05 Jul 2026 · 5 min read

NextDNS: A Modern DNS Firewall for Your Whole Network

I’ve been using <a rel="noopener nofollow noreferrer external" target="_blank" href="https://nextdns.io/?from=83bgqgfw">NextDNS</a> for over a year now and it’s one of those services that once you set up, you wonder how you lived without it. It’s a cloud-based DNS resolver with built-in filtering, analytics, and parental controls — think Pi-hole as a hosted service, but with global anycast routing and way more features. <h2 id="what-s-wrong-with-plain-dns"><a class="zola-anchor" href="#what-s-wrong-with-plain-dns" aria-label="Anchor link for: what-s-wrong-with-plain-dns">🔗</a> What’s Wrong with Plain DNS?</h2> Traditional DNS (port 53, UDP) sends your queries in plaintext. Anyone on your network, your ISP, or anyone snooping on the wire can see every domain you visit. It’s also trivially easy for ISPs or governments to hijack DNS responses and redirect you to phishing pages or censorship pages. DNS over HTTPS (DoH) and DNS over TLS (DoT) fix this by encrypting your DNS queries. Instead of plain UDP packets, your queries travel inside an encrypted TLS tunnel (DoT) or are wrapped in HTTPS requests (DoH). This gives you: <ul> <li>Privacy — your ISP can’t see what domains you’re resolving</li> <li>Integrity — nobody can tamper with DNS responses in transit</li> <li>Authentication — you verify you’re talking to the real DNS server</li> </ul> <h2 id="why-nextdns"><a class="zola-anchor" href="#why-nextdns" aria-label="Anchor link for: why-nextdns">🔗</a> Why NextDNS?</h2> There are other encrypted DNS providers (Cloudflare 1.1.1.1, Quad9, etc.), but NextDNS goes much further: 1. Blocking & Filtering You can block malware, tracking domains, adult content, ads, and more — all at the DNS level. It works like Pi-hole but requires no hardware, no configuration on each device, and it applies to every device on your network. It uses multiple blocklists (OISD, Energized, etc.) out of the box. 2. Analytics The dashboard shows you exactly which domains are being queried, how many were blocked, which devices made the requests, and a timeline of activity. It’s incredibly useful for spotting rogue IoT phones home or checking if a block is too aggressive. 3. Allow/Deny Lists You can whitelist domains that get falsely blocked and blacklist entire domains or TLDs. Changes propagate in seconds. 4. Parental Controls Built-in categories for restricting adult content, social media, gaming, etc. You can also schedule when certain categories are blocked (e.g., block social media during school hours). 5. Response Policy Zones (RPZ) RPZ is a powerful DNS-level policy mechanism that lets you redirect, block, or log queries based on domain patterns. NextDNS supports it natively, giving you advanced control far beyond simple blocklists — you can, for example, redirect queries for known malware domains to a local sinkhole, override DNS responses for specific domains across your entire network, or quarantine IoT device domains. 6. Native DoH/DoT/DoQ/DNSCrypt No need to run a local proxy — every device can talk to NextDNS directly over encrypted DNS. 7. No Hardware Required It Just Works on your existing router, phone, or laptop. You don’t need a Raspberry Pi or a separate server. 8. Global Anycast NextDNS has servers all over the world. Latency is consistently lower than running a Pi-hole over a VPN or a self-hosted Unbound instance. 9. Censorship Resistance Compatible browsers enable encrypted Server Name Indication (SNI) on top of DoH to prevent leaking of DNS hostnames and thus thwarting commonly used internet censorship attempts by ISP’s and governments. They have a generous free tier (300,000 queries/month) and the paid plan is cheap — $1.99/month or $19.90/year for unlimited queries and up to 50 devices per configuration. <h2 id="setting-up-nextdns-on-openwrt-with-stubby"><a class="zola-anchor" href="#setting-up-nextdns-on-openwrt-with-stubby" aria-label="Anchor link for: setting-up-nextdns-on-openwrt-with-stubby">🔗</a> Setting Up NextDNS on