NextDNS Is Out of Beta

https://nextdns.io

by jrnkntl • 6 years ago

334 153 6 years ago

nextdns.io

pvg• 6 years ago

A year to the day: https://news.ycombinator.com/item?id=20012687

Making this a perfect snee-less dupe!

firloop• 6 years ago

Signed up for a year as soon as I got the email announcement. Love NextDNS and excited to see where they go — particularly would love some sort of time-based scheduling or API for rule automations.

greatjack613• 6 years ago

Really happy to hear this. I have loved next dns since its start, not only for their product, but also due to the fact is is a clean sustainable business. No need for ads, a generous free tier, and a cheap full featured paid tiered. This is the way I would like to see most SaaS's go

elliekelly• 6 years ago

And they give users incredible control over their data/privacy. Their privacy policy is fantastic[1].

On my dashboard I can:

- Enable/disable logs and decide whether logs include client IP address and domains

- Clear logs and set log retention period (as short as 1 hour and as long as 2 years)

- Select the country of the servers that store my logs to the US, EU, or Switzerland

I really hope to see more tech companies follow their lead.

[1] https://nextdns.io/privacy

PascLeRasc• 6 years ago

"Try it now. No sign up required"

I love that phrase. This looks like a fantastic service!

lucasverra• 6 years ago

It is, been using it since multiple months. I have no more ads on my iphone now, for free. The dns request pass throught Switzerland and i feel i have 007 level privacy. sweet !!

ac295• 6 years ago

DNS level blockers arent really for privacy - your ISP can still see all of the connections your device is making. It can however greatly reduce connections to known tracking domains.

netcyrax• 6 years ago

But missing the point. If I am worried about privacy from cloud players, why to trust another cloud player?

I would setup my own Pi-Hole if I wanted true privacy.

Missing something?

halfmatthalfcat• 6 years ago

How do you block unwanted DNS requests outside of the Pi-Hole’s radius (e.g. Home Network)? If I’m on mobile, NextDNS let’s you disable on user specified WiFi networks and then re-enables when you leave range.

NextDNS can also be used as a fallback if your Pi goes down for whatever reason too. Might as well have options in this space.

bauerd• 6 years ago

Dynamic DNS and a redundant Pi-Hole setup

moreorless• 6 years ago

VPNs are generally pretty easy to setup these days. If redundancy is needed, can always run it on a cheap VPS provider.

buildbot2• 6 years ago

You aren’t missing anything, your setup would be more private.

There is a valid niche between no privacy and completely self hosted dns-over https, that a service like nextdns solves well. Just as Apple solves a by default more secure yet still not without flaws phone, or how using a vpn provider is a midpoint between a self hosted vpn and no vpn. I think the privacy trade off here is good for many.

noodlesUK• 6 years ago

Whilst I completely agree with your comment, I have a nit to pick about the self hosted VPN part. What commercial VPN providers sell is plausible deniability through multiple users having access to the same set of endpoints. A self hosted VPN does not provide that. If I have a server somewhere and route my traffic through it, that server doing something can easily be tied to me doing something. Hence why you probably shouldn’t self host a VPN. Now, if you’re only afraid of your ISP or neighbours snooping, then a self hosted VPN makes sense. If you’re afraid of advertisers or the MPAA, then a commercial VPN makes sense.

chickenpotpie• 6 years ago

Am I alone in the feeling that a lot of privacy related solutions are just paying for a promise? For example, a VPN can record all my requests, they just promise not to and I can’t verify it.

dewey3• 6 years ago

You are not, at some point you'll just have to trust someone. Just like that the app you submitted to the App Store is the same one you are downloading and hasn't been tampered with.

As always it's a matter of tradeoffs, if you just don't want to get tracked by ads it's probably a good solution. If you are afraid of some nation state trying to track you down, then probably not.

bad_user3• 6 years ago

I'm more worried for my local ISP selling my browsing history, or exposing it due to incompetence, because something like that already happened and nowadays I'm worried they send that data to local authorities too.

The "cloud players" you're worried of are big targets and the law protects me, since we have the GDPR and the EU is trigger happy in giving fines to big companies. Also my data is not that useful right now to a US company.

