21 ms·

Show HN: NextDNS Adds "Bypass Age Verification"

537 points by nextdns 1y ago

We just shipped a new feature in NextDNS: Bypass Age Verification. More and more sites (especially adult ones) are now forcing users to upload IDs or selfies to continue. We think that’s a terrible idea: handing over government documents to random sites is a huge privacy risk. This new setting workarounds those verification flows via DNS tricks. It’s available today to all users, including free accounts. We’re curious how the HN community feels about this. Is it the right way to protect privacy online, or will it just provoke regulators to push harder? https://nextdns.io https://nextdns.io

nedt 1y ago
The age verification should be based on ISO 18013-5 mdocs and not even need a full ID. That would give you basically a "is over 18" flag signed by the state and not need anything in addition.
kaboomshebang 1y ago
On-topic: Seems like a good feature. Off-topic: I've been reading some of the comments and I notice a bunch of HN-members are unhappy about their product. My experience: things never broke for me, never needed to contact support, ads are blocked, etc (But I also use uBlock, etc) (P.s. - My only complaint is that -- like so many other SaaS offerings -- administrating payments is not easy enough. - No option to pay by year - So every month you have to go the website, login, go the admin, click download invoice - Instead of: click download PDF from monthly invoice email)
- slekker 1y ago
  What? I pay by year
- haswell 1y ago
  I’m also a happy customer. Regarding payments, I pay yearly. At the time I signed up I think it was the only option. They do have a $1.99/month option now, but they still offer yearly pricing.
  - kaboomshebang 1y ago
    Found that yearly payment option :)
- dewey 1y ago
  Just to balance the negative comments: I'm in the same boat, I'm paying yearly and I never had to use any support and things also never broke for me.
- jansper39 1y ago
  I've sadly moved away from the service due to it seeming to get a lot slower in recent months. Have moved to a self hosted pihole instance and everything is noticeably faster including most of the apps on my PC.
jadar 1y ago
I think this is wrong and should not exist.
- bigzyg33k 1y ago
  do you care to elaborate or are we being mysterious today?
ksu999 1y ago
Interesting discussion here. One thing I’d add is that beyond using VPNs or private browsing modes, tools like antidetect browsers can help a lot when managing multiple identities or accounts online. They provide separate digital fingerprints and reduce the risk of bans or tracking. For example, Multilogin (https://multilogin.com/antidetect/mobile-antidetect-browser/ https://multilogin.com/antidetect/mobile-antidetect-browser/)explains how this works in practice.
ksu999 1y ago
[dead]
6thbit 1y ago
I feel the feature would be better aligned with the rest of nextdns if the message was “Avoid ID checkpoint”, which is more privacy focused and less confrontational than the current presentation. But that’s when I thought this was a sort of blocklist of ID processors. If what you’re doing really is forcing the site to be served from a different geolocation then maybe just have that as a top level feature. “Use foreign DNS” or something, maybe allow configuring a list of domains I want to happen that on, or geographies I’m ok with connecting to.
riedel 1y ago
I wonder if it commercially would not make sense to build the opposite thing: a VPN that requires age verification that sites may whitelist. While it may seem nonsensical in the first place, because any VPN probably would allow this, however, it might put pressure on the sites to add a privacy friendly alternative. Not completely sure if creating an ' adult only' anonymous internet would be feasible. Thinking about it it would probably also create some dystopian dynamics if any more anonymous form of age verification would actually work. So I wonder if it make sense to simply join the chorus of all that hope it will fail big time. Probably the worst case would be if Google stepped in and offered something similar effective like Google play attestation.
Imustaskforhelp 1y ago
I am a user of nextdns and okay, this is really neato team! I find this really interesting. If I may ask, what are the dns tricks, is there a blog post about what you added, I am sooo curious about what sorcery is nextdns using. Edit: I searched on ddg and there was a ghacks.net link and a alternativeto.net article and sadly ghacks was taking a long time to load and I just read the alternativeto.net article and it was kinda cool, let me paste it here here is the article link : https://alternativeto.net/news/2025/8/nextdns-rolls-out-new-feature-to-bypass-age-verification-checks-on-adult-websites/ https://alternativeto.net/news/2025/8/nextdns-rolls-out-new-... NextDNS has introduced a new DNS-level feature that allows users to bypass age verification checks commonly found on adult websites. This update enables users to avoid submitting personal documents, such as photos or government-issued IDs, to unfamiliar websites when accessing age-restricted content. To enable the feature, users can activate it directly within the NextDNS settings. The technical approach is straightforward: the DNS resolver intercepts requests to target websites and routes traffic through proxy servers in countries where age verification is not required by law. This means that while users visit the same websites, the sites perceive the traffic as originating from a country without mandatory ID checks. These changes are particularly relevant for individuals in the European Union and the United Kingdom, regions where certain governments have introduced strict ID requirements for accessing adult content websites. Looking at community reaction, user feedback on Reddit and social media has been largely positive since the announcement, with some users ironizing that “NextDNS developers know their clientele!”. --- TLDR/my-thoughts: Nextdns can use something similar to vpn and I am wondering how much more efficient is this for this usecase compared to a vpn, like I am sure that vpns can be banned by a country, see china. But nextdns.io is still available in china?, how would that work, and so can this feature be actually expanded to make it a general purpose vpn too if need be but honestly a lot of vpn use cases might be for bypassing verification itself, so basically the only few use cases I can think of vpn is to bypass censorship and maybe verification and also changing vpn for lets say watching content that's available in other country Can nextdns add other features too, like imagine you can use nextdns with netflix and change it to anime mode and you can get netflix as in of japan, I don't have netflix but I am just giving an example because that's a lot of times what I hear from all those youtube vpn shills Or can they provide some vpn service itself while at it, and since nextdns still uses dns and dns can operate over https. I imagine that it might be even harder to detect such vpn traffic because I know for sure that some vpn's can be tracked implementation wise (as in wireguard)[i can be wrong, i usually am] but I am pretty sure that https can't be tracked in the same manner, and we can use dns over https in nextdns using this feature.. Can you guys maybe comment on what you think about it? adding general purpose vpns / japan/country switching/enabling vpns itself though I guess it might make you a vpn app which can have its own logs/rules and regulations and I am currently fine/really happy with protonvpn which I also think can run on top of https with their proxy option atleast in browser and maybe even in their apps I am not sure.
paradox460 1y ago
Where is the setting configured? I just looked through my admin page and didn't see any switch for it
- thewisenerd 1y ago
  i can see this in the settings page for a profile under the section "Bypass Age Verification" https://my.nextdns.io/$id/settings https://my.nextdns.io/$id/settings
skybrian 1y ago
Glancing at the front page, it looks like this product also has enforced SafeSearch and restricted mode to protect children, so... seems fine? They're doing the same thing themselves, and it's probably better since it's a local solution. If you're running a product like this, it should be officially allowed to bypass age verification.
- wizzwizz4 1y ago
  Arguably, the UK's Online Safety Act already allows these products to bypass age verification: see s. 12(6) https://www.legislation.gov.uk/ukpga/2023/50/section/12/6 https://www.legislation.gov.uk/ukpga/2023/50/section/12/6): > the age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child Unfortunately, it's hard to tell what this passage means, and I suspect it doesn't apply here. (But does that mean there's no law covering age-verification bypassing services? That seems like an unlikely oversight, and the Online Safety Act's badly-drafted enough that I'm not comfortable making a broad assertion here.) Hopefully case law sorts this out a little.
