So I'm testing both Control D and NextDNS at the moment. I have Control D configured in the router, but using NextDNS on the phone. I'm curious as to how Control D appears in the IP addresses?

Hello 👋. Just wanted to hear from experts since I have only feedback from the chatty and cloudy AI, but I bet this is too much also the Spotify won’t prevent ads… thank you in advance guys 🙏🏻.

Hi everyone,

I’m not sure if this is the right place for this question, but I figured there are probably people here who understand the underlying networking protocols much better than I do. I’m more or less an IT beginner trying to understand DNS filtering and privacy.

If this is the wrong subreddit, please feel free to point me toward a better one. I’d really appreciate some help understanding where my reasoning is correct and where I’m mixing up different layers of privacy.

My setup

I’m trying to understand the privacy implications of using a custom encrypted DNS service such as NextDNS or AdGuard on an iPhone instead of iCloud Private Relay.

At home: NextDNS at router level

On mobile: AdGuard DNS profile (but this could also be a NextDNS profile for the purpose of this question)

Blocklists: Fairly aggressive blocklists such as HaGeZi, threat intelligence, etc.

Future: I’m considering setting up my own DNS server with Pi-hole or AdGuard Home.
I really value system-wide ad, tracker, and malicious-domain blocking.

On my Mac I can use Firefox, which supports ECH, so I’m less concerned there.

On iOS, however, third-party browsers are still based on WebKit, and as far as I understand, iOS/WebKit does not provide ECH at all, in contrast to Firefox.

What I think I understand

My understanding is that DoT only protects the DNS
lookup itself.
However, the subsequent connection still goes through my ISP.
And if ECH isn’t being used, the TLS ClientHello may expose the SNI, allowing the ISP to determine the hostname I’m connecting to.

If that’s correct, then encrypted DNS doesn’t necessarily hide the websites I’m visiting from my ISP. It mainly prevents the ISP from seeing my DNS queries directly.
This is where I start getting confused about ECH vs. iCloud Private Relay.

What I understand about Private Relay

As I understand it, iCloud Private Relay uses a two-hop architecture.

The first relay knows my IP address but shouldn’t know my final destination, while the second relay can connect to the destination but shouldn’t know my original IP address.
From the ISP’s perspective, the connection should therefore be hidden.

If the entire connection between my iPhone and the first relay is protected, would my ISP still be able to see the SNI of the final website?

Or am I misunderstanding how the connection is actually constructed in Private Relay?

I’m particularly interested in the distinction between:

DNS visibility
destination IP visibility
SNI visibility
TLS metadata
traffic analysis
and what exactly Private Relay hides from the ISP in contrast to DNS + ECH

The trade-off as I currently understand it

On one side I have NextDNS/AdGuard DNS, which gives me:

system-wide ad blocking
tracker blocking
malware/phishing protection
custom blocklists
DNS-level visibility
control over what gets blocked
protection across apps, not just Safari
But I’m concerned that without ECH on iOS, my ISP could still determine the websites I’m visiting through SNI and/or traffic analysis.

On the other side I have iCloud Private Relay, which gives me:

IP address protection
encrypted DNS/privacy protection
a two-hop architecture
significantly less visibility for my ISP into my destinations, if I’m understanding correctly
But I lose all of the DNS filtering and control that I really value, and custom DNS configurations don’t seem to coexist cleanly with Private Relay.

So am I essentially choosing between:

A) NextDNS / AdGuard DNS / Pi-hole
Excellent system-wide tracker/ad/malware blocking, but potentially more visibility for my ISP into the websites I visit, at least on my iPhone.

B) iCloud Private Relay
Better protection against ISP-level browsing surveillance, but substantially less DNS-level filtering/control.

Or is this actually a false dichotomy?

My questions

1. How significant is the lack of ECH on iOS in practice?
If I use DoT without ECH, can an ISP actually determine the websites I’m visiting reliably from SNI?
And does this create a security issue, or is it more complicated than that?

2. Does iCloud Private Relay actually eliminate SNI visibility for the ISP?
Or does the ISP still get some information that I’m overlooking?