Also the ad blockers for iOS Safari don't work well and I use iOS Firefox anyway, which can't use Safari's content blockers. So I'll take any help in blocking ads I can get.

This will also be valuable for doing some content filtering for my son, without installing anti-virus crap on his devices.

It really depends on your threat model.

ac295• 6 years ago

Does GDPR and other EU laws not protect you from your ISP also? I'm not sure how your home ISP is less trustworthy than your VPNs ISP if they're both in the EU (and if you arent, GDPR doesnt apply to you).

rsync2• 6 years ago

"But missing the point. If I am worried about privacy from cloud players, why to trust another cloud player?"

The workflow I am (not quite finished) setting up is as follows - I run a caching, recursive nameserver (unbound) in my own colo space. That DNS server, not me or my devices, is the nextDNS client.

Then I set all of my own networks and devices to use my (unbound) DNS server.

My goal is to receive all of the benefits of a paid nextdns account, but on the nextdns side, all they see is a single, fixed IP, in a fixed location, owned by a corporate entity, doing a bunch of DNS queries.

In fact, I am a bit worried about this exact setup because although I am using this for my own, personal use, consistent with their expectations, I could just as easily be a full-blown ISP passing through my nameservice to nextDNS ... how do they deal with that ?

Do they care ?

BenjiWiebe• 6 years ago

Totally guessing here. If they saw one IP making ISP-rate queries they could contact you and negotiate a different price. Even with caching you are very likely going to see much higher query rates occasionally when a whole network of people are using it.

thanksforfish5• 6 years ago

You personally make a many DNS queries as a full-blown ISP? The fact that your server does it's own caching may keep your query rate lower than others.

I'm sure they can refuse service to customers in certain cases.

ianmcgowan3• 6 years ago

They're pretty upfront about this in the excellent documentation: https://help.nextdns.io/en/articles/3941241-what-is-the-adva...

""" To be fair, there are also some advantages of using Pi-hole® over NextDNS:

1) You know who runs it. We can’t ask you to trust us more than yourself. We can provide all the guarantees you want, show who we are and make promises, it is understandably easier to trust a solution you manage yourself. Keep in mind though, that all your unblocked DNS queries are still visible by your upstream DNS. So there is still someone you need to trust with your data.

2) It’s free with no limits. NextDNS is cheap, very cheap, but it’s still a paid service if you use it over a certain limit. Pi-hole® is free to use. You still have to pay about $35 for a Raspberry Pi + an SD card, which is equivalent to several years of NextDNS subscription. You should also consider donating to the Pi-hole® project if you use their solution. After a few years though, yes, Pi-hole® should become less expensive than NextDNS. """

tialaramex• 6 years ago

We can’t ask you to trust us more than yourself

They can't, but it might make sense to do so anyway.

I always explain this when it comes to running your own private CA as well. In principle you might do a better job than anybody else, and certainly if you fall down you'd know exactly who to blame. But you also might do a pretty shoddy job and cut corners you know you shouldn't, and knowing whose fault it is will be cold comfort if things do go wrong.

People who do this for a living can never be as trustworthy as you could be, but they might very well be more trustworthy than you are in practice and it's worth a moment's honest introspection to consider that.

cj• 6 years ago

70% of HN readers probably don't have the technical knowledge (or hardware on hand) to set up pi-hole without investing 10+ hours.

For those of us with a raspberry pi or intel nuc on hand, sure, it only takes 30 minutes.

This service is for people who want to kill ads at the DNS level without dealing with the hardware / setup of pihole.

Also, not many people are going to bother setting up a VPN to access their pihole DNS when traveling or on cellular, which makes NextDNS attractive.

The other argument is "just use ublock matrix". The counter-argument is it doesn't block native app ads / tracking. (One of the #1 blocked domains on my pihole is from Dashlane's MacOS app, constantly wanting to phone home)

ac295• 6 years ago

70% of HN readers probably don't have the technical knowledge (or hardware on hand) to set up pi-hole without investing 10+ hours.

That seems pretty dismissive of our audience. I cant think of many things easier to set up than pi-hole, unless even using SSH is too difficult to understand.