freedomben 1y ago
It may not be effective in the long term, but I think it's very much worth doing. The privacy nightmare of uploading government docs is appalling and should be resisted by all who can, so I think you're doing great work. If it provokes regulators to push harder, they might just get enough attention from voters to motivate a change. That would be my hope anyway
- Alive-in-2025 1y ago
  It's a great idea to get rid of, I'm shocked a company is this brave to do this. It's not in the interest of any adult to upload their ID so the government can track their web browsing. I didn't want to expose my kid to porn when they were 5, somehow it wasn't a problem because the avg browser use was guided by me, but also the browser blocked porn. When they were a bit older, a teenager, I also lightly guided their computer use.
  - amy_petrik 1y ago
    The solution to spam is that everyone replies to the spam and engages up to the point that human labor is required, thus making it financially impractictable The solution to this problem is not to provide YOUR ID but to provide AN ID, again and again, once per day. Again - cannot scale if a manual check is done by a human somewhere, flipside if it's fully automated now it's game-able
    - theshrike79 1y ago
      This is the AI we need. Detect or tag an email as scam -> forward it to an AI agent that will keep the scammer conversing as long as possible. Basically a tarpit solution but for actual humans.
    - sowbug 1y ago
      Interesting idea. If you're of age, then arguably there would be no material deception from using a fake or borrowed ID to prove that you're of age. I don't believe for a second that this argument would stand up in court, but it would at least be a rational form of protest against having to identify yourself.
syntaxing 1y ago
Easily one of the best $20 I spend a year. Makes iOS so much more usable and I really love supporting the vision of the developers from NextDNS
- brees504 1y ago
  Yep its my top IT reccomendation to everyone I know
- drcongo 1y ago
  Same. I absolutely love NextDNS.
- ethagnawl 1y ago
  Same here. I'd previously been using a Pi-Hole and Next is just so much simpler -- especially on the go.
perihelions 1y ago
As a remark, not a criticism, such a deliberate promotion is probably illegal in the UK market, > "But Ofcom says platforms required to introduce "highly effective" methods to check user age must not host, share or permit content that encourages use of VPNs to get around age checks. The government has also told the BBC it would be illegal for platforms to do so." https://www.bbc.com/news/articles/cn72ydj70g5o https://www.bbc.com/news/articles/cn72ydj70g5o
- walterbell 1y ago
  Can VPN/DNS providers independently market their services, if content providers cannot advertise VPN providers?
  - perihelions 1y ago
    > "content that encourages use of VPNs to get around age checks" I think "...to get around age checks" is controlling. It isn't illegal to promote VPN's in that country; it's illegal to promote their usefulness in circumventing other laws.
    - neilcj 1y ago
      The law reads like it applies to platforms required to do the checks rather than third party service providers.
      - JdeBP 1y ago
        * https://legislation.gov.uk/ukpga/2023/50/contents https://legislation.gov.uk/ukpga/2023/50/contents Which section of the Online Safety Act 2023 is that in, please?
- buyucu 1y ago
  For people who don't live in the UK, why should they care about UK law?
  - 1y ago
1a527dd5 1y ago
I love you guys, even before this.
throwpoaster 1y ago
[flagged]
- can16358p 1y ago
  Speak for yourself please. No one can dictate who can watch something or not.
- 888632798 1y ago
  What would the regime do without people like you?
- crooked-v 1y ago
  Porn is just the excuse used to put more systems of control and oppression in place, as can be seen by US and UK conservatives attempting to get the mere existence of trans and LGBT people classified as 'obscene' and thus any mentions of them banned under the same laws.
puppycodes 1y ago
amazing... we need more of this on the dns level
FiReaNG3L 1y ago
Better than that at least in the UK, they are not handing the data to the government, but to unregulated, diverse third parties - what could go wrong.
- OldfieldFund 1y ago
  it's all gonna get leaked every quarter
- cedws 1y ago
  Free VPNs are also at the top of the UK App Store. All of them look extremely dodgy, probably ran by foreign adversaries seizing the opportunity to slurp data.
baby_souffle 1y ago
> We’re curious how the HN community feels about this. Is it the right way to protect privacy online, or will it just provoke regulators to push harder? Both. May the mouse forever elude the cat in this game! If you’re proxying all traffic, that’s going to get expensive and - in theory - makes you as easy to block as VPN providers. I wish you the best of luck!
- deleted 1y ago
  [deleted]
pyuser583 1y ago
I'm a parent, and I try to keep my kids from the Internet in general, but adult parts in particular. VPN's are great for this. Just install the VPN, have it block access to adult sites, and have it alert me of any suspicious attempts. It's bewildering how VPN companies have branded their technology as "anti-censorship" and "privacy-focused." VPN's are a censor's best friend. DNS services are taking the opposite approach: they start by having a censorship feature (blocking malware, adult ads, etc), and now are adding anti-censorship options. There's nothing about connecting to a different network, or using a different DNS provider, that is anti-censorship.
- ronsor 1y ago
  > There's nothing about connecting to a different network, or using a different DNS provider, that is anti-censorship. In a sense, it allows you to pick your censors, or no censors. "Anti-censorship" doesn't necessarily mean that nothing is blocked; it means you get to control what's blocked for yourself.
- bongodongobob 1y ago
  VPNs have nothing to do with it. I guess yours has some kind of filtering service, but that's not at all related to a VPN. It's like buying a V8 engine because you wanted a turbo. V8's can have turbos, but it has nothing to do with being a V8.
- thaumasiotes 1y ago
  > VPN's are great for this. Just install the VPN, have it block access to adult sites, and have it alert me of any suspicious attempts. > It's bewildering how VPN companies have branded their technology as "anti-censorship" and "privacy-focused." VPN's are a censor's best friend. You're already using a router. That's where you would normally implement blocks. A VPN necessarily does the same thing, and so you can implement routing blocks there too. But this is like saying that a virtual machine is a great technology to run software. OK. Why do you want a virtual one?
- pjc50 1y ago
  Making your own filter choices should not be referred to as "censorship". Censorship is when the choice is taken away.
ltbarcly3 1y ago
Presenting government ID to random entities is literally what government ID's exist for. Paranoia about this is silly. Additionally, intentionally aiding someone (especially a minor) in circumventing the law is very likely to not be legal, especially when legality is largely determined by a jury, and especially^2 when the facts of the case against you are the most egregious that the government can find, especially^3 when you are profiting from it. It will be something like a 12yo using your service to access something absolutely shocking, and you or someone else will be forced to read a detailed text description of it in front of a jury. This doesn't even begin to address civil liability. I'm not saying what you are doing is 'wrong', I'm saying you should talk to a lawyer who specializes in this sort of thing before you are forced to.
- prism56 1y ago
  Is it though? Unfortunately this could have been implemented much better with a decentralised approach. Its not the showing the ID its having it potentially tied to your accounts and usage. Having your ID tied to your selfie which could be leaked.
- smallnix 1y ago
  Please post a link to a picture of your national ID. /s
  - ltbarcly3 1y ago
    I've had to upload my ID card to send money, open a bank account online, verify my identity for a dating app, book an international flight, and ironically to register for the app to have an electronic version of my id on my phone, and weirdly to pay a traffic ticket (why do they care who pays it?), get a discount on my Amazon Prime subscription, and finally to reset my password for my ID.me login for government websites. So all of those are 'fine' I guess, but god forbid you upload it to a third party verification service (the same one that was used for one or more of the above cases where I uploaded my id) to watch pornography, that's where we draw the line? You are being absurd. I don't agree with this requirement, but I'm also not so dishonest that I would pretend that it's a security issue.
