- Mar 19, 2022
- 246
Among the ones mentioned which does the best job of blocking malicious domains ?
CleanBrowsing DNS vs NextDNS vs ControlD DNS
- Thread starter SohanRay
- Start date
Please provide comments and solutions that are helpful to the author of this topic.
- Aug 17, 2014
- 11,096
For sure Quad9 confirmed even from my personal testing...
I see improvements for Cloudflare DNS 'Malware Blocking' (1.1.1.2)
I see improvements for Cloudflare DNS 'Malware Blocking' (1.1.1.2)
- Aug 28, 2015
- 801
Even though I am a NextDNS user, I would agree with @silversurfer and say Quad9 is best at this.
- Mar 19, 2022
- 651
I am a NextDNS user. I can say that it blocks well. But that's my opinion. Not everyone has to guess 
- Mar 19, 2022
- 246
Which one would you rank just after Quad9?
- Aug 17, 2014
- 11,096
NextDNS as 2nd best, it's close to Quad9.
NextDNS is superior in almost every way compared to Quad9, and can become even better when properly configured
- Mar 19, 2022
- 246
Are you sure? If you check this link from my post... Nextdns uses poor quality threat intelligence feeds I think.
Update/replace Threat Intelligence feeds not updated since very long · Issue #959 · nextdns/metadata
https://malc0de.com/bl/ZONES --hasn't been updated since december 2019 https://rescure.me/rescure_domain_blacklist.txt --hasn't been updated since 2 months eventhough it says feed update frequency ...
github.com
It still has AI powered protection and Google Safe Browsing, aswell as Block Newly Registered Domains and the ability to add more filter listsAre you sure? If you check this link from my post... Nextdns uses poor quality threat intelligence feeds I think.
Update/replace Threat Intelligence feeds not updated since very long · Issue #959 · nextdns/metadata
https://malc0de.com/bl/ZONES --hasn't been updated since december 2019 https://rescure.me/rescure_domain_blacklist.txt --hasn't been updated since 2 months eventhough it says feed update frequency ...
Last edited:
- Aug 17, 2014
- 11,096
Well, probably depends what filters are added on NextDNS, default includes Google Safe Browsing that's good protection even against fresh malicious domains.Are you sure? If you check this link from my post... Nextdns uses poor quality threat intelligence feeds I think.
Update/replace Threat Intelligence feeds not updated since very long · Issue #959 · nextdns/metadata
https://malc0de.com/bl/ZONES --hasn't been updated since december 2019 https://rescure.me/rescure_domain_blacklist.txt --hasn't been updated since 2 months eventhough it says feed update frequency ...
Just wait for other users opinions like from @SecureKongo he is an advanced user of NextDNS.
- Mar 19, 2022
- 246
Is that enough? As CleanBrowsing claims to use mix of public lists, private lists, lists from partners and malicious domains picked up by their AI and Machine learning just like NextDns.
I personally am not sure how effective CleanBrowsing is.
- Mar 19, 2022
- 246
Maybe in terms of control, because Quad9 doesn't provide any. But, what would be the case if the quality of threat intelligence feeds is compared? Nextdns just uses public lists and that too around at least 17 of those I have found to be useless as they haven't been updated for months!
- Apr 1, 2019
- 2,868
NextDNS can have some quirks. I've never been able to run it on a router without it popping some google and cloudflare hits on leak tests. They insist this is impossible, but it's the only DNS service I've ever seen bring up another DNS resolver when using their service. I'm not alone either, other people have posted about it on their help page. They also had a lot of trouble getting DoT to play nice on ASUS routers. As much as I like NextDNS, Quad9 is much easier to set and forget as long as you are just looking for an extra layer of security.
- Feb 25, 2017
- 2,585
I personally wouldn't call myself an "advanced" NextDNS user, but thanks I guess 
@silversurfer
NextDNS Threat Intelligence Feeds > AI Based Threat Detection > Google Safe browsing. This is how I would rank all three of them.
@ScandinavianFish already said that you can also add more filters like the oisd filter which is a great starter list for malware, tracker and ad-blocking. Even tho it doesn't necessarily detect malicious sites, I also recommend the "Block Newly Registered Sites" setting which blocks all domains that were registered less than 30 days ago. As most malicious or phishing sites are only a few days old and as older domains are already taken down, this can be quite a strong addition to your blocklists. In my opinion the main strenght of NextDNS isn't the detection of malicious sites but the risk-reduction to even access one. I already mentioned the example "Block Newly Registered Sites". It reduces the risk of being infected by restricting the access to sites that have a high possibility of being infected. Same goes for Typosquatting Protection or the blocking of often abused Top Level Domains.