1) Buy a rasp-pi (or pretty much any other device support a reasonably standard Linux distribution)

2) Copy one of many Linux distributions to an SD card with something like etcher: a couple clicks. Or buy one of the many pre-made kits with Linux already on the card.

3) Run a single line linux command via SSH and follow prompts.

FlagsAreFun• 6 years ago

70% of many audiences, even of tech news sites? Sure. But of Hacker News' audience? I would expect many here could follow the basic setup tutorial relatively easily.

bad_user3• 6 years ago

This is cool.

NextDNS appears to implement DNS over HTTPs (DoH) and Firefox ships with it as an option, next to Cloudflare.

UPDATE — Took it for a test drive:

* Logs are concerning, but look good for optimizing the traffic and notice odd communications; I already noticed telemetry sent by my browser that I switched off

* Ad blocking seems to work, not as good as desktop uBlock Origin, but I'll take anything for my iPhone

* Latency is around 30 - 100 msec, which seems a bit high? (server I connect to seems to be 400 km away)

cpeterso• 6 years ago

I already noticed telemetry sent by my browser that I switched off

Mozilla is running some Firefox experiments with different DoH providers. Eventually Firefox may automatically select whichever DoH provider is the fastest for each user. This would improve performance for users and reduce the privacy concerns about DoH consolidation with one provider (the current Firefox default Cloudflare).

buildbot2• 6 years ago

I trialed nextDNS based on other people talking about it here, and have really liked it - it’s really awesome to have an always on, dns-over-https solution for every device. I think it’s really worth the 20$ per year, just for the slick ui and not having to manage a pihole somewhere.

40four3• 6 years ago

I was not aware of this service before, but I’m very interested! The price seems very reasonable, and as you say, not managing a pi-hole device is very appealing. I have tried multiple times to setup pi-hole on a dev board on my home network, and could never get it to work properly so I gave up.

leesalminen• 6 years ago

As a counter-example, I was amazed at how simple it was to set up Pi-Hole. I thought they had the setup workflow built pretty well. Took me ~10 minutes including flashing a SD card with Raspbian.

Gimpei• 6 years ago

I've been using NextDNS and really enjoy it. I've found it a lot easier to manage than pihole. Only issue I have is that it doesn't seem to work with the Economist.

bretthopper2• 6 years ago

I really wanted to like and use NextDNS but my latency was ~200ms vs maybe 10-40ms for my ISP resolver. I'm fine with paying a bit of a latency price for the extra features and privacy, but not that much. And I'm located in Toronto, not somewhere remote.

nextdns5• 6 years ago

Looks like a case of bad anycast routing, as we have a PoP in Toronto! It happens and is usually easily fixable, can you talk to us via the chat on our website (or at support@nextdns.io)?

A map of our network for anyone interested:

https://i.imgur.com/2uenEAZ.png

bretthopper2• 6 years ago

I figured I'd activate it again and test it first... and of course it's way better now! Consistently getting around 40ms now so I'll keep it enabled and try again :)

dewey3• 6 years ago

What's the difference between using the macOS app or just setting the DNS on a router level? Just the attribution to a specific device in the dashboard? I couldn't figure that out by reading the (actually very well written) FAQ.

nextdns5• 6 years ago

- Encrypted DNS (DNS-over-HTTPS)

- Ideal routing (low DNS latency)

- Bypass DNS-level censorship (inside a country, from your hotel Internet provider, your school, etc.)

- Being able to identify your device in the logs (if you choose to)

- Hardened Privacy Mode (if you are into that)

Edit: this goes for all our apps (iOS/Android/macOS/Windows/Router client), not just macOS.

dewey3• 6 years ago

That’s very helpful, thanks!

ianmcgowan3• 6 years ago

I literally (not figuratively) setup NextDNS yesterday and so far it's been great. The documentation is awesome, and love the features available. The only mild feedback I have is that the "Setup Guide" doesn't provide enough context about what's going on, and the implications of setting up on my PC vs mobile device vs router. It says:

"Follow the instructions below to set up NextDNS on your device, browser or router."