tester89 1y ago
At least for my discord, I still can't access channels marked NSFW, instead of showing me the verification screen it just says "failed to load messages".
- wolfy1993 1y ago
  Likewise, unable to get it working myself (tested with reddit and bluesky - both ask for verification still). Will be keeping an eye on this though, hopefully this can be an alternative to my Irish VPN in the future.
skyzouwdev 1y ago
That’s a bold move. Handing over IDs to random sites is definitely a privacy nightmare, so I get why you built this. The real question is whether it buys time for users or just accelerates the push for stricter regulation. Either way, it sparks an important conversation
- mrweasel 1y ago
  The UK age verification seems to be "Upload your ID to a porn site", but that's not the EU solution from what I can tell. What the EU is building is an Identity Wallet, where your national online ID verifies your age with your wallet. The wallet can then tell the sites that yes, this person is in fact 16+ or whatever the age restriction is. How they plan to avoid having kids just borrow their parents phones I don't know, frequent reconfirmation maybe? The mistake that UK, and probably others, have made is that the government isn't actually able to provide the required infrastructure. If the solution is anonymous in the sense that the government doesn't see that I visit some site, and the site doesn't see who I am, then I struggle to see problem. This assumes that it's only applied to services and products that are already age restricted in the physical world already.
  - cutemonster 1y ago
    > How they plan to avoid having kids just borrow their parents phones I think one can say that about alcohol too? How do they plan to avoid kids drinking the wine? Maybe if the parents leaves knifes, wine and medicine and an unlocked mobile phone where the kids can find it, ... That's a problem that's hard to solve in a phone app? > frequent reconfirmation maybe? Maybe popping up face ID camera tests? Can be annoying, I suppose, if you were in the middle of something
- echelon 1y ago
  > Handing over IDs to random sites is definitely a privacy nightmare They just need to leak all of the elected official internet usage. You'll see this rolled back faster than it was implemented. I really can't wait for the video titles of the porn our government officials watch to be read out loud by newscasters. That's going to be such sweet karma.
pkulak 1y ago
That’s really cool. I thought you guys had stopped development altogether.
- tky 1y ago
  Same; I switched to ControlD when it appeared NextDNS was on autopilot without support or fixes.
  - pkulak 1y ago
    I did as well, but went back to NextDNS after a bunch of stuff broke for me on ControlD. Plus, I really like being able to control log retention and they have a server closer to me.
Ms-J 1y ago
Thank you for doing this! You are helping spread freedom. If everyone were to create more tools like this, it would shape the future to our liking.
mytailorisrich 1y ago
Features that are only aimed at breaking the law will tend to backfire...
luxurytent 1y ago
I don't have a strong opinion here, but I did want to say thank you for your service! I was previously running a pi-hole but switched my family and my household to NextDNS. Great $20/home spent
rany_ 1y ago
How does this "DNS trick" work? That to me is a much more interesting detail.
- shitloadofbooks 1y ago
  It likely overrides DNS resolution to CDN/POPs in countries which don't require age checking, or routes the traffic through TCP proxies so your traffic appears to come from a different country without these laws. This will increase the latency of all traffic to that site though.
  - rany_ 1y ago
    I tried out NextDNS and this feature doesn't seem to work anyway. Enabling "Bypass Age Verification" has no effect. I tested it out on PornHub and XVideos. I also can't find anything different in the returned A/AAAA records compared to my standard resolver.
  - selcuka 1y ago
    A DNS provider can not route your traffic through TCP proxies, so it must be the former.
    - cluckindan 1y ago
      Sure they can. When your browser resolves a host, they replace the actual IP with the IP of a proxy that is configured to forward traffic according to the Host HTTP header.
      - selcuka 1y ago
        Good point. I was thinking of an HTTP proxy, but surely a TCP proxy would work.
      - okasaki 1y ago
        You would have to install a certificate for that to work.
HocusLocus 1y ago
Seeking DNS with 'furry exemption' for fully clothed furries.
Telemakhos 1y ago
Does this create any new liability for the sites that are legally required to check ID?
buttocks 1y ago
As a subscriber of NextDNS I say, first, this is cool, but second, don’t do it. I don’t want NextDNS to face some sort of judgment that will get it shut down. Just publish the “DNS tricks” so that people can DIY but don’t make it part of your service.
atonse 1y ago
I use NextDNS to BLOCK porn sites, etc from my kids’ devices. I hope you aren’t changing your ethos as a company, although I don’t know, maybe your customers are changing and causing you to pivot. Because I don’t want any chance of this stuff affecting the blocks we use for minors, etc.
- graemep 1y ago
  I doubt it will. It fits with what I hope is their ethos, which is to allow customers to decide what they want blocked for themselves and their households.
- lionkor 1y ago
  Age verification doesn't protect minors, so I doubt their ethos changed.
  - atonse 1y ago
    Yeah the non-anonymity part of it is troubling. In HN comment thread for another post, I had hoped that we could come up with a rating system like we have with Movies, TV, Apps, mediated by HTTP Headers. I feel that is all we actually need. Then I can configure a browser a certain way, and the site publisher can just send a header saying "X-Content-Rating: Mature" or something along those lines, and that's it. It would be anonymous and opt-in.
    - extraduder_ire 1y ago
      The RTA header has existed for almost 20 years now, but it's nowhere near universal.
- deleted 1y ago
  [deleted]
pogue 1y ago
Hey @nextdns team. I'm a long time customer of NextDNS. I've been using your service for a few years now, but it seems a large amount of your primarily offered services & blocklist offerings are SEVERLY out of date. I detailed that here on Reddit: https://www.reddit.com/r/nextdns/s/IX2mUogHPK https://www.reddit.com/r/nextdns/s/IX2mUogHPK Your input on this thread would be greatly appreciated, as the community wants NextDNS to be the best service it can be. I do appreciate the addition of the Age Verification Bypass, though. Many users on r/nextdns are trying to guess how it works. Proxing specific domain requests to show the user is from another country is our best guess. But I would still be very interested in the specifics. Thanks.
- deleted 1y ago
  [deleted]
- huhkerrf 1y ago
  I'm really surprised to see this pop up considering how the NextDNS team seems to have disappeared otherwise. Out of date offerings like you mentioned, coupled with 0 customer support when things break (and things break a lot). New features like this are fine only if the base service works. I can guess that this feature also is going to break soon, and I don't have high hopes for it getting fixed. I moved over to ControlD about a year ago and I've been very happy. Nothing has broken, and they seem to be active about their service.
  - 1dom 1y ago
    Same here, I left NextDNS because I didn't trust it anymore. I started using it personally in homelab and just found it to be randomly a bit sluggish at times. Saw other similar reports. Tried to get support and failed. I saw it trying to sell itself as business capable DNS, and considered if it would fit in at work. Then I got an e-mail giving 7 days for me to disable and move all my logs out of the EU region. I was working at a large fintech firm at the time, and if a vendor had given us 1 week to rearchitect and figure out a new logging solution for DNS, we would have dropped them immediately due to the massive compliance issues they would have created. The messaging around the change was very much "FYI we're deleting everything in 7 days in that region whether you're good or not, feel free to do what you want", e.g. creating problems with no interest in helping with solutions to those problems. This would all be fine for a free-tier service, but I was a paying customer. Even as a paying customer though, I paid virtually nothing. Overall, NextDNS felt like it had the worst possible combination startup, passion project and beer money project features: I paid for it for a couple of years and got fed up because the amount talk about it gave the impression to me there was a fair and growing customer base but NextDNS were missing either the capability or focus to grow the service at the time. I'm conscious they'll be reading this - it was 2 years ago this happened, so maybe things have changed.
