11 ms·
I ran a competing project[0] on my home network for a few years before I discovered NextDNS[1]. What I lost in performance (requests don't leave my house) I gai
by JadoJodo 3y ago
I ran a competing project[0] on my home network for a few years before I discovered NextDNS[1]. What I lost in performance (requests don't leave my house) I gained in portability: ALL my devices can take advantage – at home and away – and time-saved. PiHole works 90% of the time, but when it did stop working, I'd have to spend a bit of time fixing it. At $20/year, I simply couldn't compete with NextDNS.
Note: This isn't a shill for NextDNS; I love these kinds of projects and think they absolutely should exist, but NextDNS just happens to be one of those dead-simple SaaS tools that is an insanely good value.
0 - https://pi-hole.net/ https://pi-hole.net/
1 - https://nextdns.io https://nextdns.io
- drewg123 3y agoI love NextDNS. The one (fairly huge) issue that I have is that it cannot handle captive portals when its enabled on my iPhone. So if I'm joining the wifi on a plane, etc, I need to remember to turn it off. This means that I cannot recommend it to my non-technical friends.
- maronato 3y agoI’ve been using NextDNS for a little while and don’t remember having issues with captive portals on my iPhone. Maybe something changed?
- hipsterstal1n 3y agoMost likely it's due to the different lists you can add or use on NextDNS. I also have issues with captive portals (I run a number of lists on NextDNS) and I just flip it off and on when I need to.
- air7 3y agoA general trick for bringing up the captive portal manually is to browse to a non ssl url such as http://example.com http://example.com The portal would unapologeticly mitm the server response with a redirect to the portal login page. The domain needs to exist (to pass DNS) and not have HSTS, but otherwise any address will do.
- ssklash 3y agohttp://neverssl.com/ http://neverssl.com/ is my go-to for this.
- scosman 3y agoNot http://nevertls.com http://nevertls.com ?
- hn_go_brrrrr 3y agoOr http://gstatic.com/generate_204 http://gstatic.com/generate_204?
- therealmarv 3y ago+1 for nextdns definitely, that would be also my preferred choice. Alternative and free for private usage is to set DNS to: dns.adguard-dns.com on your devices to block ads with DNS. UPDATE: it seems the old one was dns.adguard.com (which was blocked in some countries)
- greenie_beans 3y agoomg, thank youuuu
- bityard 3y agoFor the home-gamers without a strong grip of DNS, note that you can't enter a domain name into your resolver fields, you have to use the IPs: 94.140.14.14 94.140.15.15 2a10:50c0::ad1:ff 2a10:50c0::ad2:ff Also, it looks like https://dns.adguard-dns.com/ https://dns.adguard-dns.com/ redirects to https://adguard-dns.io/ https://adguard-dns.io/ which is a paid service for more advanced DNS filtering, a la NextDNS.
- vin047 3y ago9.9.9.9 from Quad9 is another great, free, pro-privacy alternative.
- JulianWasTaken 3y agoInteresting -- for me pi-hole has worked for so long that I've forgotten my login even, but when I redo my home network in the near future I definitely intend to re-evaluate the options. Sounds like I've got 3 now...
- nickthegreek 3y agoyou are gonna want to do a 'pihole -up' every few months. I would suggest finding that password!
- markphip 3y agoThis is also my issue with pi-hole, I still use it but I lost the password. Every now and then I take a crack at getting back in so I can update it. I have been thinking of switching to NextDNS so I could have blocking everywhere. Other than this problem, Pi-Hole has always been great
- afruitpie 3y agoAnother great (and free!) option is Mullvad’s ad-blocking DNS over TLS or HTTPS. https://mullvad.net/en/help/dns-over-https-and-dns-over-tls https://mullvad.net/en/help/dns-over-https-and-dns-over-tls
- deleted 3y ago[deleted]
- mrbonner 3y agoi paid for NextDNS back in 2020 but discontinue the following year due to services such as streaming from PBS app and websites not working properly. I knew this maybe related to aggressive blocking DNS but I wasn't having the time to investigate. I have no complain about NextDNS. Their service works and pricing is fine. I just use Adguard premium now and have no issue for a year.
- i2shar 3y agoHaven’t used NextDNS but have used PiHole and currently running AdGuard Home. But if you are paying $20/year just for DNS encryption/blocking, you may consider upgrading to Mullvad which gives you DNS Ad blocking but also IP anonymity, tunneling etc.