A couple more sentences there would be super helpful..

ryan-allen• 6 years ago

The Windows setup doesn't like Windows 10 on ARM, it couldn't install the TAL driver. Very edge case I guess, I'm going to install on x86 when I get home :)

drcongo2• 6 years ago

The macOS app stopped working for me a while back, but there's also a homebrew package for command line control which works flawlessly.

admax88q2• 6 years ago

What I don't get about DNS, is why doesnt every device just run its own recursive caching resolver. Why ask ISPs and hotspot providers to resolve your requests?

What would be the downside outisde of corporate networks?

thanksforfish5• 6 years ago

A cache shared by a couple thousand people would have lots of stuff already cached. Running your own would be add latency as you'd need to fully resolve more domains.

admax88q2• 6 years ago

Only on initial use. Most DNS records have a cache time of 24 hours, so if you're using the internet every day, you're unlikely to notice.

Some latency when visiting a new site seems like a small price to pay for side-stepping all the shenanigans that ISPs have been doing to DNS, without having to defer trust to yet another cloud provider.

m-p-3• 6 years ago

I'm a fan of their service, and because most browsers support DNS-over-HTTPS natively I can put the configuration right into my browser settings and have the same level of DNS filtering even when I'm outside of my home network without VPN.

nextdns5• 6 years ago

Google Chrome (and some Chromium forks) will also be supporting custom DNS-over-HTTPS providers very soon (it's already being rolled out to some users).

Already__Taken• 6 years ago

It's in my chrome://flags/#dns-over-https currently 81.0.4044.138 (Official Build) (64-bit)

k__4• 6 years ago

I like it, but it's sad that I have to run an extra VPN app on my Android because Xiaomi doesn't allow me to configure private DNS.

nextdns5• 6 years ago

It's a "fake" VPN, it only captures the DNS traffic (that's just the cleanest/most efficient way to do it).

k__4• 6 years ago

Yes, I thought so.

Still sad.

On my desktop systems I can configure it in the network options and never think about it again. On Android I always close it if I don't think about it when closing all apps, then I forget to restart it.

microbass• 6 years ago

Using this app, you can access DNS settings which are typically hidden in MIUI

https://play.google.com/store/apps/details?id=com.ceyhan.set...

k__4• 6 years ago

Yes, I know about these apps, they don't work.

The network stuff is not accessible.

0x49d1• 6 years ago

They do have custom DNS provider setting, but it's a bit hidden (also it's different among various MIUI versions). So to find it better try old QuickShortcuts: https://play.google.com/store/apps/details?id=com.sika524.an... and see the Settings->Network Dashboard (or something similar).

k__4• 6 years ago

I tried multiple of these apps, and nothing worked.

foob4r2• 6 years ago

That's awesome and I've tried nextdns and loved it. But - and this is just me - I just don't trust anyone to delete my logs or not log in the first place.

That's why I'll probably not move off of my pihole

altano• 6 years ago

You have to trust someone because at some point the DNS request is getting made. It sounds like you're just choosing to trust your ISP.

tubbs• 6 years ago

Is anyone aware of a VPN out there that supports PiHole-like list filtering, so you could get the best of both worlds?

Right now it feels like I have to choose:

- Use my PiHole to block all sorts of content on filtering lists that are useful in cases like blocking unwanted tracking in mobile apps, but my ISP knows everything I access

- Use a VPN, where my ISP doesn't know what I'm doing, but every web service I use can use whatever tracking it wants (except where uBlock is used and such, but you don't get that luxury with, say, Samsung Smart TVs which are notorious for phoning home)

julyhaze• 6 years ago

The ISPs are going to log everything for sure. However I’d probably trust their incapability of putting data into <s>good/evil</s> use, comparing to professionals like google.

badrabbit2• 6 years ago

No you don't. If you use DoH or Dnscrypt over a VPN, the DNS provider can't associate the traffic with your IP (mitigating control of sorts).

foob4r2• 6 years ago

No my upstream is Cloudflare. Weirdly, I trust them.

brokenmachine3• 6 years ago

Do you trust your ISP? Because they are probably logging.

nix232• 6 years ago

I trust my ISP (Swiss) much more, than any privately owned VPN-Company outside Switzerland or Iceland.

loughnane2• 6 years ago

I'm in the same boat with a pihole as my primary blocker, but I use NextDNS as an upstream resolver since they, of all the options, seem most likely to not log (presuming I configure it apprpriately)

elktea• 6 years ago

I had it on my phone for a while, sadly it breaks URLs in the twitter app because it was blocking the analytics redirect. Nice service otherwise

7ewis3• 6 years ago

You can choose what blocklists you use and whitelist individual domains, so you can make it not block the t.co links.

agotterer• 6 years ago

I believe you can whitelist certain domains. That might be a solution if that was the only thing which wasn’t working for your needs.

nicolas_3• 6 years ago

I've been using NextDNS for the past few months and it's a fantastic product!

