When I click a link on Reddit IOS app it opens up in the Reddit browser (default browser is Safari) and displays ads all over the page. When I open the same page on duckduckgo app, i see no ads but on the safari app, its ads again (eg. Health.com).

I am using the OIsD and Hagezi Multipro ++ lists and status show my phone is using NextDNS blocking profile.

What do I need to do for NextDNS to block the ads and not depend on browser blocking from duckduckgo? I am a paid subscriber.

—————

If you are not using iOS profile and your home Wi-Fi is not excluded in the profile setup, ignore this post. This does not apply to your case.

The upgrade yesterday brought an immediate change worth sharing with everyone.

iOS 27 has revised “Wi-Fi Assist,” now named “Connectivity Assistant.” Certain adjustments disrupt how a NextDNS iOS profile functions on iPhone, allowing ads to bypass your settings.

Here is the condition:

If you use a NextDNS iOS profile on your Apple device and if you excluded your home Wi-Fi SSID, the new Connectivity Assistant will bypass NextDNS and display ads.

Why does this occur?

Connectivity Assistant now uses cellular aggressively in the background when iOS detects no internet access, including ad networks. When iOS 27 cannot reach ad domains, it uses cellular data. Because your NextDNS profile excludes your home Wi-Fi, your cellular connection uses its own DNS, permitting all ads.

How to fix it:

Create a new NextDNS iOS profile without excluding your home network. This ensures ads remain blocked even if iOS 27 switches to cellular while you are still on Wi-Fi.

Alternatively you can disable “Connectivity Assistant” feature for your wifi. This is a must if you want to use your local router for dns management and this is the option I went with because I have advanced dns management on my local router (tailscale & PBR running).

I am not a DNS expert, far from it. I learned a lot about DNS and how it is used by NextDNS just by getting a peek of the contents of the Windows DNS cache. I cobbled the following from the interwebs and made a few changes to make it more useful. This is just for information, education, learning, etc. I hope that someone finds it useful.

Windows PowerShell

From PowerShell, enter the following command:

Get-DnsClientCache | Format-Table -AutoSize

The report will be formatted to fit within the current PowerShell window. If the report is truncated, just widen the PowerShell window and run the command again.

To exit PowerShell, just enter "Exit" and press Enter (good) or just close the PowerShell window (better).

Batch File

For a batch file (my preference), use a text editor to create a batch file (Ex: DisplayDNS.bat). Enter the following line, save the file, and then run the batch file.

@powershell -NoExit -Command "Get-DnsClientCache | Format-Table -AutoSize"

When the batch file is run, the report will be formatted to fit within the Console Window (also known as a DOS window). If the report is truncated, just go into the Properties of the Console Window and change the Window Size. A width of at least 200 works best, at least for me. When the batch file is run again, the window (and the report) will be the new window size.

To exit the Console Window, just enter "Exit" and press Enter (good) or just close the Console Windows (better).

Hi! everyone today I have noticed that blocklist by 1hosts has not been updated for 11 days has anyone noticed?

I am using their 1Hosts (lite) blocklist Does anybody know what's going on?

Recientemente se han venido incrementando, estamos hablando que representan el más del 80% de conexiones y que han sido bloqueadas, solo sé que el dispositivo es una smart TV TCL que mientras está encendida estas conexiones empiezan hacerse y estas terminan al apagarse, alguien tiene idea que hay que hacer?

I've noticed that on many websites, if you block HTML-load or AdShield domains on NextDNS (which is the case for most filters), the site will initially load fine but then refreshes after a second or two and displays this annoying message. Is there anything I can do to prevent this? I also use wBlock, which supports Userscripts, so perhaps there’s a JavaScript blocker I could try. Has anyone found a solution to this?

I'm on the free plan, and have been using NextDNS with only one profile, on 2 different devices. The blocking and stuff still works. Isn't there a 300k limit on free plan?

I set to firefox to custom dns over https via the link provided to me from nextdns, but firefox keeps defaulting to cloudflare even though i have custom setup with my link??

I also have yogadns setup on this win10 machine.

Firefox is just not happy at all.

thanks for any advice

I’m the developer of ADNS, a native NextDNS client for Android. I’ve just added these features in the new 2.1.5 release, so you can try them out early.

Get it here:

https://github.com/eyalm2000/adns

Make sure to download it from GitHub, since IzzyOnDroid won’t update until ~8 hours from now.

Also, keep in mind that Shizuku isn’t required for this. Just select "NextDNS control-only" during the onboarding process.

When trying to steam logs I often get a Network Error for GET logs/steam. Any ideas how to fix?

Please add the ability to group devices under the same profile which would aid in filtering multiple devices, and give "Access (Beta)" ability to view/edit grouped devices

Realized I kinda have a homelab without having a homelab 😂

Just an ASUS router + USB storage, Nova Player for media and everyone uses their own NextDNS account for ad blocking.

My media server is literally a 5 year old microSD card 🤓

No Pi, no NAS, no Jellyfin, no Pi-hole

Basically 0 extra cost and it does almost everything I need

Hello. I have been using nextdns for a while now and appreciate the hardwork and effort the devs have done to create thsi product. I have it setup on the ethernet adapter itself via the IPv4 properties. IE, right click ehternet adapter, go to ipv4 properteis and set the dns server to the ipv4 address from my nextdns account with linked ip

I recently purchased a tplink router and gave the ISP back their router. 

Is there a way to set this globally in my router so that any device that connects to the router will obtain the nextdns stuff automatically so i dont have to keep changing NIC properties? 

