Advanced Plus Security Brambedkar59's Security Config 2026

[Kongo]

Anonymized doesn't mean it's not visible/hidden, it just means that instead of using your exact IP or IP subnet it uses the ASN number of that region or something like that. I don't fully understand ASN number yet, but some details are present in the NextDNS article you gave above, as well as in this AdGuard article.

Privacy-friendly EDNS Client Subnet

EDNS Client Subnet is a mechanism used by DNS resolvers to to deliver location-specific results to clients. It's widely popular, but also not without its drawbacks. Are there ways to improve it?

adguard-dns.io

AdGuard took inspiration from NextDNS's approach and made some tweak of their own to further improve cache hit ratio.

My IP address starts with 103 while the ECS that I get from AdGuard starts with 203. Both IP belongs to my country, but they are not the same, hence still private to some extent. So when DNS is queried with the ECS IP subnet, the DNS server still knows that it's coming from my country and serve IPs for/closest to my location if available.
So the ECS shouldn't be hidden to a testing site as far as I understand. No issue while using AdGuard DNS on that site, who is doing almost exactly the same thing as NextDNS.

Besides, NextDNS has their own testing site,

https://test.nextdns.io/

You should see an ECS entry here if ECS is working for you. If you see, then the previous testing site has an issue.
Here's mine. No sign of ECS here.
View attachment 292575
The nice thing is, you can use this site to test ECS with any DNS provider.
Here's the same site with AdGuard DNS, and there we have ECS. You can test with Google DNS, Quad9 with ECS or anything else.
View attachment 292578
Another method that is given in the NextDNS article is by using DIG. This method is applicable to NextDNS only.

I already have dig installed on my Windows. You will have to install it for testing. Here from the result we have another confirmation that ECS is not being sent when I am using NextDNS.
View attachment 292574
So you can try these methods to see it's actually working for you.
ECS not working for many users is a long known issue. It never ever worked for me.

Thanks a lot for clarifying

 

[SeriousHoax]

Thanks a lot for clarifying

Is ECS working for you?

 

[Divergent]

But how to test if it is actually working?

Give this a read.

NextDNS Diagnostic Guide: Connection and Smart ECS Check

This guide shows you how to use NextDNS tools to check your connection status, latency, and, most importantly, confirm that the Smart EDNS Client Subnet (ECS) feature is working to protect your privacy.

---

I. For Windows Users: The Dedicated Diagnostic Tool

NextDNS provides a specific program to run comprehensive checks on your Windows machine and generate a shareable report.

1. Download and Run the Program

Download the official NextDNS diagnostic program and run it.

It automatically gathers network measurements related to your connectivity and routing with NextDNS.

2. Generate the Report URL

At the end of the process, it submits the report and gives you a unique diagnostic URL (e.g., [https://nextdns.io/diag/](https://nextdns.io/diag/)...).
Share this URL if you need assistance troubleshooting specific latency or routing issues.

---

II. Basic Status Check: The NextDNS Test Page

For a quick check of your current connection and basic settings, use the official NextDNS test page:

Go to: [https://test.nextdns.io/](https://test.nextdns.io/)

This page provides key information at a glance, such as the connection status (should show ok), the protocol (e.g., DOH or DOT), and the client IP address it sees.

---

III. For Advanced Users (Linux/Mac): Verifying Smart ECS Logic

To confirm NextDNS's Smart ECS (which substitutes your IP for privacy) is working on a specific domain, you can use the `dig` command. This checks if the domain is on their whitelist for ECS optimization.

1. The Diagnostic CHAOS Query

Run this command in your terminal. Be sure to replace `[domain_name]` with the site you want to test (e.g., `facebook.com`):

dig +tcp +nocomment chaos [domain_name] @ecs-test.nextdns.io

2. How to Read the Results

The key is the line containing `smart-ecs.nextdns.io` in the output's TXT record.

Scenario	smart-ecs.nextdns.io TXT Record	What It Means
Domain is on the Whitelist	"X.Y.Z.0/24" (Example)	The domain needs ECS for speed. NextDNS sent a substituted subnet for optimization. The IP block shown is not your real IP.
Domain is NOT on the Whitelist	"not sent"	The domain was determined not to benefit from ECS. NextDNS sent NO ECS data at all, maximizing your privacy.

This check confirms that NextDNS successfully applies its smart logic, either sending a privacy-preserving substitute subnet or skipping ECS entirely, depending on the domain.

---

---

---

 

[Kongo]

Is ECS working for you?

According to the test pages - no.

 

[brambedkar59]

Switched to Avast Premium.

 

[Captain Awesome]

Switched to Avast Premium.

Why Avast!?

 

[brambedkar59]

Why Avast!?

I wouldn't have switched away from Kaspersky Free but they kinda forced my hand by discontinuing the free version. I thought about going premium route with Kaspersky but I hate the Application control, it's very annoying.
Avast is the 2nd best choice for me. It's usually in the top 5 spots in-terms of both protection and performance (which is more important for me, so MS Defender is no go), since last 5 years.
Avast allows exceptions easily just like Kaspersky. Updates don't slow down system like Bitdefender. Also, False positives are not too high unlike some of the AVs.

Edit: I do have concerns about its stability, from my past experience. I will use it for a while and then go from there.

 

[Captain Awesome]

I wouldn't have switched away from Kaspersky Free but they kinda forced my hand by discontinuing the free version. I thought about going premium route with Kaspersky but I hate the Application control, it's very annoying.
Avast is the 2nd best choice for me. It's usually in the top 5 spots in-terms of both protection and performance (which is more more important for me, so MS Defender is no go), since last 5 years.
Avast allows exceptions easily just like Kaspersky. Updates don't slow down system like Bitdefender. Also, False positives are not too high unlike some of the AVs.

Kaspersky Free is working fine for me. Recently know about discontinuing K Free from @harlan4096 and its really sad to see. Hope they will bring back free soon.

 

[brambedkar59]

Kaspersky Free is working fine for me. Recently know about discontinuing K Free from @harlan4096

Yeah, I have ~100 days left in the free subscription. But I was bored...

 

[harlan4096]

The current KFree continue auto-updating to new versions (now 21.23)... and probably also the new installations...

 

[lokamoka820]

Why, despite your security settings being categorized as "Advanced Plus Security" do they still include the following:

 

[harlan4096]

That depends on the settings on the config, I just removed this tag on this config, but probably I added it because a pervious one fulfilled with the tag.

 

[brambedkar59]

Why, despite your security settings being categorized as "Advanced Plus Security" do they still include the following:

View attachment 293859

I think at some point in time I installed insider preview build of Win 11, that's why this tag.

 

[brambedkar59]

Edit: I do have concerns about its stability, from my past experience. I will use it for a while and then go from there.

For anyone wondering, Zero stability issues so far.