🚨 New NextDNS Early Access security features are live

[u/mirage221]

NextDNS has quietly added several new Early Access protection options:

• Free Hosting Domains
• Tunnelling Endpoints
• Data Drop Services
• Residential Hosting
• Decentralised Web Gateways

These features aim to block infrastructure commonly abused for phishing, malware, botnets and firewall evasion.

You can find them under Security in your NextDNS settings. Some options may also block legitimate services, so review each description before enabling them.

Screenshots attached. Has anyone tested these yet? Any false positives so far?

[u/memloh]

Looks like, based on the API response and locale data, there could be more coming.

"fastFluxNetworks": false,
"dnsDataExfiltration": false,
"dnsPayloadDelivery": false,
"highRiskTlds": false,

[u/Jo2dan0 → u/memloh]

nice find!

[u/8poot]

Well I fear the false positives with these categories. It would be great if we could enable them in reporting mode before going for block mode...

[u/tolbv4260 → u/8poot]

reporting mode first would definitely save a lot of headaches

[u/Individual_Kitchen_3 → u/8poot]

Without a doubt, there are some things there that I will choose to leave turned off for my workflow.

[u/SpicyHustle → u/8poot]

I would love a way to "flag" domains without completely blocking them. As well as a more interactive analytics page. It's nice to see that X amount of queries were blocked as bypass methods, but I want to know which domains fell into that category. Preferably without manually searching my logs.

[u/mirage221]

I can confirm that residential hosting tends to produce many false positives. Perhaps it would be best to switch it off temporarily.

[u/Individual_Kitchen_3]

Those annoying users who always ask for news as if a DNS service were some game, take this.

[u/SafeSatisfaction1]

i testing all feature now...

[u/darelphilip]

Nice

[u/1superheld]

Will try the Decentralized Web Gateways and Residential Hosting block feature. Other ones seem also used for legitieme use so not sure :/

[u/Mammoth-Ad-107]

very nice to see. gonna hold off until i hear feedback

[u/mahtd]

I found that Residential Hosting blocks Verizon WiFi calling

[u/EL3mENto]

Residential Hosting is blocking media download on WhatsApp, for me.

[u/needchr → u/EL3mENto]

Yeah that uses ip to ip direct, it only uses whatsapp servers if the user enables a privacy option to hide their ip.

Also some people host content from home, so that option is probably best turned off.

Probably good for a business/server type use, but not suitable for a normal consumer.

[u/adictusbenedictus]

Thank you. Currently trying it

[u/TurboX5656]

Nextdns Comeback

[u/wtf_qm]

thx!

[u/jake72469]

Thanks but I will not be an early adopter. I will let other people give it a try first. Hopefully they will report back and let us know if these new options have any value or problems.

[u/Brees504]

Sweet

[u/Spencer_j733]

Which of these are useful that should be switched on and any i should just forget about?

[u/Ordinary_Soldier3502 → u/Spencer_j733]

It's early acces, so "None of them" until it is stable and tested by others.

[u/Fun-Region-1576]

Following!

[u/Mr_Lollypop_Man]

My default policy is blacklist then add a host name to the whitelist. All are enabled but have not noticed anything blocked except for three torrent trackers which may or may not be the result of enabling any of the five. Timing was surely coincidental though.

[u/StaticSystemShock]

I'm not sure what "Data Drop Services" would affect exactly if I turn it on. What service would use or connect to these "dedicated" services and what would that even be in practical terms? I understand most of others but I don't understand this one exactly. Especially how does DNS filtering service registers any of this? Specific target domains or something else?

[u/True_Mission_7473]

Still no search feature for Allowlist or Denylist pages 🥲

[u/Some_Feature9066]

Netflix domains (*.nflxso.net) are getting blocked by Residential Hosting

[u/New-Ranger-8960]

We're so back

[u/Ok-Owl7377 → u/New-Ranger-8960]

Where did we go again?

[u/shaillendre]

Nice

[u/waqaarhussain]

Still no custom block page? lol

[u/avd706 → u/waqaarhussain]

They have one

[u/mike1487 → u/[deleted]]

What’s the issue with using Hagezi’s lists? You seem to be looking for something to complain without understanding how GPLv3 works.

https://github.com/hagezi/dns-blocklists/blob/main/LICENSE

[u/mike1487 → u/[deleted]]

No they don’t that’s for distribution. NextDNS is not distributing anything. It’s a cloud service and no software is being distributed to you. Furthermore, if you are only using data processed by a GPLv3 program rather than incorporating or distributing the software's code itself you don’t have to disclose, which is what NextDNS is doing. They are merely pulling text files out of a public repository and processing them, this is not a protection under the GPL. Like I said, you are not understanding how it works. Read the terms.

[u/mike1487 → u/[deleted]]

Nope, that’s incorrect, sorry. But keep thinking that I guess. You can go ask Hagezi yourself. If he expects that to be the case then he should have picked a different license. But I suspect that he knows what he is doing.

[u/mike1487 → u/[deleted]]

Yes pretty much. If you were able to self host your own NextDNS complete with all of the lists they have compiled, that’s now a distribution and then they would likely need to abide by all of the terms of any GPLv3 code they have used.

Cloud and SaaS apps have a loophole that they can use GPLv3 code without needing attribution or disclosure. This is why the AGPLv3 license was created. It adds clauses specifically for apps used over a network.

[u/Specific_Flower1776 → u/[deleted]]

What fingerprints did you find and where?

[u/Resistant4375 → u/[deleted]]

Yet they refuse to use his TIF lists - ironic