cedws 1y ago
I love NextDNS. Can you explain what exactly the DNS tricks are and where they do/don’t work?
j45 1y ago
Handing over Government IDs to private websites and apps is a highly risky and attractive target for identity theft and fraud.
1vuio0pswjnm7 1y ago
This sounds like a company using DNS to direct _other_ peoples' web traffic through _their_ proxies. Cloudflare started this way. That's why signing up for Cloudlfare requires using _Cloudflare's_ DNS servers The so-called "DNS trick", which is defintely not a trick, is to redirect traffic though a proxy server. Whoever operates the proxy, e.g. Cloudflare, NextDNS, etc., has control over the HTTPS traffic and _could_ have access to the contents HN commenters and other online commenters have criticised Cloudlfare in the past because it decrypts ("terminates") TLS connections and _could_ thereby have access to the contents of customers' traffic For any doubters, this access was confimed some years ago when a coding mistake by someone at CF in a scanner generated with ragel caused customers'_decrypted_ web traffic contained in memory on Cloudflare's proxies to spill out all over the web. Leaked data became publicly available and remained discoverable via web search for a while; the data had to be scrubbed from search engines and web archives which took several days at least https://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed NextDNS purports to be a "DNS service" but proxying HTTPS opens a new can of worms NB. This comment is not claiming that NextDNS or anyone else does or does not do anything, nor that anyone will or won't do anything. This comment is about _what becomes possible through control over DNS_. The possibilities it allows for control are why I do not use third party DNS service and prefer to control own DNS; having control can be very useful
- 1vuio0pswjnm7 1y ago
  Generally, CDNs, e.g., Akamai, etc., are authoritative DNS providers that direct HTTP traffic to selected reverse proxies When a customer gives a third party recursive DNS provider, e.g., NextDNS, etc., permission to "block" certain domains then the third party may act as an authoritative nameserver. Queries with RD==1 for A RRs of "blocked" domains not already cached do not need to be forwarded to an authoritative nameserver chosen or operated by the domain owner. The third party can answer these queries with whatever address it chooses, e.g., 0.0.0.0, rewrite the answers, etc. Whether any third party DNS provider is abusing this permission^1 is not the point of this comment. The point is that delegating DNS to a third party makes it possible^2 1. This could be difficult to discover 2. For example, I have seen DNS caches that return A records for certain domains that do not match the A records returned by the domain's authoritative nameservers; sometimes the responses even falsely claim they are authoritative answers. Academic papers have been published about countries that implement censorship via DNS. Even in the US, it's common for third party DNS providers such as hotels and certain ISPs, including cellular providers, to intercept DNS traffic and direct it to their own caches, rewrite answers, etc. This includes nonrecursive queries to a domain's authoritative nameservers
qwertox 1y ago
I wish they would add a dropdown box where I can select English as the main language. If they pretend they're a product targeted at anyone in the DACH region by offering the pages only in German, then they also must add an imprint: who they are, who is responsible, where they are, how I can contact them via email and phone.
bunnyfoofoo 1y ago
Do not promote or use NextDNS, it's essentially abandoned. You will not get any support from the developer when something breaks, and it will break. I tried for a year to contact him before abandoning it. Just check the help forums.
- spiffotron 1y ago
  I've used nextDNS for years but the past few weeks its been breaking websites left, right and centre so I gave up on it entirely. Everything feels much snappier since I dropped them for a different option too
  - esperent 1y ago
    What different options are there that provide anything like the same features and control?
  - nipperkinfeet 1y ago
    It would appear that you are not familiar with its proper use. You can identify which rule is causing the issue by reviewing the log, and then add it to your allowlist.
  - pogue 1y ago
    You definitely want to be following yokoffing's NextDNS Configuration Guide [1] to set it up. You basically only want to be using one of the Hagezi blocklists [2] and a possibly a few other options based on your preferences. I have it running on every device in my household and it works absolutely fine. I keep it on Hagezi Pro++, and that requires me to go through and whitelist some sites I use. That can be annoying, so in that case Hagezi Light or Normal should work just fine to block ads/trackers and not break things you have to go in and manually fix. OTOH, Control D offers free DNS [3] that includes using the Hagezi blocklists and other lists, but it's just a set and forget type setup as you can't look at log files to see if it's blocking stuff you don't want or anything like that. Scroll down to "3rd Party Filters" to see their offerings. [1] https://github.com/yokoffing/NextDNS-Config https://github.com/yokoffing/NextDNS-Config [2] https://github.com/hagezi/dns-blocklists https://github.com/hagezi/dns-blocklists [3] https://controld.com/free-dns https://controld.com/free-dns
AnonC 1y ago
Sorry to get on to a related topic, since the NextDNS team may be looking at these comments. Is there any plan at all to revive the iOS app (last updated in 2020) so that the toggle in the app actually works? I don’t like installing a NextDNS profile because it doesn’t offer the flexibility to turn it off or on as needed. The app used to work pre-2020, but doesn’t now. On my iPhone, at any given date and time, it’s just a random occurrence of whether NextDNS (with the app) works or not. Visiting test.nextdns.io may show “unconfigured” or a NextDNS endpoint. Various posts on the forums by several people over the years have not been responded to. I’d like to know if the team is ever going to work on this. If not, just remove the app from the App Store so that people don’t assume that it works when it doesn’t.
- maxmax_ 1y ago
  I‘m also using the iOS App and I think you need to wait a bit after using the toggle because the DNS requests might be cached by the Browser
  - dbmnt 1y ago
    Parent might also be getting bit by Apple's iCloud Private Relay and/or the "Hide IP Address" feature of Safari.
    - AnonC 1y ago
      Late reply. I don’t have any iCloud+ subscription and thus don’t have iCloud Private Relay. The NextDNS iOS app is broken and abandoned (no updates since 2020).
  - AnonC 1y ago
    Late reply, but the app toggle is always on in my device. But when I visit test.nextdns.io on a browser, it may report a NextDNS endpoint or say “unconfigured”. There’s no way for me to know if it’s working or not at any point in time. It’s broken and the app is abandoned (with no updates since 2020). I don’t want a permanent VPN profile on the device since I’d like to have the flexibility to turn it off if/when needed.
import 1y ago
Are you guys still active? I don’t remember how many of my questions went unanswered in the help forums, later switched to self hosted adguard.
karel-3d 1y ago
How can this work? What is "DNS tricks"? DNS is just telling you where the site is? edit: ah it spoofs the EDNS subnet for the DNS request, so it gives you server "intended" for a different location. You will get slower connection but if it's poorly implemented and they have geofencing just on that layer, it will not do the age verification stuff. It's interesting that it works, but... the website can still tell your IP through TCP handshake... it might fool some sites that have geofencing on DNS level.
- alphabetter 1y ago
  Thanks for answering the one thing I wanted to know about this. It wasn't at all obvious to me how this might be possible using DNS only. I guess it will work for some sites, but it would be interesting to know what fraction.
blissofbeing 1y ago
If you are already building a proxy network to handle this can you please implement redirects? I would love to redirect x.com to xcancel.com by just setting my DNS. I would pay more for this feature.