- ThePowerOfFuet 3y agoThe two are not the same; with NextDNS I can choose to enable logging and see all requests from each device, as well as allowlist/denylist any domain/subdomain I want.
- Rastonbury 3y agoNot familiar with pihole but are there not ways to do those things on it?
- oceanplexian 3y agoExcept all of these third party VPN and DNS type services are literally NSA honeypots and privacy nightmares. I get that you have to do DNS lookups somewhere, but I'm not going to make it ridiculously trivial for a bad actor to scoop up all that data conveniently in a central location.
- hackeman300 3y agoMullvad is an NSA honeypot? Got any sources on that?
- nprateem 3y agoI agree there's a very high chance they and the majority of other VPNs are - or if not the US some other intel org. The US government has form (what was that early crypto machine they sold to allies and it was backdoored?), and they'd be foolish to miss such a strategically obvious play.
- lencastre 3y ago
- lnxg33k1 3y agoI also switched from pihole, because of the random disservice, I’d have it working, the suddently it would just stop, without changing anything, and even having it in their own docker container, unbelievable, I am quite happy with adguardhome, but now I kinda would try this nextdns
- hsshah 3y agoHave you looked into their privacy/data collection policies? Generally prefer local solutions but gave up on Pi-hole some time back after recurring issues. Currently using client-specific adguard; however the centralized management with nextdns is enticing.
- evanreichard 3y agoI'm curious what issues you ran into with Pi-hole? I was running my instance for years without a single hiccup. I ended up moving to AdGuard Home about a year ago though because I wanted to run it on my OPNSense box. I have an automatic WireGuard VPN set up on my devices to VPN into my home network when I'm not connected to my SSID, so my local DNS still works remotely.
- fdgadfagfgd 3y agoI think op's saying local DNS was fine and preferred, just not usable outside the home network.
- zikduruqe 3y ago> I have an automatic WireGuard VPN set up on my devices to VPN into my home network when I'm not connected to my SSID, so my local DNS still works remotely. Exact same setup for me also. I also run Tailscale since I have run into some remote networks that blocked wireguard's port.
- progbits 3y agoHow's the latency? I like the idea and might set that up but my residential ISP doesn't have great peering and latency isn't great. I wonder if that extra roundtrip would be noticable or not.
- zikduruqe 3y agoI'm on a 2 Gbps fiber link at home, so none as far as I'm concerned.
- vin047 3y agoI do the same thing and am on 500mbps - don’t experience any issues
- omnicognate 3y agoI do this from my phone with crummy copper ADSL at home that gets <20Mbps in the uplink and don't notice the difference between it being on and being off. YMMV of course, and all I'm doing is basic web browsing, occasional youtube videos and chat apps but it's fine for that.
- stranded22 3y agoI love nextdns - pihole was fine but required admin, and I also had challenges vpn’ing in to use it out side of home. Whereas nextdns is simple to use, and effective.
- verelo 3y agoNo idea how I have been living under a rock. I was using Google dns forever, but just switched my router over to next! This looks amazing, and great to see so many people using it with positive feedback.
- JaggedJax 3y agoI've used ControlD [https://controld.com/ https://controld.com/] for this and liked it. Does anyone know how NextDNS compares to it? ControlD has worked well for me, outside a few UI complaints I have with their site. I do have some concerns with trust as I don't know much about ControlD, and I'd rather use the most trusted service for this.
- upheaval7276 3y agoI've been a NextDNS user for years now, and am trying out ControlD (last week) before I commit to switching. NextDNS development seems to have stalled and there are a number of conveniences missing, such as being able to label allowlist entries (ControlD supports this). Also, running the NextDNS app on a device that use a different profile then the one on my home router results in constant issues when the device wakes from sleep (not able to resolve domains for a noticeable amount of time on wake). NextDNS claims this is an Apple issue, but I don't think that's entirely true. Certainly not a problem for other similar services. I'm seeing ControlD as much more feature-rich and the service is evolving faster. I also personally like the UI a bit more vs NextDNS. Prices are comparable.
- SparkyMcUnicorn 3y agoIt looks like cost is not comparable. ControlD pricing is per user and a router costs $5/month, but NextDNS is a flat $20/year. So ControlD would be significantly more than NextDNS for me personally.