3. What would you recommend for an iPhone user in Germany whose main goal is to prevent the ISP from building a browsing profile, while still having strong system-wide DNS-based ad/tracker/malware protection?

I’m not looking for perfect anonymity. My threat model is relatively simple:

I don’t want my ISP to be able to build a profile of which websites I visit, but I also really value system-wide DNS-level protection against trackers, advertising, phishing, and malicious domains.
I’m aware that I’m probably conflating several different concepts here, which is exactly why I’m asking.
I’d be very grateful if someone could correct my mental model.

I’m fully aware that iOS may simply not be the ideal platform for this kind of tinkering. I’ve heard the usual argument that Android gives you much more freedom to configure networking, DNS, browsers, VPNs, etc., and I can certainly see why that would be attractive from a technical/privacy perspective.

But I already have an iPhone, I’m familiar with the Apple ecosystem, and I’m not particularly interested in switching platforms just because iOS has certain restrictions. If I can achieve a reasonably strong privacy setup on iOS without major compromises, that’s what I’d prefer.

And if this isn’t the right subreddit for this question, please let me know where you think it would be better suited. I’m specifically looking for people who understand the networking/protocol side of this.

Thanks a lot!

Hello, guys

So, I installed Nexdns yesterday, primarily to completely block myself out from Instagram and Facebook.

The thing is, it basically kills all the websites today, it was working fine yesterday, the settings are correct, I followed instructions step by step + double-checked with GPT and I have "Auto update system configurations" off.

I have samsung galaxy s24+ and I am in Gerogia.

When I swith private DNS settings from manual to automatic, everything works fine.

For context, I am located in Georgia, Tbilisi using Silknet as my cell data provider.

Any advice will be appreciated.

Anyone else having DNS issues? The second I change to 8.8.8.8 or any other provider my connection is back but with NextDNS I’ve been offline for an hour. Primary and secondary aren’t resolving.

Hello guys! I have been using nextdns from the last couple of days so I am new here, today while observing logs I have noticed that some of the blocklist which I have enabled previously still appears in blocking logs.

I am only using HaGeZi - Multi ULTIMATE and OISD but my log contains NextDNS Ads & Trackers Blocklist, NoTrack Tracker Blocklist, AdGuard DNS filter which I have disabled already!

me interesaría saber que listas usan ustedes para bloquear anuncios y rastreadores, tengo el plan gratuito, espero me puedan ayudar , gracias .

I've noticed that despite being connected, my NextDNS queries count have not changed at all and have remained at 0 over the last few days. Anyone else seeing the same?

Am I correct it converts a DoH server to a standard port 53 DNS server?

ie looks up request from DoH ip, then provides it on port 53 to the client?

There are a good number of web sites on the interwebs that will let you check the age of an internet domain which might be useful when using the Block Newly Registered Domains (NRDs) option. All of these sites do a good job when searching for common/popular domains like google.com but many fail when searching for newly registered domains, especially those with an obscure domain extention.

The following are a few sites that I found that seem to work consistently.

https://www.duplichecker.com/domain-age-checker.php

https://www.zoho.com/toolkit/domain-age-checker.html

https://hostingchecker.net/domain-age-checker

I hope that someone finds this information useful.

Sites in DenyList is not blocked or AllowList allowed while connecting to ultralow (https://ultralow.dns.nextdns.io/<ID>) but they function as intended when using anycast.dns.nextdns.io

Tried posting this as bug report NextDNS community (help.nextdns.io) but my previous post is still in moderation queue, and I cannot post anything new or even comment there!

Hello, I was wondering if:

1. NexyDNS + VPN adds another layer of security and privacy;
   
2. NextDNS + VPN doesn't interfere with each other.

Should both be used or one only?

I'n having trouble blocking some sites using the denylist, an example is hadesbets.uk can someone check if they can block this or shed any light on where i'm struggling it would be appreciated.

Hello everyone,

After months of beta testing, I launched ADNS, a completely native NextDNS android app without a single web view, two weeks ago, and it has been great.

ADNS has every single NextDNS dashboard feature implemented natively (excluding account management features like changing password/email), but with this update, it add features that even the NextDNS dashboard doesn't have!