I don't need Blockada on my phone anymore and I can block whatever I want at the router level instead of doing it on each devices.

Keep up the good work!

ck2• 6 years ago

recently discovered this opensource hosts solution for android

https://github.com/AdAway/AdAway

almost everything obeys hosts on android, works great on lineageos

nicolas_3• 6 years ago

You can add AdAway to your blocklist in NextDNS super easily https://imgur.com/a/VVKM8TF

7ewis3• 6 years ago

Saw this when it first came out, never tried it until now.

Used it for around an hour and I've already made 2,000 requests and 15% of those were blocked. Can definitely see myself going over 300,000 requests (free monthly allowance) but it's looking great so far so would be happy to support it.

Currently use AdGuard on my phone, looks like this does almost everything AdGuard does (stats, logs, blocklists) with the added benefit of the processing being done elsewhere.

1f60c• 6 years ago

I’ve just set it up, and so far I quite like it.

jart• 6 years ago

Consider reading IETF docs for how things like DNSSEC were intended to be used.

arminiusreturns• 6 years ago

Care to expand on what you are talking about? I've been very curious for a few years about CurveDNS and less so dnssec, but I admit I haven't read the ietfs yet.

Urgo• 6 years ago

Since pretty much all the reviews here are glowing I'll offer up an alternative.

If you want what they are selling, then it does work quite well.. but there are drawbacks.. one primarily.. that made me end up not using it for my whole network and only on my ipad when I don't want ads in a game.

As mentioned in other comments, you can whitelist domains, but unlike the whitelist in ublock or something in your browser, this means you need to know the exact ad server domain/domains. For example if I want ads on for certain websites to help support or troubleshoot my own site then I'm unable to do that or if the wife needs to see an ad in her game to get gems, you have to dig through the logs to find out what ad server its calling.. or set up another profile to not block any ads.

In short, you're not whitelisting the domain you're visiting, you need to whitelist every domain that website might call too. Perhaps most people are okay with then and if so then ignore :)

Another thing I didn't like, which I mean makes sense, but in order to label a device you need to run their client. I had set up nextdns on my router which worked great, but if I wanted different devices to have different rulesets they each needed to run the nextdns client. So good luck knowing which smart device is calling what because you're not going to be installing the client on your Alexa. One other downside of this which honestly I probably could have fixed was their client broke WSL network connections so on my primary device I ended up operating in logged out mode.

That said, I might end up giving it another shot at some point but running on a very limited set of rules rather then the pretty comprehensive rulesets I had enabled. I did like how it blocked the device telemetry calls.. perhaps that is all I need to block and then handle everything else client side.

Hope this helps someone!

jmathai• 6 years ago

Currently using OpenDNS Family Shield and giving NextDNS a try.

Re labeling devices: I set up descriptive hostnames and static LAN IPs on my router for all my devices (including smart ones). The NextDNS interface reports traffic using those hostnames without me having to run clients on any of my devices.

I'm curious how the ad blocking will work. I was running adblock on my router but had to disable it because a few legitimate sites were being blocked (i.e. school sites my kids needed access to). I'm hoping NextDNS provides easier to use controls and UI that would let me keep ad blocking enabled.

ianmcgowan3• 6 years ago

Did you install the clients or do anything in the setup to get that? I can see client hostnames where the client software is installed, but just my external IP for all others. It doesn't seem possible with just IPv4/Router config. Are you using IPv6 or DoH?

nullify88• 6 years ago

Another thing I didn't like, which I mean makes sense, but in order to label a device you need to run their client.

I hope I understood you correctly. A feature recently introduced (Or perhaps I just recently noticed) is the ability to label devices without using their clients, you can do this by prefixing your unique DNS endpoint with the label and terminating it with a hyphen.

