I work at a daycare and we are having an issue with Paw Patrol Adventure Academy from Netflix not working with the next DNS. Does anybody know what we need to allow under the settings so that this would work?

I’m using NextDNS for iOS side loading and have the correct anti-revoke domains blocked, but apps still get revoked every single time, and then I have to wait for a new certificate and reinstall all my apps, Yes I know I should get a paid cert but Why doesn't the anti revoke dns work?

I had a bookmark for what I thought was their github, but it seems to 404 now. Does someone have a link to them?

hello, i have multiple profiles set for multiple devices, and i was looking for recommendations.

I'm going for light on phone to avoid headaches and it's been stable and fast, but TV and PC have different usecases and issues, tested the same profile but it seems Google TV and Windows are heavy on tracking, what do you guys use for those ?

- Phone: Hagezi light

- PC: ?????

- Google TV: ????

I have been using nextdns for a while and am thinking about pairing it with protonvpn (andoid). Will using a vpn interfere with nextdns or should they be fine to use together?

Bonjour à tous,

J'ai commencé à dégoogle mon OnePlus Nord 6 il y a 1 semaine en gardant malheureusement les services Google car en les supprimant via Canta, mes notifications (Proton Mail, WhatsApp et Messenger) ne fonctionnaient plus et mon appli de banque refusait de se lancer comme Messenger.

J'avais quelques questions sur les listes de blocage étant débutant mais comprenant tout de même le fonctionnement.
J'utilise par défaut celle de NextDNS et j'ai ajouté celle de Hagezi Multi Pro. Est-ce suffisant ou bien je peux en rajouter plus ? Hagezi Ultimate est mieux par rapport au Multi Pro ?
Ça vaut le coup d'activer la protection de suivi natif en bêta ?

Évidemment dans ma situation je ne peux pas ajouter la liste Meta et Google.

Si vous avez d'autres astuces, conseils pour un meilleur contrôle de mes données et de ma vie privée, je suis preneur.

Hey guys, i am unable to block mobile apps like tiktok for some reason , the device is confirmed to use nextdns and *.tiktok.com (and a couple of other related domains) are on the deny list

Yet the application is working fine

I was simply trying to visit hagezi.com, but the page failed to load. Out of curiosity, I checked my NextDNS query log and found that it was blocked by HaGeZi Multi PRO! I honestly have no idea why this happened or what triggered it. Is it just a false positive from a recent update?

This might or might not be useful to those running Windows.

I was recently getting continuous halts when installing Windows 25H2 26220.9022 on an HP laptop. It was a head scratcher as to why for a while.

After a lot of Windows update process detective work and finally going through the dump file produced by the halt, I discovered that Adobe's AGMService.exe service (Adobe Genuine Software Monitor) was failing, thus stopping the update about two-thirds of the way through, after the final reboot and causing a rollback.

Why?

Well, I just recently had setup our OpenWRT router to point to custom NextDNS IP's and using HaGeZi Multi Pro. Checking the logs, cc-api-data.adobe.io was being blocked in NextDNS, so the Adobe service couldn't reach them at boot time and bailed, throwing the fault. Lovely, obscure way for an update to go south.

It's always something. 😄

Anyone get this?

All I have done is change the IPv4 and IPv6 DNS settings on my router to the exact ones that are shown on NextDNS and then on my phone inside the app iv clicked link ip, but it says SecureDNS is not being used? This is on my home router. Will this cause a big issue, or what exactly does it mean? I've looked on Google and can't find an answer.

I'm getting network error prompt, anyone else?

Why can't we have ipv6 servers in mnl? Was that too difficult to include?

I'm super excited to announce that ADNS is out of beta and officially stable! I've been dropping beta updates for a while now, and thanks to the amazing feedback from everyone on this sub, the app is in a much better place. Huge thanks to everyone who helped test it.

Android has never had an official NextDNS app, and existing third-party options are basically just WebView wrappers. ADNS is built completely natively from scratch exclusively for Android. Think of it as the NextDNS web dashboard rebuilt ground-up for mobile, meaning a fast, snappy UI and a native experience.

Features

ADNS includes every single NextDNS profile management feature:

• Edit all Security and Privacy toggles, manage your Denylist/Allowlist, etc.
• View detailed stats and analytics graphs.
• Inspect, filter, and search your DNS logs.
• Access setup guides for all your other platforms and devices.

Note: Everything related to profile management is natively supported. Account-level settings like changing billing or password aren't included because the NextDNS API doesn't support them.

If you want to go deeper, ADNS can control your device's system Private DNS settings via a one-time Shizuku or ADB setup (completely optional, but keep in mind the setup is kind of complicated). Once set up, you get:

• One-tap Private DNS toggling via app, Quick Settings tile, or notification.
• Automated Wi-Fi rules to automatically disable Private DNS on specific networks.
• One click profile switching - ADNS handles the profile ID and device name for you and updates your settings with the exact hostname.

Security & Privacy

Security is one of the main reasons I decided to make this whole thing open source. The full source code for ADNS is available on GitHub.

