Advice Request CleanBrowsing DNS vs NextDNS vs ControlD DNS

[SohanRay]

Among the ones mentioned which does the best job of blocking malicious domains ?

 

[silversurfer]

For sure Quad9 confirmed even from my personal testing...

I see improvements for Cloudflare DNS 'Malware Blocking' (1.1.1.2)

 

[Trooper]

Even though I am a NextDNS user, I would agree with @silversurfer and say Quad9 is best at this.

 

[M4RT1NE2]

I am a NextDNS user. I can say that it blocks well. But that's my opinion. Not everyone has to guess

 

[SohanRay]

For sure Quad9 confirmed even from my personal testing...

I see improvements for Cloudflare DNS 'Malware Blocking' (1.1.1.2)

Which one would you rank just after Quad9?

 

[silversurfer]

Which one would you rank just after Quad9?

NextDNS as 2nd best, it's close to Quad9.

 

[ScandinavianFish]

NextDNS is superior in almost every way compared to Quad9, and can become even better when properly configured

 

[SohanRay]

NextDNS as 2nd best, it's close to Quad9.

Are you sure? If you check this link from my post... Nextdns uses poor quality threat intelligence feeds I think.

Update/replace Threat Intelligence feeds not updated since very long · Issue #959 · nextdns/metadata

https://malc0de.com/bl/ZONES --hasn't been updated since december 2019 https://rescure.me/rescure_domain_blacklist.txt --hasn't been updated since 2 months eventhough it says feed update frequency ...

github.com

 

[ScandinavianFish]

Are you sure? If you check this link from my post... Nextdns uses poor quality threat intelligence feeds I think.

Update/replace Threat Intelligence feeds not updated since very long · Issue #959 · nextdns/metadata

https://malc0de.com/bl/ZONES --hasn't been updated since december 2019 https://rescure.me/rescure_domain_blacklist.txt --hasn't been updated since 2 months eventhough it says feed update frequency ...

github.com

It still has AI powered protection and Google Safe Browsing, aswell as Block Newly Registered Domains and the ability to add more filter lists

 

[silversurfer]

Are you sure? If you check this link from my post... Nextdns uses poor quality threat intelligence feeds I think.

Update/replace Threat Intelligence feeds not updated since very long · Issue #959 · nextdns/metadata

https://malc0de.com/bl/ZONES --hasn't been updated since december 2019 https://rescure.me/rescure_domain_blacklist.txt --hasn't been updated since 2 months eventhough it says feed update frequency ...

github.com

Well, probably depends what filters are added on NextDNS, default includes Google Safe Browsing that's good protection even against fresh malicious domains.
Just wait for other users opinions like from @SecureKongo he is an advanced user of NextDNS.

 

[SohanRay]

Is still has AI powered protection and Google Safe Browsing, along Block Newly Registered Domains and the ability to add more filter lists

Is that enough? As CleanBrowsing claims to use mix of public lists, private lists, lists from partners and malicious domains picked up by their AI and Machine learning just like NextDns.

 

[ScandinavianFish]

Is that enough? As CleanBrowsing claims to use mix of public lists, private lists, lists from partners and malicious domains picked up by their AI and Machine learning just like NextDns.

I personally am not sure how effective CleanBrowsing is.

 

[SohanRay]

NextDNS is superior in almost every way compared to Quad9, and can become even better when properly configured

Maybe in terms of control, because Quad9 doesn't provide any. But, what would be the case if the quality of threat intelligence feeds is compared? Nextdns just uses public lists and that too around at least 17 of those I have found to be useless as they haven't been updated for months!

 

[blackice]

NextDNS can have some quirks. I've never been able to run it on a router without it popping some google and cloudflare hits on leak tests. They insist this is impossible, but it's the only DNS service I've ever seen bring up another DNS resolver when using their service. I'm not alone either, other people have posted about it on their help page. They also had a lot of trouble getting DoT to play nice on ASUS routers. As much as I like NextDNS, Quad9 is much easier to set and forget as long as you are just looking for an extra layer of security.

 

[Kongo]

I personally wouldn't call myself an "advanced" NextDNS user, but thanks I guess @silversurfer

NextDNS Threat Intelligence Feeds > AI Based Threat Detection > Google Safe browsing. This is how I would rank all three of them.