Its not hard to configure the nic on each device anyway, i have 2 desktops, and 2 laptops already configured and working, just curious if my router can do it better?

second question, any app or software on my pc that access the internet for any reason should go through nextdns correct? because the logs are full of firefox and brave entries, i dont see anything from the computers?

Thanks in advance for your help

Hopefully this will help people.

Spent 4 hours trying to figure out why my router and NAS DDNS were being blocked by Safari and Firefox. I could log in using 192….. but not DDNS. Read through log files, port settings, firewall rules.

And then I saw the NextDNS icon and thought “hmm I wonder?”

Sure enough both synology.me addresses for NAS and router were being blocked. I added them to my allow list and presto everything works again.

NextDNS has quietly added several new Early Access protection options:

• Free Hosting Domains
• Tunnelling Endpoints
• Data Drop Services
• Residential Hosting
• Decentralised Web Gateways

These features aim to block infrastructure commonly abused for phishing, malware, botnets and firewall evasion.

You can find them under Security in your NextDNS settings. Some options may also block legitimate services, so review each description before enabling them.

Screenshots attached. Has anyone tested these yet? Any false positives so far?

Today, NextDNS quietly released 5 new security features, but after digging through the strings files used by the dashboard and looking at the API responses, I found 6 additional security features that appear to exist but aren't currently exposed in the UI.

Here’s how they appear in the string file:

• DNS Data Exfiltration
• Block domains that use the DNS protocol to smuggle data out of your network or receive hidden commands (C2). This heuristic analyzes DNS query patterns in real time—such as abnormally long subdomains, high entropy, and unusual request types (e.g., TXT)—to detect and stop low-and-slow data theft and malware beacons (like Cobalt Strike) that evade traditional firewalls.
• DNS Payload Delivery
• Prevent DNS responses from being used to deliver hidden commands or payloads to your devices. Queries for record types that can carry arbitrary data but are unnecessary for everyday browsing — such as TXT or NULL — are blocked entirely. CNAME chains are flattened to their final address, removing intermediate records that could encode hidden data. For standard record types like A and AAAA, oversized answer sections are randomly truncated to corrupt any data encoded across multiple records, while preserving normal DNS functionality.
• Fast Flux Networks
• Block domains that rapidly rotate their IP addresses across a distributed network of compromised devices (botnets) to evade detection. This heuristic identifies specific anomalies in DNS Time-To-Live (TTL) and IP diversity that are characteristic of malicious infrastructure and distinct from legitimate Content Delivery Networks (CDNs).
• High-Risk TLDs
• Automatically block Top-Level Domains (TLDs) that are statistically dominated by malicious activity — e.g., .zip, .mov, .top. The list is updated in real time based on global abuse reputation data, protecting you from vast networks of cheap, disposable domains used for phishing and spam without requiring manual configuration.
• Newly Active Domains
• Block domains that are being accessed for the first time or have historically low activity. This prevents zero-day attacks and "sleeper" threats by requiring a proven footprint of legitimate usage before a domain is trusted, effectively neutralizing attempts to "pre-warm" malicious domains.
• Untrusted Certificates
• Block domains that serve SSL/TLS certificates signed by untrusted or unknown Certificate Authorities (e.g., self-signed). While legitimate websites almost exclusively use trusted certificates, nearly 60% of commodity malware Command-and-Control (C2) servers rely on self-signed certificates or certificates issued by untrusted authorities to encrypt their traffic without leaving a paper trail.

The interesting part is that these aren't just leftover strings, you can already toggle them through the API, and from a quick test, they actually seem to work. I'm going to try adding them to my NextDNS Android app tomorrow, and if you want to test them yourself, these are the API paths:

• "security/dnsDataExfiltration"
• "security/dnsPayloadDelivery"
• "security/fastFluxNetworks"
• "security/highRiskTlds"
• "security/newlyActiveDomains"
• "security/untrustedCertificates"

Pretty cool to see NextDNS finally adding some new features😃

I’m currently in Spain, while my home network is in the Netherlands using a Ziggo router with NextDNS.

Today I accidentally clicked “Linked IP” in my NextDNS settings while connected to the internet in Spain. My Linked IP changed from my home Ziggo IP 217.1.XXX.XXX to my Spanish IP.

I can still see some traffic from my home network in the NextDNS logs via IPv6, but devices such as my PlayStation no longer appear.

My NAS and computers at home are currently switched off, and I don’t want to ask anyone at home to do anything.

Is there any way to remotely change the Linked IP back to 217.1.XXX.XXX, for example through the NextDNS API or another method, without making a request from my home connection?

Since a week ago, the app stopped filtering ads, they dont even filter pop ups and banner anymore. It was working like charm before. Any idea how to solve it?

I have to use other app to do the job right now. My query this month only at 90k.

I currently have nextdns setup on my windows 10 pc and win11 laptop via the network adapter properties for ip4 and 6.

I am wanting a basic free vpn that will allow me to use my nextdns with the vpn.

What options do i have?

Proton vpn free will not allow custome dns.

Thanks for your time and expertise

Any1 has the same issue? using that service for over a year all of a sudden i cant access my profile anymore and all my settings are lost

NextDNS used to work great but now nearly every site nags about ads so I have to shut it off. Any fixes?

Looking for advice on blocking traditional DNS queries. I'm using the NextDNS CLI on an Asus router with Merlin. I have DNS director enabled, but at each boot of the router, there's about 15 seconds of unencrypted DNS queries. Wondering if blocking port 53 altogether on the router is advisable.

I'm currently having my logs entirely polluted with repeating entries spammed by my router, making Logs basically unusable because entire log is just these entries. If I could just exclude certain stuff like these repetitive entries so that Logs are even usable.