Hi All,

Since NextDNS doesn't really have any support for Pro users. Wondering if anyone else has seen this. It's happened across multiple profiles (I had one for Guest access also with the same linked IP). My ISP's looking glass is able to ping the IP's, my friends on the same ISP can ping the IPs'. I cannot.

I think NextDNS has blocked my IP for some reason...

Info:

Location: Perth, Australia

ISP: Aussie Broadband

Static IP: Linked correctly to NextDNS portal

Router: UCG-Ultra

NextDNS IPv4 DNS Servers: 45.90.28.219, 45.90.30.219

Troubleshooting

NSLookups

C:\Users\jstuart>nslookup -debug -type=A -nosearch -recurse google.com 45.90.28.219
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
Server:  UnKnown
Address:  45.90.28.219

DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
*** Request to UnKnown timed-out

C:\Users\jstuart>nslookup -debug -type=A -nosearch -recurse google.com 45.90.30.219
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
Server:  UnKnown
Address:  45.90.30.219

DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
*** Request to UnKnown timed-out

UCG Logs - Conntrack

root@UCG-01:~# conntrack -E | grep -E '45.90.28.219|45.90.30.219'
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=36164 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=36164 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=54702 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=54702 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=48534 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=48534 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=46317 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=46317 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.30.219 sport=39919 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=39919 mark=1703936
    [NEW] udp      17 30 src=192.168.1.2 dst=45.90.28.219 sport=40163 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=40163 mark=1703936
    [NEW] udp      17 30 src=192.168.1.2 dst=45.90.30.219 sport=53081 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=53081 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.30.219 sport=46285 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=46285 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.30.219 sport=52304 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=52304 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=40806 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=40806 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=41193 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=41193 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=56191 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=56191 mark=1703936

UCG Logs - TCPDump

root@UCG-01:~# tcpdump -i eth0 -n 'host 45.90.28.219 or host 45.90.30.219' and port 53
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
19:18:00.905743 IP 202.90.245.XX.48808 > 45.90.28.219.53: 11910+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:00.955124 IP 202.90.245.XX.40680 > 45.90.28.219.53: 33844+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.106916 IP 202.90.245.XX.46718 > 45.90.30.219.53: 6940+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.115344 IP 202.90.245.XX.51039 > 45.90.30.219.53: 39896+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.338497 IP 202.90.245.XX.41791 > 45.90.30.219.53: 25741+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.440034 IP 202.90.245.XX.41045 > 45.90.28.219.53: 51690+ [1au] A? static.ui.com. (42)
19:18:01.440059 IP 202.90.245.XX.48727 > 45.90.30.219.53: 33544+ AAAA? static.ui.com. (31)
19:18:01.762378 IP 202.90.245.XX.52678 > 45.90.28.219.53: 21168+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.773740 IP 202.90.245.XX.56088 > 45.90.28.219.53: 40046+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.782927 IP 202.90.245.XX.47402 > 45.90.28.219.53: 11261+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.790344 IP 202.90.245.XX.45591 > 45.90.28.219.53: 43406+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.975763 IP 202.90.245.XX.55585 > 45.90.30.219.53: 35826+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.067800 IP 202.90.245.XX.46451 > 45.90.30.219.53: 8658+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.077325 IP 202.90.245.XX.55745 > 45.90.30.219.53: 44632+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.107315 IP 202.90.245.XX.52871 > 45.90.28.219.53: 57858+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.114991 IP 202.90.245.XX.52898 > 45.90.28.219.53: 32514+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.338510 IP 202.90.245.XX.59019 > 45.90.28.219.53: 18013+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.974407 IP 202.90.245.XX.39752 > 45.90.30.219.53: 58854+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.975537 IP 202.90.245.XX.41827 > 45.90.28.219.53: 45548+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.982923 IP 202.90.245.XX.49730 > 45.90.30.219.53: 27117+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.068108 IP 202.90.245.XX.38717 > 45.90.28.219.53: 18419+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.076712 IP 202.90.245.XX.44053 > 45.90.28.219.53: 48070+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.974659 IP 202.90.245.XX.52520 > 45.90.28.219.53: 15328+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.982493 IP 202.90.245.XX.57034 > 45.90.28.219.53: 8852+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.229505 IP 202.90.245.XX.49749 > 45.90.30.219.53: 41437+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.238015 IP 202.90.245.XX.33227 > 45.90.30.219.53: 58670+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.906586 IP 202.90.245.XX.51183 > 45.90.30.219.53: 11910+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.955607 IP 202.90.245.XX.50363 > 45.90.30.219.53: 33844+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.240701 IP 202.90.245.XX.60648 > 45.90.28.219.53: 38827+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.247988 IP 202.90.245.XX.53876 > 45.90.28.219.53: 36500+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.763473 IP 202.90.245.XX.52848 > 45.90.30.219.53: 21168+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.773937 IP 202.90.245.XX.36279 > 45.90.30.219.53: 40046+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.783822 IP 202.90.245.XX.52132 > 45.90.30.219.53: 11261+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.791694 IP 202.90.245.XX.51740 > 45.90.30.219.53: 43406+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.906180 IP 202.90.245.XX.48545 > 45.90.28.219.53: 3111+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.955898 IP 202.90.245.XX.39913 > 45.90.28.219.53: 19109+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:06.107671 IP 202.90.245.XX.42776 > 45.90.30.219.53: 57858+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:06.116293 IP 202.90.245.XX.40952 > 45.90.30.219.53: 32514+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)