Eg, Phone-xxxxx.dns.nextdns.io

ycombonator• 6 years ago

For me Pihole on hosted vps has less latency than NextDNS

pwdisswordfish24• 6 years ago

"Privacy Policy

1. We do not (and will never) sell, license, sub-license or share any of the data submitted directly or indirectly by our users with any person or entity."

This does not cover metadata. For example, NextDNS analyzes the data submitted directly or indirectly by the user and makes a note, "This user [something private]"

If NextDNS sells, licenses, sublicenses or shares that metadata they are not violating this Privacy Policy.

If NextDNS acquires data from a third party (e.g., data brokers) that identifies NextDNS users, then that is not "data submitted directly or indirectly by our users" and they are not violating this Privacy Policy if, e.g., they pair that data with NextDNS metadata and store, sell, license/sublicense or share it.

This Privacy Policy also does not cover the event of NextDNS itself or a successor selling ads or ad services. If that ever happens, it would not violate this Privacy Policy.

godzillabrennus• 6 years ago

It’s a free service. If it’s free you are probably the product.

You can still put Pi Hole on a device in your home and use that. I do. It’s amazing.

35% or more of monthly requests are blocked.

pwdisswordfish24• 6 years ago

Or... You can put your own DNS server on a device in your home and use that.

Personally I am not fond of dnsmasq or the patched version Pi-Hole uses.

100% of "monthly requests" are blocked. There are no third-party managed blacklists, only personally created whitelists. Individual DNS queries rarely leave the network. DNS data is gathered in bulk and stored.

ray991• 6 years ago

So NextDNS is free to sell metadata. What is the extent of this metadata - is it like ‘this user spends 10 hours a day actively using the internet’, or ‘this user consumes a lot of streaming video content’, or this user ‘watches netflix every friday evening’, or ‘this user uses duckduckgo instead of google’? Can these examples be considered metadata?

pwdisswordfish24• 6 years ago

They do not need to sell metadata. They can sell services. Neither Google nor Facebook need to sell data. They sell services.

Those companies are not obligated to disclose what metadata they might have. Neither is NextDNS.

If the Privacy Policy stated that NextDNS will not create, collect or acquire metadata about its users, then we would have less reason to be concerned.

However the NextDNS Privacy Policy is all of nine sentences. It is not very restrictive.

Brajeshwar3• 6 years ago

NextDNS is nice and easy to use for us, a family -- non-technical spouse, two kids with access to devices for schools, 'games & stuff'. I ran Pi-Hole on a Raspberry Pi 3 for about a year and it is one of the best ever there. I wanted something simple and something I can just clicky-click.

Been testing NextDNS for quite a while and I like it. Will continue as long as it serves what I'm looking for.

On a different note, unlike most of us, my wife and kids are worried that they can no longer see those 'interesting and useful' ads. They go on to those ads, spend long minutes browsing from one to the other, propelled by ads. My kids discovers 'these amazing games' via the ads. It is a different world out there.

jan_g• 6 years ago

It is a different world out there.

I've noticed the same thing! Wife and kids actually do tap on (some) ads and discover new games, merchandise, etc. that way. They are also easily tricked into reading or watching stuff by this or that 'influencer', which is mostly just advertising under disguise. Maybe tricked is too strong of a word here, because they seem to enjoy it ... it just seems to be part of the way they interact with online world.

DavideNL• 6 years ago

As long as people are aware that their habits are being tracked and such it's a choice everyone can make for themselves.

(especially kids) not being aware of 1) clicks/behavior being tracked and 2) perhaps being manipulated by exploiting this knowledge about their behavior sounds bad to me...

