or add a domain to the Denylist by POST‘ing at: https://api.nextdns.io/profiles/:profile/denylist https://api.nextdns.io/profiles/:profile/denylist So I assume the same can be done for allowlists.
- haswell 4y ago
  I recently started using NextDNS, and it's great, but was thinking about exactly this use case as I went to my allow-list yet again to add a domain so I could use some app/site, I forget which. NextDNS is great, but occasionally breaks things depending on the blocklists enabled, so I was toying with the idea of building a utility that would show the last n blocked domains with an easy option to click-to-add a specific domain to the allow-list. As far as I can tell, the API has what's needed.

quyleanh 4y ago

Already posted on HN https://news.ycombinator.com/item?id=31579149 https://news.ycombinator.com/item?id=31579149

deleted 4y ago
[deleted]

seaghost 4y ago

I still can’t believe you can’t change profiles based on different WiFi networks, i.e home or work.

firloop 4y ago
I’m planning on building this sort of functionality with the iOS Shortcuts and the NextDNS API. Very excited about this.

todsacerdoti 4y ago

We just added the ability to automate DNS management with NextDNS using Pipedream - https://pipedream.com/apps/nextdns/ https://pipedream.com/apps/nextdns/

Melatonic 4y ago

Hell YEAH Now can we just get an easy way in the GUI to import/export our custom blocklists / allow lists ? And bulk adding/removing things to both would be nice as well through the GUI.

blaydator 4y ago

I would love to disable filtering for a limited time (eg when opening a TechCrunch article which doesn’t load with nextDns enable), but the api doesn’t seems to provide a way to achieve this. So I need to open the app and disable NextDns, then I forget toi re-enable it..

LilBytes 4y ago
Depending on what machine you're running with issues against. I got a work around by using YogaDNS and setting it to point to CloudFlare DNS, you can use any external DNS service to this affect. So when I hit issues with NextDNS where my block list is too strict or it has to be amended but want to hit another website rather than wait for the allow list to update. I launch YogaDNS so my DNS servers are temporarily changed, rather than disable NextDNS. Then I disable YogaDNS a few moments later when I expect my settings in NextDNS have updated/refreshed. You still have the same problem, you have to remember to disable YogaDNS but I find it to be a lot easier, turning on and off the YogaDNS app.