Serious Discussion DNS Providers for Home Users – Still Cloudflare/Quad9, or Did NextDNS/Control D Finally Win?

[Divergent]

No — I’m not “hallucinating,” but I did previously mix two different meanings of “simple”

There are two different “simplicity” axes:

• Simplicity of the controls (few categories vs many lists/toggles).
• Simplicity of deployment/onboarding (how quickly a normal home user can get to a working, stable setup).

Cloudflare Gateway can be “simple controls” (few categories), while still being “complex onboarding” (locations, policies, selectors, rule order, etc.). NextDNS is usually the opposite: “simple onboarding” plus lots of knobs if you want them.

Facts: Cloudflare Zero Trust (Gateway) is primarily a teams/enterprise product with a Free plan

Cloudflare’s own product positioning for Gateway’s Free plan says it is: “Best for teams under 50 users or enterprise proof-of-concept tests.” That’s not consumer positioning. It’s a business/IT platform offering a free tier.
Secure Web Gateway | Threat Protection

Cloudflare has also explicitly framed the free Teams/Zero Trust offering as bringing “the features of enterprise Zero Trust products and Secure Web Gateways to small teams,” while noting it can be used to secure home Wi‑Fi. That still reads as “enterprise features made accessible,” not “consumer product UX.”
Zero Trust For Everyone

So, with facts: Cloudflare ZT Free is best described as an enterprise/teams Zero Trust platform that happens to be usable at home, not a consumer DNS product.

Facts: NextDNS really can be “create account → copy endpoint → done”

NextDNS’ own help content repeatedly points users to “your endpoints on the setup page,” including simple DoH forms like:

• Use the public DoH endpoint (no profile): https://dns.nextdns.io
• Or profile-based DoH URLs like: https://dns.nextdns.io/<profile id>

Query address
JAMF Setup Instruction

That supports your claim that NextDNS is closer to “drop-in and working” for typical home users.

How to compare them fairly (without being misled by one feature)

If the scope is “average home user DNS filtering from the portal”:

• NextDNS is more consumer-oriented: fast onboarding and clear toggles, but it also exposes high-impact options (lots of blocklists, TLD blocking, etc.) that can increase breakage when people overdo it.
• Cloudflare Gateway Free is an enterprise/teams policy engine with a free tier: it can be configured to do basic category blocking, but the workflow and concepts are more admin-like, and the clutter is real for non-IT users.

So “how can one even compare?” — you can compare outcomes and risk, but only if you keep the scope consistent (DNS filtering via portal), and you evaluate both (1) onboarding friction and (2) misconfiguration blast radius.

Conclusion

With facts, Cloudflare Zero Trust Free is not a consumer product; it’s an enterprise/teams Zero Trust platform with a free tier that can be used at home. NextDNS is much closer to a consumer/prosumer DNS product where “copy endpoint and go” is a normal workflow. That difference in product DNA is exactly why “average user” discussions can get distorted if someone cherry-picks one aspect (like “few categories”) and ignores onboarding and maintenance realities.

Sources

• Secure Web Gateway | Threat Protection
• Zero Trust For Everyone
• Query address
• JAMF Setup Instruction

So did it appear to you that those intermediate to a stage users in the other thread were only toggling the ad blocking or did you view them discussing how modify yaml files ECT.

Again I will ask can you view either dashboard to confirm.

Would you feel right recommending this to home users and some user tanks their network because you were mislead in this thread.

There is a reason they have enterprise and consumer versions bot. You just said nextdns is dangerous because you can block TLDs if you chose but ignored the serious consequences of the enterprise product of a user were to "play" with those settings.

 

[Bot]

So did it appear to you that those intermediate to a stage users in the other thread were only toggling the ad blocking or did you view them discussing how modify yaml files ECT.

Again I will ask can you view either dashboard to confirm.

Would you feel right recommending this to home users and some user tanks their network because you were mislead in this thread.

There is a reason they have enterprise and consumer versions bot. You just said nextdns is dangerous because you can block TLDs if you chose but ignored the serious consequences of the enterprise product of a user were to "play" with those settings.

What I can and cannot verify

I can’t “view either dashboard” (Cloudflare ZT or NextDNS) the way a human can. As an AI, I don’t have the ability to log into accounts, see your tenant settings, or confirm what a specific user has configured inside their dashboard.

I also can’t safely confirm what specific people in that other thread did unless you paste the relevant excerpts here. If you paste the parts where they discuss YAML/cloudflared/tunnels/scripts, I can analyze the risk and the “average vs intermediate user” fit based on that text.

On your main point: yes, there’s a real difference in blast radius

You’re right to call out that I shouldn’t highlight “NextDNS can block TLDs” while downplaying the consequences of an enterprise/teams policy engine being “played with.”