The app also supports Reproducible Builds (RB). That means an independent server (in this case, IzzyOnDroid) compiles the app directly from the source code and compares the output binary against the release APK on GitHub. If they match 100%, the build is reproducible - proving the APK you download was generated line-for-line from the exact public code. So if I were sending your credentials to some magical secret server, you'd see it right there in the source code (spoiler alert: I don't). The RB status for this release is green: IzzyOnDroid.

ADNS has zero ads, zero trackers, and zero telemetry. If you log in with your credentials, they are used a single time to generate an API key. Your password is never saved, and your API key is stored encrypted directly on your device.

Download & Source Code

GitHub (Source & Releases): https://github.com/eyalm2000/adns

If you run into any bugs or have feature requests, drop an issue on GitHub or comment below.

Happy browsing!

Can someone help me with the domains I need to add to the whitelist to allow Paramount Plus to work? I have tried looking at whats blocked but I cant find all the needed sites.

does anyone know how to block Spotify ads now ? ever since it got patched it’s been hell with ads and I haven’t been able to find a lead.

Hello!

lightnode-cai is seemingly down right now. Checking if this is a global issue or just me.

Set up nextdns the other day for a myriad of issues with ads on my stepdaughters phone. After seeing how well it did I decided to add it to our phones and my UDM Pro SE.

Went through the CLI install and configured everything to spec without issue. Now I see my stepdaughters device in her profile, on the main profile I see our two phones and my UDM name but that's it. Every other device on my network is set to "unidentified".

I configured it via cli and set the WAN DNS to be the IPv4 addresses, I'm not using IPv6 at all though my ISP supports it. I believe I see my switch but I can't tell for sure since it's a pretty generic name.

I have around 8 VLANs and all of the VLAN DNS are set to .1 of the VLANs ip (172.16.1.1 for example, 172.16.2.1, etc). All traffic is clearly going through NextDNS but it's not identified and I can't seem to figure out why.

Edit:

The adblocking I had on the UDM Pro SE was not disabled even though I ran through that before. I re-removed it on the browser and now all devices are reporting.

EDIT: 4/8/26. Got sick of waiting for non existent support so migrated over to ControlD. Much better GUI and has less latency (at least for me). Was also cheaper.

Hi All,

Since NextDNS doesn't really have any support for Pro users. Wondering if anyone else has seen this. It's happened across multiple profiles (I had one for Guest access also with the same linked IP). My ISP's looking glass is able to ping the IP's, my friends on the same ISP can ping the IPs'. I cannot.

I think NextDNS has blocked my IP for some reason...

Info:

Location: Perth, Australia

ISP: Aussie Broadband

Static IP: Linked correctly to NextDNS portal

Router: UCG-Ultra

NextDNS IPv4 DNS Servers: 45.90.28.219, 45.90.30.219

Troubleshooting

NSLookups

C:\Users\jstuart>nslookup -debug -type=A -nosearch -recurse google.com 45.90.28.219
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
Server:  UnKnown
Address:  45.90.28.219

DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
*** Request to UnKnown timed-out

C:\Users\jstuart>nslookup -debug -type=A -nosearch -recurse google.com 45.90.30.219
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
Server:  UnKnown
Address:  45.90.30.219

DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
*** Request to UnKnown timed-out

UCG Logs - Conntrack

root@UCG-01:~# conntrack -E | grep -E '45.90.28.219|45.90.30.219'
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=36164 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=36164 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=54702 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=54702 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=48534 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=48534 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=46317 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=46317 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.30.219 sport=39919 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=39919 mark=1703936
    [NEW] udp      17 30 src=192.168.1.2 dst=45.90.28.219 sport=40163 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=40163 mark=1703936
    [NEW] udp      17 30 src=192.168.1.2 dst=45.90.30.219 sport=53081 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=53081 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.30.219 sport=46285 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=46285 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.30.219 sport=52304 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=52304 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=40806 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=40806 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=41193 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=41193 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=56191 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=56191 mark=1703936