OpenWrt with Stubby</h2> This is my recommended setup because it protects every device on your network — including smart TVs, IoT devices, game consoles, and guest devices that you can’t configure individually. OpenWrt has native support for <code>stubby</code>, a DNS-over-TLS stub resolver. The setup is straightforward. <h3 id="step-1-get-your-configuration-id"><a class="zola-anchor" href="#step-1-get-your-configuration-id" aria-label="Anchor link for: step-1-get-your-configuration-id">🔗</a> Step 1: Get Your Configuration ID</h3> Sign up at <a rel="noopener nofollow noreferrer external" target="_blank" href="https://nextdns.io/?from=83bgqgfw">NextDNS</a>, create a configuration, and note your Configuration ID — it looks like <code>abc123</code>. You’ll find it under the Setup tab. <h3 id="step-2-install-stubby-on-openwrt"><a class="zola-anchor" href="#step-2-install-stubby-on-openwrt" aria-label="Anchor link for: step-2-install-stubby-on-openwrt">🔗</a> Step 2: Install Stubby on OpenWrt</h3> SSH into your router and run: <pre class="giallo" style="color: #657B83; background-color: #FDF6E3;" ><code data-lang="shellscript">opkg update opkg install stubby luci-app-stubby</code></pre><h3 id="step-3-configure-stubby"><a class="zola-anchor" href="#step-3-configure-stubby" aria-label="Anchor link for: step-3-configure-stubby">🔗</a> Step 3: Configure Stubby</h3> Edit <code>/etc/stubby/stubby.yml</code>: <pre class="giallo" style="color: #657B83; background-color: #FDF6E3;" ><code data-lang="yaml">resolution_type: GETDNS_RESOLUTION_STUB dns_transport_list: - GETDNS_TRANSPORT_TLS tls_authentication: GETDNS_AUTHENTICATION_REQUIRED tls_query_padding_blocksize: 128 edns_client_subnet_private: 1 idle_timeout: 10000 listen_addresses: - 127.0.0.1@5353 - 0::1@5353 round_robin_upstreams: 1 upstream_recursive_servers: - address_data: 45.90.28.0 tls_auth_name: "abc123.dns.nextdns.io" - address_data: 2a07:a8c0::0 tls_auth_name: "abc123.dns.nextdns.io" - address_data: 45.90.30.0 tls_auth_name: "abc123.dns.nextdns.io" - address_data: 2a07:a8c1::0 tls_auth_name: "abc123.dns.nextdns.io"</code></pre> Replace <code>abc123</code> with your actual Configuration ID. The IP addresses are NextDNS’s anycast servers. Using addresses instead of hostnames avoids a chicken-and-egg problem where DNS needs DNS to resolve the DNS server. The <code>tls_auth_name</code> is what Stubby will validate against the TLS certificate, and it includes your config ID so NextDNS knows which filtering policy to apply. <h3 id="step-4-configure-dnsmasq-or-unbound"><a class="zola-anchor" href="#step-4-configure-dnsmasq-or-unbound" aria-label="Anchor link for: step-4-configure-dnsmasq-or-unbound">🔗</a> Step 4: Configure dnsmasq (or unbound)</h3> In LuCI, go to Network → DNS → Forwards, set “DNS forwardings” to <code>127.0.0.1#5353</code>. Or from the CLI, edit <code>/etc/config/dhcp</code>: <pre class="giallo" style="color: #657B83; background-color: #FDF6E3;" ><code data-lang="plain">list server '127.0.0.1#5353'</code></pre> Then restart the services: <pre class="giallo" style="color: #657B83; background-color: #FDF6E3;" ><code data-lang="shellscript">/etc/init.d/stubby restart /etc/init.d/dnsmasq restart</code></pre><h3 id="step-5-verify-it-works"><a class="zola-anchor" href="#step-5-verify-it-works" aria-label="Anchor link for: step-5-verify-it-works">🔗</a> Step 5: Verify It Works</h3> Visit <a rel="noopener nofollow noreferrer external" target="_blank" href="https://nextdns.io/?from=83bgqgfw">NextDNS’s test page</a> or check the analytics dashboard. You should see queries coming in from your home IP. <hr /> <h2 id="setting-up-nextdns-on-android"><a class="zola-anchor" href="#setting-up-nextdns-on-android" aria-label="Anchor link for: setting-up-nextdns-on-android">🔗</a> Setting Up NextDNS on Android</h2> Android has supported DNS-over-TLS (DoT) since Android 9 (Pie) and DNS-over-HTTPS (DoH) since Android 11. You don’t need any third-party app for basic encrypted DNS. <h3 id="using-private-dns-dot-android-9"><a