@ScandinavianFish already said that you can also add more filters like the oisd filter which is a great starter list for malware, tracker and ad-blocking. Even tho it doesn't necessarily detect malicious sites, I also recommend the "Block Newly Registered Sites" setting which blocks all domains that were registered less than 30 days ago. As most malicious or phishing sites are only a few days old and as older domains are already taken down, this can be quite a strong addition to your blocklists. In my opinion the main strenght of NextDNS isn't the detection of malicious sites but the risk-reduction to even access one. I already mentioned the example "Block Newly Registered Sites". It reduces the risk of being infected by restricting the access to sites that have a high possibility of being infected. Same goes for Typosquatting Protection or the blocking of often abused Top Level Domains.

If you are looking for a set and forget DNS service then I would go for Quad9. If you want a configurable one, then I'd recommend NextDNS. It's a matter of preference. Either way I am sure that your DNS service won't be the only security layer on your system/network. So if a site slips through, you should have a backup anyway. So a short answer to your question if the Threat Intelligence Feeds are good enough: In my opinion they are good enough and also aren't outdated as you stated earlier. It catches many malicious and phising sites that are only a few days old with it's Threat Intelligence Feeds. I did some testing in the past and was always quite satisfied with the results.

You can also check out this video:

 

[Trooper]

NextDNS can have some quirks. I've never been able to run it on a router without it popping some google and cloudflare hits on leak tests. They insist this is impossible, but it's the only DNS service I've ever seen bring up another DNS resolver when using their service. I'm not alone either, other people have posted about it on their help page. They also had a lot of trouble getting DoT to play nice on ASUS routers. As much as I like NextDNS, Quad9 is much easier to set and forget as long as you are just looking for an extra layer of security.

Agree with this. I have noticed this as well. I would go with Quad9 if it had the customization of NextDNS.

 

[Kongo]

Here an addition:

This one is a phishing page so please only visit if you know what you're doing!

 

[SohanRay]

I personally wouldn't call myself an "advanced" NextDNS user, but thanks I guess @silversurfer

NextDNS Threat Intelligence Feeds > AI Based Threat Detection > Google Safe browsing. This is how I would rank all three of them.

@ScandinavianFish already said that you can also add more filters like the oisd filter which is a great starter list for malware, tracker and ad-blocking. Even tho it doesn't necessarily detect malicious sites, I also recommend the "Block Newly Registered Sites" setting which blocks all domains that were registered less than 30 days ago. As most malicious or phishing sites are only a few days old and as older domains are already taken down, this can be quite a strong addition to your blocklists. In my opinion the main strenght of NextDNS isn't the detection of malicious sites but the risk-reduction to even access one. I already mentioned the example "Block Newly Registered Sites". It reduces the risk of being infected by restricting the access to sites that have a high possibility of being infected. Same goes for Typosquatting Protection or the blocking of often abused Top Level Domains.

If you are looking for a set and forget DNS service then I would go for Quad9. If you want a configurable one, then I'd recommend NextDNS. It's a matter of preference. Either way I am sure that your DNS service won't be the only security layer on your system/network. So if a site slips through, you should have a backup anyway. So a short answer to your question if the Threat Intelligence Feeds are good enough: In my opinion they are good enough and also aren't outdated as you stated earlier. It catches many malicious and phising sites that are only a few days old with it's Threat Intelligence Feeds. I did some testing in the past and was always quite satisfied with the results.

You can also check out this video:

Thanks for the prompt reply. I didn't exactly say that their whole threat intelligence feeds were outdated. But yeah, 17 of them is definitely outdated and like months old. I had personally checked them. You can too, the list of the outdated ones is mentioned in my github post.
Also according to Paolo Alto networks latest post, their stats say that an inactive domain becoming malicious after quite some time is lot more likely than newly registered domains being malicious.

 

[Kongo]

Also according to Paolo Alto networks latest post, their stats say that an inactive domain becoming malicious after quite some time is lot more likely than newly registered domains being malicious.

Good to know, but that doesn't change the fact that the blocking of newly registered domains can increase the protection quite a bit.

 

[blackice]

Good to know, but that doesn't change the fact that the blocking of newly registered domains can increase the protection quite a bit.

It can also generate false positives and complaints among the residents if you are filtering for a whole network. Lots of legit advertising links end up being from new domains. So it depends on how much managing you want to do. When I attempted filtering ads and such on the whole network it resulted in many submissions to my "complaint inbox", also known as "hey husband, WTF did you break!!?".