- JaggedJax 3y agoTheir "personal" pricing is $20 per year. It looks like they've moved that to a separate pricing page and are gearing the other for business use.
- upheaval7276 3y agoIt's very much comparable...for personal use: https://controld.com/plans?step=plans https://controld.com/plans?step=plans
- temp0826 3y agoHappy nextdns user here who used to have an overly-complicated setup with pihole and vpns etc. The only thing I have to complain about is the iOS app- I really wish it had a builtin way for viewing logs and white/blacklisting domains from the app, without having to go to the site. (Other settings would be nice too, sure, but as aggressive as I run it I find myself fiddling with the whitelist the most)
- idatum 3y agoI ran Pi-hole along with my OpenBSD router running unbound for some period. Then I realized I can download the same entries used for Pi-hole, AdGuard, uBlock, etc. I created a simple script that generates an unbound configuration that I can include in my unbound.conf file. One advantage over Pi-hole I noticed is I can return NXDOMAIN which makes more sense to me. I didn't see how I had that option with Pi-hole. I just checked, and the generated unbound configuration comes in at 218000 lines, so takes a moment on my Celeron J3060 class router when loading unbound.
- screamingninja 3y agoI setup Pi Hole with tailscale on an inexpensive cloud server. It is configured to serve DNS requests over the tailscale interface. Also added tailscale IP address of the Pi Hole to tailscale DNS override to ensure that all devices on the tailnet use it without any additional reconfiguration. For redundancy, I have multiple DNS servers on my tailnet. Family and friends can use it without worrying about portability and be protected at all times, especially on cell networks.
- scosman 3y agoTried this. Latency of DNS so critical, wasn't loving the self host option. Plus Tailscale wasn't quite reliable enough for all DNS traffic outside the house. I ended up with Pi-Hole on local network (manual DNS tied to Wifi SSID), NextDNS as default/fallback on other networks.
- boringuser2 3y agoOne of the major reasons why I don't use or recommend NextDNS is because they force you to use their DNS resolver when a DNS resolver like Quad9 has vastly superior threat intelligence.
- muppetman 3y agoOn my Pixel I just set Private DNS. Yea I had to setup a SSL certificate but that's easy to do. So when I leave home, I still use my Adguard server for adblocking without having to touch settings etc (except, as mentioned, captival portals) I could do the same with "vanilla" DNS (udp port 53) as well, but I don't. Pihole can't, easily, do Dns vis TLS/QUIC etc without 3rd party stuff being bolted on etc. Adguard Home is a single binary, it's great.
- sitzkrieg 3y agoi switched to nextdns all in a handful of months ago and mostly recommend it too
- snailmailman 3y agoI run a pihole server for myself- and access it over VPN when I’m traveling. But I’ve tried NextDNS and can confirm it works pretty well. Set my grandmother up on the free tier and within the first week it stopped her from getting phished, because the scam text she clicked went to a site that wouldn’t resolve.
- sangnoir 3y ago> PiHole works 90% of the time, but when it did stop working, I'd have to spend a bit of time fixing it. I don't know what problems you had with your Pi that resulted in 10% downtime, but that sort of hyperbole sounds a lot like shilling. Cases of SD card corruption are 99.9% due to the use of underpowered power supplies - just buy the official Raspberry Pi power supply if you can be bothered to search for a proper 2.5-3A USB power supply. > At $20/year [...] At $20 a year, I could buy a RPi Zero 2W and an SD card to keep as a spare every single year and have enough left over for a celebratory Sheetz sandwich. PiHole + WireGuard + $15 RPi Zero (once off) are unbeatable.
- kelnos 3y agoI think it's weird when people suggest that a self-hosted on-prem solution requires no maintenance and has so little downtime such that the time spent fixing issues doesn't matter. I run a bunch of local services on RPis and a decade-old Mac Mini. I love having the control over things, but I don't pretend I don't spend a decent amount of time maintaining it. I only run things that don't need to be highly available, so something like Pi-Hole is off the table. The last thing I want is for our DNS to go out while I'm sleeping, and my partner has to wake me up because she has work to do. You mention SD card corruption as the only reason why a RPi-based service might fail, but there are plenty of others: botched updates, random hardware failures, power supply issues, and likely other things I'm not thinking of. And even if a Pi-Hole can keep three nines of uptime (I'm skeptical of this claim), many people will find significant value in giving someone else money so they don't even have to think about digging into fix a problem for the rare occasion it happens. Suggesting that a particular home-hosted solution is "unbeatable" is meaningless; "unbeatable" in this case is a subjective measure, and other people will value different things than you do.