537 points by nextdns 1y ago

nedt 1y ago

The age verification should be based on ISO 18013-5 mdocs and not even need a full ID. That would give you basically a "is over 18" flag signed by the state and not need anything in addition.

kaboomshebang 1y ago

On-topic: Seems like a good feature. Off-topic: I've been reading some of the comments and I notice a bunch of HN-members are unhappy about their product. My experience: things never broke for me, never needed to contact support, ads are blocked, etc (But I also use uBlock, etc) (P.s. - My only complaint is that -- like so many other SaaS offerings -- administrating payments is not easy enough. - No option to pay by year - So every month you have to go the website, login, go the admin, click download invoice - Instead of: click download PDF from monthly invoice email)

slekker 1y ago
What? I pay by year
haswell 1y ago
I’m also a happy customer. Regarding payments, I pay yearly. At the time I signed up I think it was the only option. They do have a $1.99/month option now, but they still offer yearly pricing.
- kaboomshebang 1y ago
  Found that yearly payment option :)
dewey 1y ago
Just to balance the negative comments: I'm in the same boat, I'm paying yearly and I never had to use any support and things also never broke for me.
jansper39 1y ago
I've sadly moved away from the service due to it seeming to get a lot slower in recent months. Have moved to a self hosted pihole instance and everything is noticeably faster including most of the apps on my PC.

jadar 1y ago

I think this is wrong and should not exist.

bigzyg33k 1y ago
do you care to elaborate or are we being mysterious today?

ksu999 1y ago

Interesting discussion here. One thing I’d add is that beyond using VPNs or private browsing modes, tools like antidetect browsers can help a lot when managing multiple identities or accounts online. They provide separate digital fingerprints and reduce the risk of bans or tracking. For example, Multilogin (https://multilogin.com/antidetect/mobile-antidetect-browser/ https://multilogin.com/antidetect/mobile-antidetect-browser/)explains how this works in practice.

ksu999 1y ago

[dead]

6thbit 1y ago

I feel the feature would be better aligned with the rest of nextdns if the message was “Avoid ID checkpoint”, which is more privacy focused and less confrontational than the current presentation. But that’s when I thought this was a sort of blocklist of ID processors. If what you’re doing really is forcing the site to be served from a different geolocation then maybe just have that as a top level feature. “Use foreign DNS” or something, maybe allow configuring a list of domains I want to happen that on, or geographies I’m ok with connecting to.

riedel 1y ago

I wonder if it commercially would not make sense to build the opposite thing: a VPN that requires age verification that sites may whitelist. While it may seem nonsensical in the first place, because any VPN probably would allow this, however, it might put pressure on the sites to add a privacy friendly alternative. Not completely sure if creating an ' adult only' anonymous internet would be feasible. Thinking about it it would probably also create some dystopian dynamics if any more anonymous form of age verification would actually work. So I wonder if it make sense to simply join the chorus of all that hope it will fail big time. Probably the worst case would be if Google stepped in and offered something similar effective like Google play attestation.

Imustaskforhelp 1y ago

I am a user of nextdns and okay, this is really neato team! I find this really interesting. If I may ask, what are the dns tricks, is there a blog post about what you added, I am sooo curious about what sorcery is nextdns using. Edit: I searched on ddg and there was a ghacks.net link and a alternativeto.net article and sadly ghacks was taking a long time to load and I just read the alternativeto.net article and it was kinda cool, let me paste it here here is the article link : https://alternativeto.net/news/2025/8/nextdns-rolls-out-new-feature-to-bypass-age-verification-checks-on-adult-websites/ https://alternativeto.net/news/2025/8/nextdns-rolls-out-new-... NextDNS has introduced a new DNS-level feature that allows users to bypass age verification checks commonly found on adult websites. This update enables users to avoid submitting personal documents, such as photos or government-issued IDs, to unfamiliar websites when accessing age-restricted content. To enable the feature, users can activate it directly within the NextDNS settings. The technical approach is straightforward: the DNS resolver intercepts requests to target websites and routes traffic through proxy servers in countries where age verification is not required by law. This means that while users visit the same websites, the sites perceive the traffic as originating from a country without mandatory ID checks. These changes are particularly relevant for individuals in the European Union and the United Kingdom, regions where certain governments have introduced strict ID requirements for accessing adult content websites. Looking at community reaction, user feedback on Reddit and social media has been largely positive since the announcement, with some users ironizing that “NextDNS developers know their clientele!”. --- TLDR/my-thoughts: Nextdns can use something similar to vpn and I am wondering how much more efficient is this for this usecase compared to a vpn, like I am sure that vpns can be banned by a country, see china. But nextdns.io is still available in china?, how would that work, and so can this feature be actually expanded to make it a general purpose vpn too if need be but honestly a lot of vpn use cases might be for bypassing verification itself, so basically the only few use cases I can think of vpn is to bypass censorship and maybe verification and also changing vpn for lets say watching content that's available in other country Can nextdns add other features too, like imagine you can use nextdns with netflix and change it to anime mode and you can get netflix as in of japan, I don't have netflix but I am just giving an example because that's a lot of times what I hear from all those youtube vpn shills Or can they provide some vpn service itself while at it, and since nextdns still uses dns and dns can operate over https. I imagine that it might be even harder to detect such vpn traffic because I know for sure that some vpn's can be tracked implementation wise (as in wireguard)[i can be wrong, i usually am] but I am pretty sure that https can't be tracked in the same manner, and we can use dns over https in nextdns using this feature.. Can you guys maybe comment on what you think about it? adding general purpose vpns / japan/country switching/enabling vpns itself though I guess it might make you a vpn app which can have its own logs/rules and regulations and I am currently fine/really happy with protonvpn which I also think can run on top of https with their proxy option atleast in browser and maybe even in their apps I am not sure.

paradox460 1y ago

Where is the setting configured? I just looked through my admin page and didn't see any switch for it

thewisenerd 1y ago
i can see this in the settings page for a profile under the section "Bypass Age Verification" https://my.nextdns.io/$id/settings https://my.nextdns.io/$id/settings

skybrian 1y ago

Glancing at the front page, it looks like this product also has enforced SafeSearch and restricted mode to protect children, so... seems fine? They're doing the same thing themselves, and it's probably better since it's a local solution. If you're running a product like this, it should be officially allowed to bypass age verification.

wizzwizz4 1y ago
Arguably, the UK's Online Safety Act already allows these products to bypass age verification: see s. 12(6) https://www.legislation.gov.uk/ukpga/2023/50/section/12/6 https://www.legislation.gov.uk/ukpga/2023/50/section/12/6): > the age verification or age estimation must be of such a kind, and used in such a way, that it is highly effective at correctly determining whether or not a particular user is a child Unfortunately, it's hard to tell what this passage means, and I suspect it doesn't apply here. (But does that mean there's no law covering age-verification bypassing services? That seems like an unlikely oversight, and the Online Safety Act's badly-drafted enough that I'm not comfortable making a broad assertion here.) Hopefully case law sorts this out a little.

