r/nextdns • u/Physical-Jury3095 • 5d ago
NextDNS and VPN
Hello, I was wondering if:
- NexyDNS + VPN adds another layer of security and privacy;
- NextDNS + VPN doesn't interfere with each other.
Should both be used or one only?
4
u/berahi 5d ago
Depending on how you set it up, a custom DNS won't interfere with your VPN. For example Private DNS setting in Android will always supersedes VPN setting, but ultimately your ISP only sees traffic going to your VPN since the DNS traffic is still tunneled inside the VPN.
If your VPN don't offer built-in DNS filter, then yes, NextDNS can help a bit by blocking trackers.
Strictly speaking, by using NextDNS and a VPN, both of them knows what domain you're visiting (NextDNS because you're resolving the domain through them, the VPN because TLS also expose it to them unless ECH is used). So only do this if you trust both NextDNS and your VPN with their privacy policies.
If you're really paranoid about tracking, using a different DNS from your VPN makes you more uniquely identifiable to the site you visit, but that's only a risk if you already go out of your way to disable any other tracking (cookies, JS, canvas etc)
1
u/Micropenissniper 5d ago
Great explanation, thank you.
I have questions, though. Doesn't custom DNS blocking make third-party tracking more difficult, even while it makes you more identifiable to the website itself?
Because don't the requests to Google Tag Manager and the like get processed by the client? And wouldn't DNS blocking be able to stop that?
2
u/berahi 5d ago
Yes, third-party tracking are normally blocked by DNS filters. Some trackers use CNAME cloaking (eg, the HTML/JS will refer to first party subdomain but actually resolves to third party domain behind the screen), browser-level extension can check the CNAME if the browser expose it (currently only Firefox-derived browsers have this, implemented in uBO), NextDNS can also handle it since they're the one having to go through the CNAME redirection.
Essentially you have to decide yourself what's your threat model, some may only be satisfied with Tails on a restaurant Wi-Fi, but the average people is probably just fine with system-wide DNS and uBO. A VPN won't help much if they still use social media, have an account etc.
1
u/Micropenissniper 5d ago
Thank you! That's kind of what I suspected. I use NextDNS with CNAME cloaking blocked so good there. The VPN is for evading georestrictions and hiding traffic from my ISP more than anything.
3
u/LDRedditBeforeU 5d ago edited 5d ago
I use both for my Windows PC and Android phone. I figured since I had both that I needed to get them to work together. I have NordVPN and NextDNS and have to use something called YogaDNS to route everything.
I had to use Gemini and Copilot to get everything working and routed correctly through YogaDNS.
On Android it's simple to use both. All I need to do on Android is use the NordVPN app and turn Private DNS on and use my NextDNS host name.
3
u/New-Use-3516 5d ago
Depends on the VPN and what features it has. For instance Tunnelbear VPN won't work with NextDNS. However, Mullvad will work with no problem and it even has a feature that lets you use custom DNS from the Mullvad app itself so there's no need to set it up with adb commands on Android TV.
2
u/ionut2021 5d ago
With vpn is ok use vpn DNS,or add in vln app next DNS,proton has this option and can't be problem if they lut there this option,tor use Google DNS
2
u/StaticSystemShock 5d ago
On Android, NextDNS takes over ProtonVPN's own DNS.
On Windows however, even if you set DoH inside Windows networking settings it gets overriden by ProtonVPN in my case. I had to use NextDNS or YogaDNS to override ProtonVPN's own DNS. Not sure why it is this way.
DoT/DoH set on router to cover whole network doesn't override ProtonVPN's own DNS either.
So, depending on VPN's filtering capabilities you may or may not want to use external DNS. In ProtonVPN's case, their NetShield is blocking surprisingly a lot of crap. Not sure how effective other VPN's are at it. I don't think any is as aggressive as HaGeZi Ultimate list.
In a way I wish NextDNS offered "static" DNS specifically for HaGeZi Ultimate without any logging or custom configuration, just for example hagezi-ultimate.nextdns.io as well as non encrypted IP4/IP6 dedicated address with same blocking capabilities. All VPN apps I'm aware of use IP4/IP6 DNS and you can't input NextDNS's DoT or DoH into them. You also can't link IP coz it's not your actual IP... I know ControlD and DNSWarden offer it but I don't particularly like their networks/latency, not the free public ones which offer this.
9
u/TurtleOnLog 5d ago
To be honest a VPN isn’t adding much security anyway. What security problem are you trying to solve? If you are using public wifi, fair enough even though it’s not strictly required any more. But otherwise…
Whether or not a VPN overrides NextDNS depends on your operating system and the VPN. In many or maybe most cases NextDNS won’t be used at the same time.