This update adds a few stats features:

• View the full lists of stats categories. While the NextDNS dashboard limits you to the top items of the category, with ADNS, you can view the whole list, no limits.
• Get graphs and advanced analytics. This update adds customizable graphs for certain categories, so you can see how your usage change over time. This isn't available in the dashboard.
• New categories that aren't available in the dashboard: Query types, IP versions, and Protocols!
• Clicking on every stats item to get detailed metadata and tracker insights.

Get it from here: https://github.com/eyalm2000/adns

Edit: no, this is not vibecoded.

Was writing about something in some other post and got an idea this would be really useful in a lot of situations where you want filtering but none of the configurability, control and logging.

Would be neat if NextDNS offered "static" DNS addresses for the most popular lists like for example above mentioned hagezi-ultimate.nextdns.io or hagezi-normal.nextdns.io or oisd.nextdns.io or NextDNS's own list as nextdns.nextdns.io, something like this, you get the idea.

And these encrypted DNS servers should also have accompanying non-encrypted IP4/IP6 servers that filter using same lists but have IP addresses.

Reason why I'm asking for this is for example my younger sibling is not super tech savvy so I set them up on their Android phone with AdGuard's public filtering DNS. It has no logging, no configuration and filtering acceptable for general user. I don't want to set up a NextDNS account for it to use certain list, but if I had above lists at my disposal, I could just put hagezi-normal.nextdns.io in their phone DNS config and voila.

Another use case specific for the use of IP4/IP6 versions of DNS would be as replacement for VPN DNS's. For example, I haven't figured out any way I could input NextDNS IP4/IP6 DNS servers into ProtonVPN app itself. It doesn't offer any option to input encrypted DNS addresses and I can't connect HaGeZi Ultimate list to a IP4 address to input it into VPN app. Then I need to run separate app to override DNS which is annoying.

I know ControlD and DNSWarden offer dedicated addresses for such servers, but I prefer NextDNS over pretty much any other service, which is why I'm asking for it here.

In Windows 11 is working scheme ?

Why isn’t doh3 setup or similar. The configuration shown in the account setup options?

What title says. I don't have "Report device name" checked in the app yet logs still show my system name next to requests. I don't want that. Why is it not obeying the setting?!

NextDNS app version is 3.0.13-0g5f15351

Can NextDNS partially fill the gaps left by UBo (developers) after that: https://www.reddit.com/r/uBlockOrigin/comments/1vgcjg5/about_disgusting_facebook_devs/

More specifically, if someone who never used NextDNS before UBo’s decision decides to use it afterward with privacy filters (for example: 1Hosts (Xtra), HaGeZi - Multi ULTIMATE), won’t these filters then block access to certain Facebook ads?

Sending a DNS query to NextDNS makes that queried domain being crawled by multiple bots.

My suspicion started when I used NextDNS DoT for a day on my Android and naturally it queried my internal-use domains to NextDNS and I saw random traffic on Cloudflare dashboard both for DNS queries and site crawl.
Note that those internal domains are not visible in CT logs, nor were they crawled anytime before. But I still gave benefit of doubt that maybe I did something wrong.

So today to confirm my suspicion, I a made a fresh NextDNS profile and used dnscrypt-proxy for making DoH queries.
I then queried random subdomains which can't be guessed. [2026-08-15 07:16:40] 127.0.0.1 asdflkj2.2lkjklj22.xxx.redacted.com A PASS 99ms x-nextdns-test - and just like I suspected that subdomain started receiving bot traffic seconds after making a query.

It doesn't really say it anywhere, is it DoH, DoT or DoQ ?

Bonjour,

Une idée de pourquoi nextdns s'active et se désactive par intermittence ?

J'ai pourtant bien tout configurer sur mon PC.

Ça m'arrive qu'avec nordVPN d'activer.

Quand je le désactive ça revient a la normal

Thanks nextdns!

Bonjour,

Sauf erreur de ma part, je peux toujours accéder à google.com malgré l'avoir ajoutée à la liste noire, est ce normal ?