freedomben 1y ago

It may not be effective in the long term, but I think it's very much worth doing. The privacy nightmare of uploading government docs is appalling and should be resisted by all who can, so I think you're doing great work. If it provokes regulators to push harder, they might just get enough attention from voters to motivate a change. That would be my hope anyway

Alive-in-2025 1y ago
It's a great idea to get rid of, I'm shocked a company is this brave to do this. It's not in the interest of any adult to upload their ID so the government can track their web browsing. I didn't want to expose my kid to porn when they were 5, somehow it wasn't a problem because the avg browser use was guided by me, but also the browser blocked porn. When they were a bit older, a teenager, I also lightly guided their computer use.
- amy_petrik 1y ago
  The solution to spam is that everyone replies to the spam and engages up to the point that human labor is required, thus making it financially impractictable The solution to this problem is not to provide YOUR ID but to provide AN ID, again and again, once per day. Again - cannot scale if a manual check is done by a human somewhere, flipside if it's fully automated now it's game-able
  - theshrike79 1y ago
    This is the AI we need. Detect or tag an email as scam -> forward it to an AI agent that will keep the scammer conversing as long as possible. Basically a tarpit solution but for actual humans.
  - sowbug 1y ago
    Interesting idea. If you're of age, then arguably there would be no material deception from using a fake or borrowed ID to prove that you're of age. I don't believe for a second that this argument would stand up in court, but it would at least be a rational form of protest against having to identify yourself.

syntaxing 1y ago

Easily one of the best $20 I spend a year. Makes iOS so much more usable and I really love supporting the vision of the developers from NextDNS

brees504 1y ago
Yep its my top IT reccomendation to everyone I know
drcongo 1y ago
Same. I absolutely love NextDNS.
ethagnawl 1y ago
Same here. I'd previously been using a Pi-Hole and Next is just so much simpler -- especially on the go.

perihelions 1y ago

As a remark, not a criticism, such a deliberate promotion is probably illegal in the UK market, > "But Ofcom says platforms required to introduce "highly effective" methods to check user age must not host, share or permit content that encourages use of VPNs to get around age checks. The government has also told the BBC it would be illegal for platforms to do so." https://www.bbc.com/news/articles/cn72ydj70g5o https://www.bbc.com/news/articles/cn72ydj70g5o

walterbell 1y ago
Can VPN/DNS providers independently market their services, if content providers cannot advertise VPN providers?
- perihelions 1y ago
  > "content that encourages use of VPNs to get around age checks" I think "...to get around age checks" is controlling. It isn't illegal to promote VPN's in that country; it's illegal to promote their usefulness in circumventing other laws.
  - neilcj 1y ago
    The law reads like it applies to platforms required to do the checks rather than third party service providers.
    - JdeBP 1y ago
      * https://legislation.gov.uk/ukpga/2023/50/contents https://legislation.gov.uk/ukpga/2023/50/contents Which section of the Online Safety Act 2023 is that in, please?
buyucu 1y ago
For people who don't live in the UK, why should they care about UK law?
- 1y ago

1a527dd5 1y ago

I love you guys, even before this.

throwpoaster 1y ago

[flagged]

can16358p 1y ago
Speak for yourself please. No one can dictate who can watch something or not.
888632798 1y ago
What would the regime do without people like you?
crooked-v 1y ago
Porn is just the excuse used to put more systems of control and oppression in place, as can be seen by US and UK conservatives attempting to get the mere existence of trans and LGBT people classified as 'obscene' and thus any mentions of them banned under the same laws.

puppycodes 1y ago

amazing... we need more of this on the dns level

FiReaNG3L 1y ago

Better than that at least in the UK, they are not handing the data to the government, but to unregulated, diverse third parties - what could go wrong.

OldfieldFund 1y ago
it's all gonna get leaked every quarter
cedws 1y ago
Free VPNs are also at the top of the UK App Store. All of them look extremely dodgy, probably ran by foreign adversaries seizing the opportunity to slurp data.

baby_souffle 1y ago

> We’re curious how the HN community feels about this. Is it the right way to protect privacy online, or will it just provoke regulators to push harder? Both. May the mouse forever elude the cat in this game! If you’re proxying all traffic, that’s going to get expensive and - in theory - makes you as easy to block as VPN providers. I wish you the best of luck!

deleted 1y ago
[deleted]

pyuser583 1y ago

I'm a parent, and I try to keep my kids from the Internet in general, but adult parts in particular. VPN's are great for this. Just install the VPN, have it block access to adult sites, and have it alert me of any suspicious attempts. It's bewildering how VPN companies have branded their technology as "anti-censorship" and "privacy-focused." VPN's are a censor's best friend. DNS services are taking the opposite approach: they start by having a censorship feature (blocking malware, adult ads, etc), and now are adding anti-censorship options. There's nothing about connecting to a different network, or using a different DNS provider, that is anti-censorship.

ronsor 1y ago
> There's nothing about connecting to a different network, or using a different DNS provider, that is anti-censorship. In a sense, it allows you to pick your censors, or no censors. "Anti-censorship" doesn't necessarily mean that nothing is blocked; it means you get to control what's blocked for yourself.
bongodongobob 1y ago
VPNs have nothing to do with it. I guess yours has some kind of filtering service, but that's not at all related to a VPN. It's like buying a V8 engine because you wanted a turbo. V8's can have turbos, but it has nothing to do with being a V8.
thaumasiotes 1y ago
> VPN's are great for this. Just install the VPN, have it block access to adult sites, and have it alert me of any suspicious attempts. > It's bewildering how VPN companies have branded their technology as "anti-censorship" and "privacy-focused." VPN's are a censor's best friend. You're already using a router. That's where you would normally implement blocks. A VPN necessarily does the same thing, and so you can implement routing blocks there too. But this is like saying that a virtual machine is a great technology to run software. OK. Why do you want a virtual one?
pjc50 1y ago
Making your own filter choices should not be referred to as "censorship". Censorship is when the choice is taken away.

ltbarcly3 1y ago

Presenting government ID to random entities is literally what government ID's exist for. Paranoia about this is silly. Additionally, intentionally aiding someone (especially a minor) in circumventing the law is very likely to not be legal, especially when legality is largely determined by a jury, and especially^2 when the facts of the case against you are the most egregious that the government can find, especially^3 when you are profiting from it. It will be something like a 12yo using your service to access something absolutely shocking, and you or someone else will be forced to read a detailed text description of it in front of a jury. This doesn't even begin to address civil liability. I'm not saying what you are doing is 'wrong', I'm saying you should talk to a lawyer who specializes in this sort of thing before you are forced to.

prism56 1y ago
Is it though? Unfortunately this could have been implemented much better with a decentralised approach. Its not the showing the ID its having it potentially tied to your accounts and usage. Having your ID tied to your selfie which could be leaked.
smallnix 1y ago
Please post a link to a picture of your national ID. /s
- ltbarcly3 1y ago
  I've had to upload my ID card to send money, open a bank account online, verify my identity for a dating app, book an international flight, and ironically to register for the app to have an electronic version of my id on my phone, and weirdly to pay a traffic ticket (why do they care who pays it?), get a discount on my Amazon Prime subscription, and finally to reset my password for my ID.me login for government websites. So all of those are 'fine' I guess, but god forbid you upload it to a third party verification service (the same one that was used for one or more of the above cases where I uploaded my id) to watch pornography, that's where we draw the line? You are being absurd. I don't agree with this requirement, but I'm also not so dishonest that I would pretend that it's a security issue.