Octopuz2• 6 years ago

That's why I switched to Adguard Home: https://adguard.com/en/adguard-home/overview.html You can make custom configurations per device, OS or a different label you give them. So you can have your wife see their ads while still blocking your smart TV from calling home.

tilolebo• 6 years ago

How does it differ from the NextDNS configuration profiles?

yumraj2• 6 years ago

Difference from pi-hole? Genuinely curious since I'm currently using pi-hole at home.

iforgotpassword• 6 years ago

I'll make sure to raise my kids on adblockers so they can never develop that habit.

troquerre2• 6 years ago

One cool thing about NextDNS is that they also support the Handshake DNS protocol. It’s an alternative root DNS that supports new TLDs while maintaining compatibility with existing ICANN TLDs https://handshake.org

alin23• 6 years ago

I got pretty excited when I saw that and tried to find some use cases for it as soon as I enabled NextDNS. But I couldn't find any use case where it would make domain management easier. In fact it seemed overly complicated with it being auction based and having to use a cryptocurrency.

Have you found Handshake useful in any way?

troquerre2• 6 years ago

Right now most of the sites are personal projects and toy sites. You can check out some of them here https://github.com/NamebaseHQ/Awesome-Handshake. For my personal use, I set up tieshun.txt to point to my personal todo.txt file, and I use watchman to rsync my local todo.txt to tieshun.txt so I can access it from all my devices. I could also set up todo.tieshunroquerre.com for this but I find that tieshun.txt is much more convenient to use.

I bought tieshun.txt on https://gateway.io (in beta). The owner of .txt set up their own registry and they're selling .txt domains. That's another aspect of Handshake that I'm excited about. To get an ICANN TLD you need to be a big corporation that can pay for the $200k application fee (and you're not even guaranteed to get the name), whereas anyone can create a registry on their own TLD with Handshake.

The cryptocurrency aspect is unintuitive (if possible it would've been ideal to not require it), but it's actually needed in order to have a more secure root of trust alternative to CAs. This article expands on this point: https://www.namebase.io/blog/meet-handshake-decentralizing-d...

slenk4• 6 years ago

Just a perspective - 300k DNS queries is not very much. 1 full day of home use + work (most DNS goes over VPN for that) and I am at 130k queries. So you'll get a nice little trial, but don't expect it to last very long, imo

porker3• 6 years ago

This. I guess if your router can install their software, and it maintains a local DNS cache, then it'll go further. But without that, it's repeatedly hitting their servers for the same entry, racking up queries.

ignoramous• 6 years ago

...and it maintains a local DNS cache, then it'll go further. But without that...

Nextdns has a cache boost option now which sets TTLs to a minimum of 5mins. If the client is complaint (respects the TTLs), then that should help further.

ikornaselur• 6 years ago

I'm genuinely surprised you've made 130k dns queries in one day.

I've been using NextDNS now for half a year or so and I have 1,021,075 queries in the last 90 days, or roughly ~11k a day. I have ~69k in the past 7 days.

I have this set up on all my devices.

Are you running a home server or something that could explain so many requests?

porker3• 6 years ago

I have something on my network that has contacted pool.ntp.org 37k times in 5 days. That's a fifth of all my DNS requests.

Haven't managed to track it down.

slenk4• 6 years ago

I have ~50 docker containers running with various stuff I am working on. I am sure that contributes quite a bit.

2 Windows 10 machines make a LOT of phone-home queries.

StavrosK• 6 years ago

I have the same experience. I like them but will stop using them because I apparently do 900k queries a month, for some odd reason...

JoshuaRLi• 6 years ago

On my work laptop (macOS Catalina), I get a bunch of `in-addr.arpa` - seems to be reverse lookups. Is that the case for you, too?

Brajeshwar3• 6 years ago

Request to NextDNS, if you are listening, can we have servers in the Southern Part of India too? Thanks.

tipoftheiceberg• 6 years ago

Am I “grandfathered in” if I was using NextDns during beta?

freeAgent• 6 years ago

No, they’ll email you if you go over the free limit.

sa1• 6 years ago

I got a warning that I was approaching the limit of free queries, so it appears that the answer is no.

gigatexal• 6 years ago

I don’t want “in depth analytics” from anything really especially a DNS provider. How about a truly non-logging, ad-blocking, DNS provider that does DNSSec?

OkGoDoIt• 6 years ago

They actually have the ability to turn off all logging and analysis, pretty easy and front-and-center, not buried deep in a hidden settings page like some companies. Or you can limit it to a timeframe that makes sense for you. I have mine set to delete everything after one hour. That way if I ever have issues I can pretty easily debug the problem by going to my account details within the hour.

