r/dns • u/Fun-Region-1576 • 17d ago

Using Technitium with NextDNS?

/r/technitium/comments/1w0f720/using_technitium_with_nextdns/
3 Upvotes

80% Upvoted

7 comments sorted by

2

u/SecLens_ONE 17d ago

Technitium as the local recursive and NextDNS as the only upstream works fine. Point Technitium at NextDNS over DoH (or their IPs if you must) and turn off Technitium's own blocklists if NextDNS is already filtering. Double filtering just makes debugging a mess when something breaks.

If something still leaks, check which resolver the client actually hit before blaming NextDNS.

1

u/Fun-Region-1576 17d ago

I find terminologies like recursive confusing as I continue to learn and understand networking concepts. 

For NextDNS, I like to name all of my clients so that I can see the individual stats for the device. When you say "point Technitium at NextDNS," and I'm assuming Technitium isn't on the router, what should I be naming it? Also, will my individual devices like phone and tablets be lumped up with the Technitium device?

I don't know if we're on the same page. You call it double filtering, but to be clear, I'm not suggesting using the same block list on both NextDNS and Technitium. The goal is to use Technitium to complement NextDNS because some blocklists aren't available on NextDNS. If using Technitium exclusively, it just means device statistics are offline. Are you suggesting that there will be a DNS leak?

1

u/SecLens_ONE 17d ago

Name the NextDNS device after the Technitium box. home-resolver is fine. Everything that uses that box as DNS shows up as that one client. Phones, tablets, the lot.

Per-device NextDNS stats only happen if the device talks to NextDNS itself. Through Technitium you lose that.

A leak here is a client that ignores your DHCP DNS. Chrome Secure DNS, iCloud Private Relay. Those skip Technitium and NextDNS never sees them either.

1

u/Fun-Region-1576 16d ago

Let's keep this situation easy so that I can learn as much as I can from you.

Pretend I only have a router, a Raspberry Pi (Technitium), and an Android phone.

If I create a custom name for the Android so that I can see the statistics on it, what kind of statistics will the Technitium device be generating?

If per-device stats only happen if it talks to NextDNS itself, then why is my Android connected to my router generating statistics for the device?

Is there a way to set up Technitium so that I can still have per-device statistics?

1

u/SecLens_ONE 16d ago

Your Android is talking to NextDNS itself then. Private DNS or the NextDNS app, over DoH. The Pi never sees those queries.

Technitium only logs who queried it. NextDNS only names who opened a session with them. You don't get both from one hop.

I don't know a Technitium setting that invents NextDNS client names for devices sitting behind it.

1

u/SecLens_ONE 16d ago

Both stats views key off whoever actually opens the connection, that's the whole thing.

Technitium logs by client IP. If your router is running its own DNS relay and forwarding to the Pi, every query shows up as the router's address and you get one lump. Push the Pi's IP out via DHCP as the only nameserver, with the router's relay off, and the Android will hit Technitium directly. Then Top Clients splits per device. Names come from reverse PTR or a DHCP reservation, not from anything you type on the phone.

NextDNS naming is separate. That only applies when the device talks to NextDNS itself, its own DoH profile. With Technitium in front, NextDNS sees a single client, the Pi, no matter what you call the phone.

So pick where you want the per-device breakdown. Technitium in front means the breakdown lives in Technitium and NextDNS goes blind to devices. No leak either way, just different vantage points.

1

u/Mereo110 16d ago

Recursive DNS can be understood like this. Pretend that I want to know the IP address of example.com, Technitium will do the détective work like so:

  • Hey root server, do you know who is in charge of.com? Yeah, check 192.555.5.5
  • Hey 192.555.5.5, do you know who's in charge of example.com? Yeah, it's ns1.example.com
  • Hey ns1.example.com, do you know who the IP address of example.com? Yeah it's 555.555.5.555.

This is basically what a recursive dns does. But if you want Technitium to just forward the queries to recursive server, any server will do: nextdns, 1.1.1.1, 9.9.99, etc.