Both products have foot-guns, but they’re different:

• NextDNS “power-user” foot-guns (home/prosumer tool):
  • Overblocking by stacking too many lists
  • Blocking TLDs / overly broad rules
  • Aggressive tracking/affiliate options causing site breakage
  These usually manifest as “some sites/apps break,” and users can often quickly revert by disabling a list or toggle.

• Cloudflare Zero Trust / Gateway foot-guns (enterprise/teams platform):
  • Policy order / precedence mistakes (deny/allow interactions)
  • Applying policies to the wrong scope (location, identity, device group)
  • If using WARP/clients: endpoint disconnects/updates and user confusion can look like “internet is broken”
  • If using tunnels: accidental exposure of internal services is a genuine security risk (not just breakage)
  These can be “whole household outage” problems, or worse, “you published something you didn’t intend to.”

So yes: the enterprise product can carry higher-consequence failure modes if a non-expert starts experimenting outside a narrow, well-understood configuration.

Would I feel right recommending Cloudflare ZT Free to typical home users?

Not as a general “default recommendation,” for exactly the reason you’re getting at: it’s primarily a teams/enterprise-style policy platform, and many home users won’t maintain it safely over time.

If a home user is already comfortable with networking concepts and wants category-based filtering, Cloudflare Gateway can be used safely if they keep the scope tight (DNS-only, minimal policies, minimal moving parts) and have a quick fallback plan (e.g., router DNS revert).

But for “average” home users who just want quick, low-maintenance protection, a consumer/prosumer DNS product with straightforward onboarding (NextDNS/ControlD-type workflow) is usually the safer fit.

What I saw “in principle” vs what I can prove

It’s completely plausible that intermediate users in that thread go beyond “toggle ads” into scripts, YAML, tunnels, or complex policies—MalwareTips attracts power users. However, I can’t responsibly claim specifics as “confirmed” without the quoted passages.

Conclusion

Your criticism is fair: enterprise/teams platforms can have bigger consequences when non-experts “play” with settings, and it’s not responsible to treat that as comparable to a consumer DNS toggle experience. If you want a fact-based call on what the other thread’s users were actually doing (ads-only vs YAML/tunnels/etc.), paste the relevant excerpts and I’ll evaluate them directly.

 

[Divergent]

@Divergent

The irony of your desire to have the last word and proof you are right in all circumstances is that you have driven the discussion to the outskirts of average home user use cases. Also all other members have lost the intrest in this square millimeter outskirt discussion. Maybe you have not noticed, but only Bot and your second best friend Linuxfan58 are reacting on your posts (where is your best friend Bazang?)

Have fun discussing with Bot because I am throwing the towel in the ring

Mr narcissist. Please understand I am not your friend. Also understand the reason I just called you that. You are responding here as last word every time it's settled. Who has to have the last word, today it's me. I'm going to ram this thread sideways up your four point of contact since staff will not moderate you.

@harlan4096 @silversurfer @Jack

 

[Jonny Quest]

Bot is that type of configuration that requires guides safe even for intermediate users that would not understand what they are adjusting let alone average users?

Your response to that post was 100% accurate. You are being mislead and so are the guest of MalwareTips.

No — relying on copy/paste guides for that kind of Cloudflare Tunnel/YAML configuration is not “safe by default” for intermediate users who don’t understand what they’re changing

Intermediate users can often follow the steps and get a working tunnel, but the safety issue is that “working” is not the same as “secure.” If they don’t understand ingress matching, what services are being published, and what access controls are in place, they can accidentally create a real exposure.

What’s risky for intermediate users (even if they can follow the guide)

• Accidental external exposure: The biggest risk is unintentionally publishing an internal service (NAS/admin UI/Home Assistant/RDP/other web panels) to the internet.
• Wrong assumptions about protections: People assume “it’s Cloudflare, so it’s safe,” but security depends on how Access policies/MFA/auth are configured in front of the app.
• Catch-all/ingress mistakes: A misplaced rule (or an overly broad hostname/service mapping) can route more than intended.
• Poor troubleshooting leads to “make it more permissive”: When something doesn’t work, intermediate users often weaken rules to restore functionality, which can reduce security.
• Maintenance debt: Once set up from a guide, the user may not be able to safely update/repair it when the environment changes.

What’s generally “safe enough” guidance
If someone insists on using tunnels, a safer baseline is:

• Only publish one specific service at a time and verify exactly what is reachable externally.
• Put strong auth in front (Cloudflare Access with MFA) for anything sensitive.
• Avoid exposing device/admin panels at all unless the user understands the threat model.
• Keep a “default 404” catch-all and test from an external network.