tester89 1y ago

At least for my discord, I still can't access channels marked NSFW, instead of showing me the verification screen it just says "failed to load messages".

wolfy1993 1y ago
Likewise, unable to get it working myself (tested with reddit and bluesky - both ask for verification still). Will be keeping an eye on this though, hopefully this can be an alternative to my Irish VPN in the future.

skyzouwdev 1y ago

That’s a bold move. Handing over IDs to random sites is definitely a privacy nightmare, so I get why you built this. The real question is whether it buys time for users or just accelerates the push for stricter regulation. Either way, it sparks an important conversation

mrweasel 1y ago
The UK age verification seems to be "Upload your ID to a porn site", but that's not the EU solution from what I can tell. What the EU is building is an Identity Wallet, where your national online ID verifies your age with your wallet. The wallet can then tell the sites that yes, this person is in fact 16+ or whatever the age restriction is. How they plan to avoid having kids just borrow their parents phones I don't know, frequent reconfirmation maybe? The mistake that UK, and probably others, have made is that the government isn't actually able to provide the required infrastructure. If the solution is anonymous in the sense that the government doesn't see that I visit some site, and the site doesn't see who I am, then I struggle to see problem. This assumes that it's only applied to services and products that are already age restricted in the physical world already.
- cutemonster 1y ago
  > How they plan to avoid having kids just borrow their parents phones I think one can say that about alcohol too? How do they plan to avoid kids drinking the wine? Maybe if the parents leaves knifes, wine and medicine and an unlocked mobile phone where the kids can find it, ... That's a problem that's hard to solve in a phone app? > frequent reconfirmation maybe? Maybe popping up face ID camera tests? Can be annoying, I suppose, if you were in the middle of something
echelon 1y ago
> Handing over IDs to random sites is definitely a privacy nightmare They just need to leak all of the elected official internet usage. You'll see this rolled back faster than it was implemented. I really can't wait for the video titles of the porn our government officials watch to be read out loud by newscasters. That's going to be such sweet karma.

pkulak 1y ago

That’s really cool. I thought you guys had stopped development altogether.

tky 1y ago
Same; I switched to ControlD when it appeared NextDNS was on autopilot without support or fixes.
- pkulak 1y ago
  I did as well, but went back to NextDNS after a bunch of stuff broke for me on ControlD. Plus, I really like being able to control log retention and they have a server closer to me.

Ms-J 1y ago

Thank you for doing this! You are helping spread freedom. If everyone were to create more tools like this, it would shape the future to our liking.

mytailorisrich 1y ago

Features that are only aimed at breaking the law will tend to backfire...

luxurytent 1y ago

I don't have a strong opinion here, but I did want to say thank you for your service! I was previously running a pi-hole but switched my family and my household to NextDNS. Great $20/home spent

rany_ 1y ago

How does this "DNS trick" work? That to me is a much more interesting detail.

shitloadofbooks 1y ago
It likely overrides DNS resolution to CDN/POPs in countries which don't require age checking, or routes the traffic through TCP proxies so your traffic appears to come from a different country without these laws. This will increase the latency of all traffic to that site though.
- rany_ 1y ago
  I tried out NextDNS and this feature doesn't seem to work anyway. Enabling "Bypass Age Verification" has no effect. I tested it out on PornHub and XVideos. I also can't find anything different in the returned A/AAAA records compared to my standard resolver.
- selcuka 1y ago
  A DNS provider can not route your traffic through TCP proxies, so it must be the former.
  - cluckindan 1y ago
    Sure they can. When your browser resolves a host, they replace the actual IP with the IP of a proxy that is configured to forward traffic according to the Host HTTP header.
    - selcuka 1y ago
      Good point. I was thinking of an HTTP proxy, but surely a TCP proxy would work.
    - okasaki 1y ago
      You would have to install a certificate for that to work.

HocusLocus 1y ago

Seeking DNS with 'furry exemption' for fully clothed furries.

Telemakhos 1y ago

Does this create any new liability for the sites that are legally required to check ID?

buttocks 1y ago

As a subscriber of NextDNS I say, first, this is cool, but second, don’t do it. I don’t want NextDNS to face some sort of judgment that will get it shut down. Just publish the “DNS tricks” so that people can DIY but don’t make it part of your service.

atonse 1y ago

I use NextDNS to BLOCK porn sites, etc from my kids’ devices. I hope you aren’t changing your ethos as a company, although I don’t know, maybe your customers are changing and causing you to pivot. Because I don’t want any chance of this stuff affecting the blocks we use for minors, etc.

graemep 1y ago
I doubt it will. It fits with what I hope is their ethos, which is to allow customers to decide what they want blocked for themselves and their households.
lionkor 1y ago
Age verification doesn't protect minors, so I doubt their ethos changed.
- atonse 1y ago
  Yeah the non-anonymity part of it is troubling. In HN comment thread for another post, I had hoped that we could come up with a rating system like we have with Movies, TV, Apps, mediated by HTTP Headers. I feel that is all we actually need. Then I can configure a browser a certain way, and the site publisher can just send a header saying "X-Content-Rating: Mature" or something along those lines, and that's it. It would be anonymous and opt-in.
  - extraduder_ire 1y ago
    The RTA header has existed for almost 20 years now, but it's nowhere near universal.
deleted 1y ago
[deleted]

pogue 1y ago

Hey @nextdns team. I'm a long time customer of NextDNS. I've been using your service for a few years now, but it seems a large amount of your primarily offered services & blocklist offerings are SEVERLY out of date. I detailed that here on Reddit: https://www.reddit.com/r/nextdns/s/IX2mUogHPK https://www.reddit.com/r/nextdns/s/IX2mUogHPK Your input on this thread would be greatly appreciated, as the community wants NextDNS to be the best service it can be. I do appreciate the addition of the Age Verification Bypass, though. Many users on r/nextdns are trying to guess how it works. Proxing specific domain requests to show the user is from another country is our best guess. But I would still be very interested in the specifics. Thanks.

deleted 1y ago
[deleted]
huhkerrf 1y ago
I'm really surprised to see this pop up considering how the NextDNS team seems to have disappeared otherwise. Out of date offerings like you mentioned, coupled with 0 customer support when things break (and things break a lot). New features like this are fine only if the base service works. I can guess that this feature also is going to break soon, and I don't have high hopes for it getting fixed. I moved over to ControlD about a year ago and I've been very happy. Nothing has broken, and they seem to be active about their service.
- 1dom 1y ago
  Same here, I left NextDNS because I didn't trust it anymore. I started using it personally in homelab and just found it to be randomly a bit sluggish at times. Saw other similar reports. Tried to get support and failed. I saw it trying to sell itself as business capable DNS, and considered if it would fit in at work. Then I got an e-mail giving 7 days for me to disable and move all my logs out of the EU region. I was working at a large fintech firm at the time, and if a vendor had given us 1 week to rearchitect and figure out a new logging solution for DNS, we would have dropped them immediately due to the massive compliance issues they would have created. The messaging around the change was very much "FYI we're deleting everything in 7 days in that region whether you're good or not, feel free to do what you want", e.g. creating problems with no interest in helping with solutions to those problems. This would all be fine for a free-tier service, but I was a paying customer. Even as a paying customer though, I paid virtually nothing. Overall, NextDNS felt like it had the worst possible combination startup, passion project and beer money project features: I paid for it for a couple of years and got fed up because the amount talk about it gave the impression to me there was a fair and growing customer base but NextDNS were missing either the capability or focus to grow the service at the time. I'm conscious they'll be reading this - it was 2 years ago this happened, so maybe things have changed.

cedws 1y ago

I love NextDNS. Can you explain what exactly the DNS tricks are and where they do/don’t work?

j45 1y ago

Handing over Government IDs to private websites and apps is a highly risky and attractive target for identity theft and fraud.