If you are looking for a set and forget DNS service then I would go for Quad9. If you want a configurable one, then I'd recommend NextDNS. It's a matter of preference. Either way I am sure that your DNS service won't be the only security layer on your system/network. So if a site slips through, you should have a backup anyway. So a short answer to your question if the Threat Intelligence Feeds are good enough: In my opinion they are good enough and also aren't outdated as you stated earlier. It catches many malicious and phising sites that are only a few days old with it's Threat Intelligence Feeds. I did some testing in the past and was always quite satisfied with the results.
You can also check out this video:
@silversurferNextDNS Threat Intelligence Feeds > AI Based Threat Detection > Google Safe browsing. This is how I would rank all three of them.
@ScandinavianFish already said that you can also add more filters like the oisd filter which is a great starter list for malware, tracker and ad-blocking. Even tho it doesn't necessarily detect malicious sites, I also recommend the "Block Newly Registered Sites" setting which blocks all domains that were registered less than 30 days ago. As most malicious or phishing sites are only a few days old and as older domains are already taken down, this can be quite a strong addition to your blocklists. In my opinion the main strenght of NextDNS isn't the detection of malicious sites but the risk-reduction to even access one. I already mentioned the example "Block Newly Registered Sites". It reduces the risk of being infected by restricting the access to sites that have a high possibility of being infected. Same goes for Typosquatting Protection or the blocking of often abused Top Level Domains.
If you are looking for a set and forget DNS service then I would go for Quad9. If you want a configurable one, then I'd recommend NextDNS. It's a matter of preference. Either way I am sure that your DNS service won't be the only security layer on your system/network. So if a site slips through, you should have a backup anyway. So a short answer to your question if the Threat Intelligence Feeds are good enough: In my opinion they are good enough and also aren't outdated as you stated earlier. It catches many malicious and phising sites that are only a few days old with it's Threat Intelligence Feeds. I did some testing in the past and was always quite satisfied with the results.
You can also check out this video:
- Aug 28, 2015
- 801
Agree with this. I have noticed this as well. I would go with Quad9 if it had the customization of NextDNS.
- Feb 25, 2017
- 2,585
Here an addition:
This one is a phishing page so please only visit if you know what you're doing!
This one is a phishing page so please only visit if you know what you're doing!
- Mar 19, 2022
- 246
I personally wouldn't call myself an "advanced" NextDNS user, but thanks I guess
NextDNS Threat Intelligence Feeds > AI Based Threat Detection > Google Safe browsing. This is how I would rank all three of them.
@ScandinavianFish already said that you can also add more filters like the oisd filter which is a great starter list for malware, tracker and ad-blocking. Even tho it doesn't necessarily detect malicious sites, I also recommend the "Block Newly Registered Sites" setting which blocks all domains that were registered less than 30 days ago. As most malicious or phishing sites are only a few days old and as older domains are already taken down, this can be quite a strong addition to your blocklists. In my opinion the main strenght of NextDNS isn't the detection of malicious sites but the risk-reduction to even access one. I already mentioned the example "Block Newly Registered Sites". It reduces the risk of being infected by restricting the access to sites that have a high possibility of being infected. Same goes for Typosquatting Protection or the blocking of often abused Top Level Domains.
If you are looking for a set and forget DNS service then I would go for Quad9. If you want a configurable one, then I'd recommend NextDNS. It's a matter of preference. Either way I am sure that your DNS service won't be the only security layer on your system/network. So if a site slips through, you should have a backup anyway. So a short answer to your question if the Threat Intelligence Feeds are good enough: In my opinion they are good enough and also aren't outdated as you stated earlier. It catches many malicious and phising sites that are only a few days old with it's Threat Intelligence Feeds. I did some testing in the past and was always quite satisfied with the results.
You can also check out this video:
Thanks for the prompt reply. I didn't exactly say that their whole threat intelligence feeds were outdated. But yeah, 17 of them is definitely outdated and like months old. I had personally checked them. You can too, the list of the outdated ones is mentioned in my github post.
Also according to Paolo Alto networks latest post, their stats say that an inactive domain becoming malicious after quite some time is lot more likely than newly registered domains being malicious.
- Feb 25, 2017
- 2,585
Good to know, but that doesn't change the fact that the blocking of newly registered domains can increase the protection quite a bit.
- Apr 1, 2019
- 2,868
It can also generate false positives and complaints among the residents if you are filtering for a whole network. Lots of legit advertising links end up being from new domains. So it depends on how much managing you want to do. When I attempted filtering ads and such on the whole network it resulted in many submissions to my "complaint inbox", also known as "hey husband, WTF did you break!!?".