class="zola-anchor" href="#using-private-dns-dot-android-9" aria-label="Anchor link for: using-private-dns-dot-android-9">🔗</a> Using Private DNS (DoT, Android 9+)</h3> <ol> <li>Go to Settings → Network & internet → Private DNS</li> <li>Select Private DNS provider hostname</li> <li>Enter: <code>abc123.dns.nextdns.io</code> (replace <code>abc123</code> with your config ID)</li> <li>Tap Save</li> </ol> That’s it. All DNS queries from your phone will now be encrypted with TLS and filtered by your NextDNS policy. This works on both Wi-Fi and mobile data. <h3 id="using-the-nextdns-app-doh-more-features"><a class="zola-anchor" href="#using-the-nextdns-app-doh-more-features" aria-label="Anchor link for: using-the-nextdns-app-doh-more-features">🔗</a> Using the NextDNS App (DoH, More Features)</h3> If you want DoH instead of DoT, or you want per-app filtering, logging, or the ability to pause protection, install the NextDNS app from F-Droid or the Play Store: <ol> <li>Install <a rel="noopener nofollow noreferrer external" target="_blank" href="https://nextdns.io/?from=83bgqgfw">NextDNS</a></li> <li>Open the app and sign in</li> <li>It will automatically detect your configuration</li> <li>Enable the VPN-based DNS — this creates a local VPN that intercepts DNS queries and sends them over HTTPS</li> </ol> The app approach gives you more visibility (you can see real-time queries on your phone) and works on Android versions older than 9. <h3 id="verifying-android-setup"><a class="zola-anchor" href="#verifying-android-setup" aria-label="Anchor link for: verifying-android-setup">🔗</a> Verifying Android Setup</h3> Visit <code>https://test.nextdns.io</code> in your browser. It will show whether you’re connected to NextDNS, your config ID, protocol (DoT or DoH), and latency. <hr /> <h2 id="dns-over-https-vs-dns-over-tls-which-to-use"><a class="zola-anchor" href="#dns-over-https-vs-dns-over-tls-which-to-use" aria-label="Anchor link for: dns-over-https-vs-dns-over-tls-which-to-use">🔗</a> DNS-over-HTTPS vs DNS-over-TLS: Which to Use?</h2> Both achieve the same goal — encrypted DNS. The differences are subtle: <table><thead><tr><th>Aspect</th><th>DoT</th><th>DoH</th></tr></thead><tbody> <tr><td>Port</td><td>853 (dedicated)</td><td>443 (shared with HTTPS)</td></tr> <tr><td>Protocol</td><td>TLS over TCP</td><td>HTTPS</td></tr> <tr><td>Ease to block</td><td>Easy (block port 853)</td><td>Hard (looks like normal web traffic)</td></tr> <tr><td>Performance</td><td>Slightly lower overhead</td><td>Slightly more overhead</td></tr> <tr><td>Android support</td><td>Native (Private DNS)</td><td>Via app only</td></tr> </tbody></table> On OpenWrt, I recommend Stubby (DoT) because it’s lightweight and OpenWrt has excellent support for it. On Android, the native Private DNS (DoT) is the simplest. If you’re on a restrictive network that blocks port 853, the NextDNS app with DoH will work because it tunnels through port 443. <hr /> <h2 id="billing"><a class="zola-anchor" href="#billing" aria-label="Anchor link for: billing">🔗</a> Billing</h2> If you’re based in India and trying to signup for their paid plans, note that their stripe integration for payments does not have OTP authentications (Verified-By-Visa enabled, thus making all Visa cards fail being charged. Any MasterCard with international payments enabled should work fine however! <h2 id="final-thoughts"><a class="zola-anchor" href="#final-thoughts" aria-label="Anchor link for: final-thoughts">🔗</a> Final Thoughts</h2> NextDNS is one of those rare services that’s simultaneously simple enough for non-technical users and powerful enough for network nerds. The OpenWrt setup takes 10 minutes and gives your entire home network ad-blocking, malware protection, and parental controls without any ongoing maintenance. The free tier covers a typical household, and even the paid plan is cheaper than a coffee. If you’ve been considering setting up Pi-hole but haven’t gotten around to it, give <a rel="noopener nofollow noreferrer external" target="_blank" href="https://nextdns.io/?from=83bgqgfw">NextDNS</a> a try instead.