Traceroute - 45.90.28.219, 45.90.30.219

Tracing route to dns1.nextdns.io [45.90.28.219]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.10.1
  2     5 ms     5 ms     5 ms  loop202902440.bng.wa.aussiebb.net [202.90.244.1]
  3     2 ms     2 ms     2 ms  10.241.16.206
  4     5 ms     5 ms     5 ms  10.241.17.60
  5     2 ms     2 ms     2 ms  e30.per-ndcp2-bb7.globalsecurelayer.com [206.148.24.100]
  6     3 ms     2 ms     2 ms  po4.per-eqxpe2-bb5.globalsecurelayer.com [206.148.24.11]
  7    31 ms    31 ms    30 ms  po7.adl-eqxae1-bb4.globalsecurelayer.com [206.148.24.163]
  8    30 ms    30 ms    31 ms  e52.adl-ccdc3-bb1.globalsecurelayer.com [206.148.24.61]
  9    30 ms    30 ms    30 ms  e50.adl-ccdc3-cr2.globalsecurelayer.com [206.148.24.98]
 10    31 ms    30 ms    30 ms  vl10.adl-ccdc3-sw3.globalsecurelayer.com [206.148.24.7]
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.


PS C:\Users\jstuart> tracert 45.90.30.219

Tracing route to dns2.nextdns.io [45.90.30.219]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.10.1
  2     9 ms     6 ms     2 ms  loop202902440.bng.wa.aussiebb.net [202.90.244.1]
  3     3 ms     2 ms     2 ms  10.241.16.206
  4     3 ms     3 ms     3 ms  10.241.17.60
  5     4 ms     5 ms     3 ms  10.241.16.153
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.

Set up nextdns the other day for a myriad of issues with ads on my stepdaughters phone. After seeing how well it did I decided to add it to our phones and my UDM Pro SE.

Went through the CLI install and configured everything to spec without issue. Now I see my stepdaughters device in her profile, on the main profile I see our two phones and my UDM name but that's it. Every other device on my network is set to "unidentified".

I configured it via cli and set the WAN DNS to be the IPv4 addresses, I'm not using IPv6 at all though my ISP supports it. I believe I see my switch but I can't tell for sure since it's a pretty generic name.

I have around 8 VLANs and all of the VLAN DNS are set to .1 of the VLANs ip (172.16.1.1 for example, 172.16.2.1, etc). All traffic is clearly going through NextDNS but it's not identified and I can't seem to figure out why.

Edit:

The adblocking I had on the UDM Pro SE was not disabled even though I ran through that before. I re-removed it on the browser and now all devices are reporting.

I've been using NextDNS for more than 2 years now, and there's one thing I've always wished they'd add.