29athrowaway• 6 years ago

DNS is not an encrypted protocol.

The people routing your DNS traffic can inspect it and even tamper it (e.g.: your ISP) even if you pick DNS servers other than the ones provided by your ISP. Your privacy is not guaranteed.

DNS over HTTPS/DNS over TLS is encrypted and may offer better privacy, if you trust them, that is.

porker3• 6 years ago

If you're in the UK and your family like watching Channel 4's 4oD, I had to whitelist *.fwmrm.net for it to play.

Otherwise 4oD think you have an ad blocker enabled and the video refuses to start.

algorithm314• 6 years ago

Hello an other alternative is https://libreops.cc/radicaldns.html . They also offer DNS over https and TLS https://libredns.gr/

3ln00b• 6 years ago

I hope they introduce MFA for the web config console

leokennis• 6 years ago

Love this service. Gladly paying a subscription now. It’s like a pihole without having to worry about keeping it running, updated etc. So ideal for not-super-techy people like me.

One feature request if the team is reading along a pause button to disable blocking for 1/5/15/60 minutes.

drcongo2• 6 years ago

I absolutely love NextDNS and I don't think I've ever been so pleased for a product to start charging me.

AnonC• 6 years ago

Where is the pricing information? I couldn't find it on the homepage or in the help page (even searching there doesn't help). Even the article on 300K free queries a month [1] doesn't have anything related to pricing.

Where is the announcement that it's out of beta? I don't see that in the homepage either. What am I missing?

[1] https://help.nextdns.io/en/articles/3962038-what-happens-aft...

jhvkjhk• 6 years ago

Pricing information is at https://nextdns.io/pricing, there's a link to this on the homepage.

I didn't found their releasing news too, maybe their announcement is just deleting “free during the beta” on the pricing page?

0xbkt• 6 years ago

How is this actually different from using Cloudflare DNS (1.1.1.1)?

For ads, I already use AdGuard.

kuon• 6 years ago

If you are wondering (as I did) how they can know what is your DNS resolver, they simply makes the webpage load some JS from a random host, like "https://853af2kklyt-dda385.test.nextdns.io/". Of course, as this host cannot be cached anywhere, their DNS are hit by your DNS resolver, thus they can know the IP of your DNS resolver. In my case as I have a DNS server at home, it displayed the name of the AS of my provider.

NicoJuicy• 6 years ago

I can think of an entire niche that could grow nextdns into the public domain.

It only needs one feature :)

Is anyone of nextdns reading this? Possibility to contact?

coldcode• 6 years ago

If we all use enough of things like NextDNS then all ads will go away. Oh wait, suddenly all websites except those with a paywall will exist. No more news reports of any kind. No more free services. Nothing but a few sites that sell T-shirts to struggle to survive. I don't like the present web either, but somehow people have to make money. Unless we build in an infrastructure that easily allows me to pay you to run a business online, I fail to see how in the long run this total blockage of ads is a benefit for all.

Of course we live in HackerNewsLand, where the rest of technologically illiterate humanity pays by watching ads so that we don't have to.

Somehow we have to use technology to find a way to balance the needs of those who are online serving us content/information/etc with a less irritating and horrific way to pay for it. Without a solution for that, the future is going to be a lot less diverse and a lot more frustrating, although in a different way.

tosers4• 6 years ago

I don't thing most people are against ads. What's the issue with a simple .png add in a banner or at the side as long as it's not screaming at you? or the occasional sponsored content. There are 2 big issues that people hate about ads:

- Obnoxious ads that take away from you browsing experience

- Tracking, spying, privacy, monopolies from ad tech and all that stuff.

And those even combine, as all the tracking makes sites slower.

Hacker news works on the sponsored content way. (but it's just one sponoer which it's also its owner) The site is kept low cost as possible, and YC uses it to promote its startups One YC posts on the front page, don't really bother us too much, as long as they don't become obnoxious.

0-O-0• 6 years ago

If this happens we might get healthier Internet where every service is either a) actually free b) croudfunded on services like SubscribeStar c) has paid tiers d) uses first party ads from sponsors. There are plenty of services monetised like this already.

Third party ad networks are an anomaly and it's time for them to go.

NextDNS Is Out of Beta

Related Stories