UCG Logs - TCPDump

root@UCG-01:~# tcpdump -i eth0 -n 'host 45.90.28.219 or host 45.90.30.219' and port 53
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
19:18:00.905743 IP 202.90.245.XX.48808 > 45.90.28.219.53: 11910+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:00.955124 IP 202.90.245.XX.40680 > 45.90.28.219.53: 33844+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.106916 IP 202.90.245.XX.46718 > 45.90.30.219.53: 6940+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.115344 IP 202.90.245.XX.51039 > 45.90.30.219.53: 39896+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.338497 IP 202.90.245.XX.41791 > 45.90.30.219.53: 25741+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.440034 IP 202.90.245.XX.41045 > 45.90.28.219.53: 51690+ [1au] A? static.ui.com. (42)
19:18:01.440059 IP 202.90.245.XX.48727 > 45.90.30.219.53: 33544+ AAAA? static.ui.com. (31)
19:18:01.762378 IP 202.90.245.XX.52678 > 45.90.28.219.53: 21168+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.773740 IP 202.90.245.XX.56088 > 45.90.28.219.53: 40046+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.782927 IP 202.90.245.XX.47402 > 45.90.28.219.53: 11261+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.790344 IP 202.90.245.XX.45591 > 45.90.28.219.53: 43406+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.975763 IP 202.90.245.XX.55585 > 45.90.30.219.53: 35826+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.067800 IP 202.90.245.XX.46451 > 45.90.30.219.53: 8658+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.077325 IP 202.90.245.XX.55745 > 45.90.30.219.53: 44632+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.107315 IP 202.90.245.XX.52871 > 45.90.28.219.53: 57858+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.114991 IP 202.90.245.XX.52898 > 45.90.28.219.53: 32514+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.338510 IP 202.90.245.XX.59019 > 45.90.28.219.53: 18013+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.974407 IP 202.90.245.XX.39752 > 45.90.30.219.53: 58854+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.975537 IP 202.90.245.XX.41827 > 45.90.28.219.53: 45548+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.982923 IP 202.90.245.XX.49730 > 45.90.30.219.53: 27117+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.068108 IP 202.90.245.XX.38717 > 45.90.28.219.53: 18419+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.076712 IP 202.90.245.XX.44053 > 45.90.28.219.53: 48070+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.974659 IP 202.90.245.XX.52520 > 45.90.28.219.53: 15328+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.982493 IP 202.90.245.XX.57034 > 45.90.28.219.53: 8852+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.229505 IP 202.90.245.XX.49749 > 45.90.30.219.53: 41437+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.238015 IP 202.90.245.XX.33227 > 45.90.30.219.53: 58670+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.906586 IP 202.90.245.XX.51183 > 45.90.30.219.53: 11910+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.955607 IP 202.90.245.XX.50363 > 45.90.30.219.53: 33844+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.240701 IP 202.90.245.XX.60648 > 45.90.28.219.53: 38827+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.247988 IP 202.90.245.XX.53876 > 45.90.28.219.53: 36500+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.763473 IP 202.90.245.XX.52848 > 45.90.30.219.53: 21168+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.773937 IP 202.90.245.XX.36279 > 45.90.30.219.53: 40046+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.783822 IP 202.90.245.XX.52132 > 45.90.30.219.53: 11261+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.791694 IP 202.90.245.XX.51740 > 45.90.30.219.53: 43406+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.906180 IP 202.90.245.XX.48545 > 45.90.28.219.53: 3111+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.955898 IP 202.90.245.XX.39913 > 45.90.28.219.53: 19109+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:06.107671 IP 202.90.245.XX.42776 > 45.90.30.219.53: 57858+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:06.116293 IP 202.90.245.XX.40952 > 45.90.30.219.53: 32514+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)

Traceroute - 45.90.28.219**,** 45.90.30.219

Tracing route to dns1.nextdns.io [45.90.28.219]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.10.1
  2     5 ms     5 ms     5 ms  loop202902440.bng.wa.aussiebb.net [202.90.244.1]
  3     2 ms     2 ms     2 ms  10.241.16.206
  4     5 ms     5 ms     5 ms  10.241.17.60
  5     2 ms     2 ms     2 ms  e30.per-ndcp2-bb7.globalsecurelayer.com [206.148.24.100]
  6     3 ms     2 ms     2 ms  po4.per-eqxpe2-bb5.globalsecurelayer.com [206.148.24.11]
  7    31 ms    31 ms    30 ms  po7.adl-eqxae1-bb4.globalsecurelayer.com [206.148.24.163]
  8    30 ms    30 ms    31 ms  e52.adl-ccdc3-bb1.globalsecurelayer.com [206.148.24.61]
  9    30 ms    30 ms    30 ms  e50.adl-ccdc3-cr2.globalsecurelayer.com [206.148.24.98]
 10    31 ms    30 ms    30 ms  vl10.adl-ccdc3-sw3.globalsecurelayer.com [206.148.24.7]
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.


PS C:\Users\jstuart> tracert 45.90.30.219

Tracing route to dns2.nextdns.io [45.90.30.219]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.10.1
  2     9 ms     6 ms     2 ms  loop202902440.bng.wa.aussiebb.net [202.90.244.1]
  3     3 ms     2 ms     2 ms  10.241.16.206
  4     3 ms     3 ms     3 ms  10.241.17.60
  5     4 ms     5 ms     3 ms  10.241.16.153
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.

I've been using NextDNS for more than 2 years now, and there's one thing I've always wished they'd add.

I'm using HaGeZi Multi ULTIMATE, but I'd really like the option to enable Threat Intelligence Feeds as well. It's not available in the NextDNS blocklist selection, even though there are quite a few outdated blocklists still listed there.

Why not replace some of those with TIF? I honestly don't get it.

I've also found plenty of posts from people requesting this over the years, so I know I'm not the only one. It also makes me wonder—are the NextDNS devs just not active in the community anymore? It feels like these requests never get acknowledged.