- sangnoir 3y ago> I love having the control over things, but I don't pretend I don't spend a decent amount of time maintaining it. I don't know the nature of your maintenance, but I've had unattended security updates working for years, I automated a bunch of stuff and use etc-keeper. > I only run things that don't need to be highly available Redundancy helps. 2 (more!) RPis cam be primary/secondary/tertiary DNS servers to match paranoia levels. Even if you have a single PiHole, keeping a pristine copy of the PiHole on a $3 sd card will get one up and running instantly. > Suggesting that a particular home-hosted solution is "unbeatable" is meaningless What site am I on, Subscription-Services-News? (:
- illiac786 3y agoCan nextDNS differentiate between clients coming from the same public IP? Do you get individual DNS IPs?
- 1vuio0pswjnm7 3y agoNextDNS sends EDNS client subnet (ECS). If challenged on privacy grounds they can claim it is for performance but a primary benefit of ECS, whether intentional or not, is to serve online advertising interests.^1 1. Dishonest people might try to debate intentionality. But forseeability is indisputable. The privacy issues created by ECS were known when it was introduced by Google. If ECS is truly for performance _that benefits the user_ then it stands to reason that it should the _user's_ choice whether to send it. That is, ECS should be optional. This is not merely a personal opinion. It was a consensus. See: https://yacin.nadji.us/docs/pubs/dimva16_ecs.pdf https://yacin.nadji.us/docs/pubs/dimva16_ecs.pdf AFAIK, NextDNS, like Google and OpenDNS, will not allow any user to disable sending ECS. For example, Cloudflare when it launched 1.1.1.1 decided not to send EDNS subnet and they have claimed this is based on privacy grounds. Whether anyone cares about privacy is their business, not mine. And whether anyone believes ECS improves peformance for them is for them to decide, not me.^2 Here I am just presenting some facts for consideration. Anyone is free to disregard these facts. 2. When considering "performance" we might differentiate between performance in requesting the resource the user is trying to access versus performance of ad servers or tracking servers. Needless to say, ads are not the resource the user is trying to access. And tracking is not even a resource. The speed of ads and tracking are obviously very important to Google, the company behind ECS. When we see a campaign for a "faster internet" from so-called "tech" companies such as Gooogle and Facebook we should keep in mind that "the internet" as envisioned by these middlemen is an internet full of advertising and tracking. As such, "faster internet" does not necessarily mean better speeds when downloading a resource. Ads and tracking are the not resources that users are intentionally requesting. They only serve to add delay and impede the user's retrieval of a desired resource. Hence the need for "ad blocking". Personally, I do not use third party DNS services, i.e., shared DNS caches operated by third parties. Historically these shared caches are the source of various problems. There are plenty of alternatives available today what with the enormous advances in network speeds and local storage that have occurred since the days when shared DNS caches were a necessity. For example, all the DNS data I use is stored locally and served from loopback addresses, either in the memory of a forward proxy or from authoritative DNS servers. Requests never leave the computer. (NB. PiHoles send requests to upstream third party DNS providers by default. Unless the parent commenter changed the PiHole's i.e., dnsmasq's, configuration to use a local DNS server serving locally stored DNS data then requests would by default be sent to the internet. In the case the configuration is changed to point to a local DNS server serving local DNS data and the user is satisfied with DNS-based blocking, like what NextDNS provides, then the utility of a PiHole would be questionable. Just omit DNS data for ad/tracking servers. I have been doing this for decades; I began using DNS for "blocking" before "adblockers" or PiHole existed.)
- berniedurfee 3y agoI’m with you. For twenty bucks it covers my home network and the app covers me when I’m out of the house. Turning it off occasionally reveals the horror of the un-ad-blocked internet. I never forget to turn it back on.
- itsTyrion 3y agoI gave up on using anything that isn’t the default/auto DNS for when I’m on the go more, as it breaks every single public wifi hotspot that has a login/I-agree-to-not-do-illegal-shit-etc page that obv cannot be resolved