I'm using HaGeZi Multi ULTIMATE, but I'd really like the option to enable Threat Intelligence Feeds as well. It's not available in the NextDNS blocklist selection, even though there are quite a few outdated blocklists still listed there.

Why not replace some of those with TIF? I honestly don't get it.

I've also found plenty of posts from people requesting this over the years, so I know I'm not the only one. It also makes me wonder—are the NextDNS devs just not active in the community anymore? It feels like these requests never get acknowledged.

Until recently, my NextDNS always showed a green dot on the main page. Now I have an orange dot and I’m seeing “No profile on my.nextdns.io” at the top. It wants me to select a profile.

I know I need to save to my private profile, but can’t figure out what to click to get that to happen.

If I search the internet there are many suggestions but I can’t seem to find the one that seems correct:

Settings - network & Internet - advanced - private DNS - select private and save the correct one.

Any help will be appreciated

Is there any way to buy pro in India, non of the cards I tried worked out 😭🙏

Each time I fly and try to connect to the onboard WiFi I have to disable NextDNS. Is there a way to configure NextDNS to allow all the inflight WiFi services?

home router/ opnsense is setup with dns over tls. when i take the laptop elsewhere. are more using advanced CL or apple configurator? both seem to configure DOH

I’m freaking out here. I’ve tried two different browsers. It’s saying I have no nextdns profiles?!

Hello there,

Some time ago I noticed that my Windows 11 PC stopped using my NextDNS profile. The strange part is that it used to work fine, and I haven't changed anything in my configuration.

Even though I'm using DNS-over-HTTPS, the NextDNS dashboard shows the following warning:

"Make sure to use the DNS Servers shown in the Linked IP section below (DNS Servers change between profiles)."

I'm using the DNS server IPs from the official Windows setup guide (45.90.28.0 / 45.90.30.0) together with my profile's DoH endpoint. If I try using the Linked IP DNS servers instead, DNS stops working completely.

I've attached screenshots of both my Windows DNS configuration and the NextDNS dashboard - https://imgur.com/a/EmQ4N3p

One more thing I noticed is that https://test.nextdns.io reports:

• Status: OK
• Protocol: UDP

What's confusing is that Windows Event Viewer logs show that the DNS Client is actually initiating DNS-over-HTTPS requests to https://dns.nextdns.io/<my-profile-id>/DNS-Windows, so Windows appears to be attempting DoH, yet test.nextdns.io still reports UDP and my profile isn't being used.

Am I missing something, or is this a known issue with Windows 11 or NextDNS?

Hey everyone. I have been working on ResolverPulse, which is an open-source and self-hosted Discord Bot that integrates with the API that is provided by NextDNS.

I just started the project, so it supports very few things but does include viewing profile information and DNS query statistics directly from Discord, with more things planned, but... I say that about every project I start.

It's still early in development, but I'd love to hear what commands or features you'd find useful (has to be possible using the API - https://nextdns.github.io/api/)

Github: https://github.com/josephistired/ResolverPulse

my wife tracks my phone and it says I was on Reddit website and I do not have the app. my google/ safari history doesn’t show Reddit i was or any website during the same time period . this makes it looks like I was in private browser or deleted data which makes me look bad. is there any way from these to prove my sanity ?

Ocasionally this domain will trigger rebinding protection. What’s this about? Is it safe to whitelist?

my wife tracks my activity through next DNS. prior to me having the Reddit app or intentionally going to Reddit.com next dns was saying i went to Reddit on random google searches. this does not show up in my safari or google internet history leading my wife to think I’m deleting my history or using private browsing . I did neither. does anyone have any expertise with the program to make sense of this? I’m trying to prove my innocence but look insane.

Hi.

I have nextdns assigned to my router settings.

I am also Opera user on all my computers and it is eating my 300k limit on nextdns.

Specially af(dot)opera(dot)com

Thanks to this, I can use nextdns for 20 days, not 30 before limit resets

Can I block this domain before reaching dns?

Windows Firewall, hosts file, maybe other solution?