1vuio0pswjnm7 1y ago

This sounds like a company using DNS to direct _other_ peoples' web traffic through _their_ proxies. Cloudflare started this way. That's why signing up for Cloudlfare requires using _Cloudflare's_ DNS servers The so-called "DNS trick", which is defintely not a trick, is to redirect traffic though a proxy server. Whoever operates the proxy, e.g. Cloudflare, NextDNS, etc., has control over the HTTPS traffic and _could_ have access to the contents HN commenters and other online commenters have criticised Cloudlfare in the past because it decrypts ("terminates") TLS connections and _could_ thereby have access to the contents of customers' traffic For any doubters, this access was confimed some years ago when a coding mistake by someone at CF in a scanner generated with ragel caused customers'_decrypted_ web traffic contained in memory on Cloudflare's proxies to spill out all over the web. Leaked data became publicly available and remained discoverable via web search for a while; the data had to be scrubbed from search engines and web archives which took several days at least https://en.wikipedia.org/wiki/Cloudbleed https://en.wikipedia.org/wiki/Cloudbleed NextDNS purports to be a "DNS service" but proxying HTTPS opens a new can of worms NB. This comment is not claiming that NextDNS or anyone else does or does not do anything, nor that anyone will or won't do anything. This comment is about _what becomes possible through control over DNS_. The possibilities it allows for control are why I do not use third party DNS service and prefer to control own DNS; having control can be very useful

1vuio0pswjnm7 1y ago
Generally, CDNs, e.g., Akamai, etc., are authoritative DNS providers that direct HTTP traffic to selected reverse proxies When a customer gives a third party recursive DNS provider, e.g., NextDNS, etc., permission to "block" certain domains then the third party may act as an authoritative nameserver. Queries with RD==1 for A RRs of "blocked" domains not already cached do not need to be forwarded to an authoritative nameserver chosen or operated by the domain owner. The third party can answer these queries with whatever address it chooses, e.g., 0.0.0.0, rewrite the answers, etc. Whether any third party DNS provider is abusing this permission^1 is not the point of this comment. The point is that delegating DNS to a third party makes it possible^2 1. This could be difficult to discover 2. For example, I have seen DNS caches that return A records for certain domains that do not match the A records returned by the domain's authoritative nameservers; sometimes the responses even falsely claim they are authoritative answers. Academic papers have been published about countries that implement censorship via DNS. Even in the US, it's common for third party DNS providers such as hotels and certain ISPs, including cellular providers, to intercept DNS traffic and direct it to their own caches, rewrite answers, etc. This includes nonrecursive queries to a domain's authoritative nameservers

qwertox 1y ago

I wish they would add a dropdown box where I can select English as the main language. If they pretend they're a product targeted at anyone in the DACH region by offering the pages only in German, then they also must add an imprint: who they are, who is responsible, where they are, how I can contact them via email and phone.

bunnyfoofoo 1y ago

Do not promote or use NextDNS, it's essentially abandoned. You will not get any support from the developer when something breaks, and it will break. I tried for a year to contact him before abandoning it. Just check the help forums.

spiffotron 1y ago
I've used nextDNS for years but the past few weeks its been breaking websites left, right and centre so I gave up on it entirely. Everything feels much snappier since I dropped them for a different option too
- esperent 1y ago
  What different options are there that provide anything like the same features and control?
- nipperkinfeet 1y ago
  It would appear that you are not familiar with its proper use. You can identify which rule is causing the issue by reviewing the log, and then add it to your allowlist.
- pogue 1y ago
  You definitely want to be following yokoffing's NextDNS Configuration Guide [1] to set it up. You basically only want to be using one of the Hagezi blocklists [2] and a possibly a few other options based on your preferences. I have it running on every device in my household and it works absolutely fine. I keep it on Hagezi Pro++, and that requires me to go through and whitelist some sites I use. That can be annoying, so in that case Hagezi Light or Normal should work just fine to block ads/trackers and not break things you have to go in and manually fix. OTOH, Control D offers free DNS [3] that includes using the Hagezi blocklists and other lists, but it's just a set and forget type setup as you can't look at log files to see if it's blocking stuff you don't want or anything like that. Scroll down to "3rd Party Filters" to see their offerings. [1] https://github.com/yokoffing/NextDNS-Config https://github.com/yokoffing/NextDNS-Config [2] https://github.com/hagezi/dns-blocklists https://github.com/hagezi/dns-blocklists [3] https://controld.com/free-dns https://controld.com/free-dns

AnonC 1y ago

Sorry to get on to a related topic, since the NextDNS team may be looking at these comments. Is there any plan at all to revive the iOS app (last updated in 2020) so that the toggle in the app actually works? I don’t like installing a NextDNS profile because it doesn’t offer the flexibility to turn it off or on as needed. The app used to work pre-2020, but doesn’t now. On my iPhone, at any given date and time, it’s just a random occurrence of whether NextDNS (with the app) works or not. Visiting test.nextdns.io may show “unconfigured” or a NextDNS endpoint. Various posts on the forums by several people over the years have not been responded to. I’d like to know if the team is ever going to work on this. If not, just remove the app from the App Store so that people don’t assume that it works when it doesn’t.

maxmax_ 1y ago
I‘m also using the iOS App and I think you need to wait a bit after using the toggle because the DNS requests might be cached by the Browser
- dbmnt 1y ago
  Parent might also be getting bit by Apple's iCloud Private Relay and/or the "Hide IP Address" feature of Safari.
  - AnonC 1y ago
    Late reply. I don’t have any iCloud+ subscription and thus don’t have iCloud Private Relay. The NextDNS iOS app is broken and abandoned (no updates since 2020).
- AnonC 1y ago
  Late reply, but the app toggle is always on in my device. But when I visit test.nextdns.io on a browser, it may report a NextDNS endpoint or say “unconfigured”. There’s no way for me to know if it’s working or not at any point in time. It’s broken and the app is abandoned (with no updates since 2020). I don’t want a permanent VPN profile on the device since I’d like to have the flexibility to turn it off if/when needed.

import 1y ago

Are you guys still active? I don’t remember how many of my questions went unanswered in the help forums, later switched to self hosted adguard.

karel-3d 1y ago

How can this work? What is "DNS tricks"? DNS is just telling you where the site is? edit: ah it spoofs the EDNS subnet for the DNS request, so it gives you server "intended" for a different location. You will get slower connection but if it's poorly implemented and they have geofencing just on that layer, it will not do the age verification stuff. It's interesting that it works, but... the website can still tell your IP through TCP handshake... it might fool some sites that have geofencing on DNS level.

alphabetter 1y ago
Thanks for answering the one thing I wanted to know about this. It wasn't at all obvious to me how this might be possible using DNS only. I guess it will work for some sites, but it would be interesting to know what fraction.

blissofbeing 1y ago

If you are already building a proxy network to handle this can you please implement redirects? I would love to redirect x.com to xcancel.com by just setting my DNS. I would pay more for this feature.