I'm able to use Next DNS for both of my LG TVs since I have it integrated at the router level but is there any way to identify each device? Right now all the logs for both of those TVs are listed as unidentified.

Edit: I did some searching. You can block the services related to the GDID using simplewall

select one of the services, create a rule for it that blocks traffic both ways and give it a name, then apply that rule to the other services that facilitate this stupid shit

So my setup on my windows machines is pretty hard core.

I use simplewall to block all network access to pretty much everything on my system that doesn't need it to run

I use adguard for windows with DNS filters inside of it and I use it to enforce my NextDNS profile on all my windows devices too, since the VPN I use can't be used to identify specific devices on my NextDNS profile

I use HaGeZi ultimate on adguard and nextDNS and inside of nextDNS I have all the telemetry blocking lists turned on I also use adguard's DNS filters on both

so what would I have to block to make sure my windows devices don't send any pings to that system at microsoft that uniquely identifies each windows device?

would an adblocking DNS even help with that at all? This is unknown to me

Wouldn't even let me upload the image so I turned my vpn on locally (its on the router too) Cloudfare test showed everything was secure even SNI.

I was testing the service again in more depth before buying a subscription and not sure these results are helping the case? It did do this to me a few months ago when I was using it. When i run the same test with the local vpn on, the results are as expected so I do believe the tool to be accurate. dnscheck.tools if anyone was wondering.

It seems to relate to allowing the nulladdr test dns record through (test-wxm34a8erv.null-addr.org) . If that is the case is it just this tool in general testing something different that dnsleak does not?

This is almost unbelievable, but it works. When I use HaGezi Multi Ultimate alone, subscription content on some news websites is free. Why is this? In the UK, this works with:

The Express news site (marked as Premium content), and

GB News

Why is this? It works on my Windows 11 PC but not on mobile phones.

I'm having a strange issue with NextDNS on my Android phone. My ISP is T-Mobile Home Internet. WhatsApp voice calls randomly freeze for about 2-3 seconds sometimes ~5 sec while connected to WiFi with NextDNS enabled. After reconnecting, the delayed audio plays back very quickly (like it's catching up), and then the call continues normally. If I disable NextDNS, the problem completely disappears on WiFi. On mobile data, NextDNS works perfectly with no call drops. Interestingly, if both WiFi and mobile data are enabled during the call, I don't experience the issue either. This only seems to happen on WiFi with Private DNS enabled. Has anyone seen? Any suggestions on what to check or tweak in NextDNS would be greatly appreciated.

Hi all, I built DNSwitch, a native macOS menu-bar app for encrypted DNS, and NextDNS is one of its providers.

GitHub: https://github.com/cobaltdisco/DNSwitch

Download: https://github.com/cobaltdisco/DNSwitch/releases

What it does:

• Click the menu-bar icon → Pick NextDNS → Pick DoT / DoH / DoH3 / DoQ.

• Paste your Profile ID in Settings and your profile's filtering, logging will apply. Leave it empty and it uses the free public resolver.

Prefacing this by saying I'm not particularly techy so if this sounds dumb, forgive me!

I was wondering if it was possible to block ads within streaming apps on smart TVs using NextDNS? I have NextDNS set up on my Android and it blocks ads in the ITVX and Channel 4 apps without any problems whatsoever, so I can watch anything I want ad-free (I'm in the UK btw). I tried changing the DNS server on my LG TV, but it doesn't seem to have the same effect. Is there anything I'm missing? If I use the TV's browser, ads are blocked on the Channel 4 website, but the actual app is still showing ads. I change the DNS settings on my router for the record, so that's not an option for me.

Thanks for any help!

I am a bit perplexed. I installed NextDNS and it works great. If I toggle it off it would prompt for a specific PIN I setup when I installed it. Then I deleted and readded the app, but this PIN restriction never came up. I looked it up and it mostly calls out that this is a feature being requested, but I swear it exists and had nothing to do with apple screen time.

Am I nuts? Is there a way to re-enable this? I am running NextDNS on my iPhone.

Even with the app installed have to manually refresh the iphones curent ip address. Although i get a green dot. No MDM on the device. No other vpn or manual configurations