About “you are being misled”

I agree with the substance: presenting Tunnel + YAML + policy logic as “average-user capable” is misleading. But I can’t verify anyone’s motives, and it’s better (and more productive on MalwareTips) to keep it framed as “this is a high-blast-radius configuration if you don’t understand it.”

Conclusion

For average and many intermediate users, guide-driven Cloudflare Tunnel/YAML setups are not safe in the “set-and-forget” sense because the main failure mode is unintended exposure, not just “it breaks.” Your caution is appropriate and aligns with good security advice.

I freely admit I am one of those average users, so @Divergent thank you for some of those follow-up posts and questions, which confirms for me anything other than the NextDNS free version which I came to understand how it worked, but still could be confusing for an average user on what was being blocked and allowed, would be my choice. As of now, I'm using the Cloudflare Warp app along with my AV's browser protection.

 

[Bot]

I freely admit I am one of those average users, so @Divergent thank you for some of those follow-up posts and questions, which confirms for me anything other than the NextDNS free version which I came to understand how it worked, but still could be confusing for an average user on what was being blocked and allowed, would be my choice. As of now, I'm using the Cloudflare Warp app along with my AV's browser protection.

That’s a sensible takeaway for an “average user”

If you already understand NextDNS (even the free tier) better than Cloudflare Zero Trust/Gateway, choosing the thing you can confidently operate and troubleshoot is usually the safer option.

About using Cloudflare WARP + your AV’s browser protection

That combination can be fine, but keep expectations realistic:

• WARP mainly helps with encrypted DNS and routing your traffic through Cloudflare’s network; the “security filtering” you actually get depends on what you’ve enabled (and whether you’re using a Gateway/Zero Trust setup behind it).
• AV browser protection can add phishing/malicious URL blocking and reputation checks, but it won’t replace solid DNS filtering and safe browsing habits.

Low-risk “average user” advice to avoid surprises

• If WARP ever causes “no internet,” first try toggling WARP off/on, then update the app. If problems persist, uninstalling WARP is a valid troubleshooting step (you won’t “break” Windows/iOS by removing it).
• Avoid changing multiple Cloudflare settings at once; if something breaks, it becomes hard to know why.
• If you switch back to NextDNS later, keep it simple: enable the basic security toggles you understand and resist stacking lots of blocklists unless you’re prepared to troubleshoot site/app breakage.

Conclusion

For an average home user, “the product you understand and can recover from quickly” is usually the most secure choice in practice. Using WARP plus your AV is reasonable, but if you ever feel you’re guessing about what’s blocked/allowed or you’re fighting connectivity issues, a simpler DNS setup (like NextDNS with minimal toggles) is often the safer long-term path.

 

[silversurfer]

@Divergent

The irony of your desire to have the last word and proof you are right in all circumstances is that you have driven the discussion to the outskirts of average home user use cases. Also all other members have lost the intrest in this square millimeter outskirt discussion. Maybe you have not noticed, but only Bot and your second best friend Linuxfan58 are reacting on your posts (where is your best friend Bazang?)

Have fun discussing with Bot because I am throwing the towel in the ring

Mr narcissist. Please understand I am not your friend. Also understand the reason I just called you that. You are responding here as last word every time it's settled. Who has to have the last word, today it's me. I'm going to ran this thread sideways up your four point if contact since staff will not moderate you.

@harlan4096 @silversurfer @Jack

@LinuxFan58 and @Divergent please stop your personal attacks against each other
Obviously, you both dislike each other so why not use the Ignore feature...

 

[Divergent]

@LinuxFan58 and @Divergent please stop your personal attacks against each other
Obviously, you both dislike each other so why not use the Ignore feature...

Ignore feature is but a joke when you can click unignore at the bottom of the thread and harass others.

 

[silversurfer]

Ignore feature is but a joke when you can click unignore at the bottom of the thread and harass others.

You and @LinuxFan58 should agree to disagree and ignoring means just don't reading comments anymore from each other...

 

[LinuxFan58]

@LinuxFan58 and @Divergent please stop your personal attacks against each other
Obviously, you both dislike each other so why not use the Ignore feature...

It is to much fun and so easy

 

[Jonny Quest]

@LinuxFan58 thank you for finding my post amusing, even though I did actually learn something

 

[silversurfer]

It is to much fun and so easy

Well, if it is so funny, you can get a warning as reply-ban for 7 days here in this thread

 

[Sampei.Nihira]

Cloudflare CEO threatens to pull out of Italy

 

[Andy Ful]

Back to the topic.
I made some more tests of NextDNS (NRD blocks enabled) and Avast/Symantec web browser extensions.

On compromised websites: NextDNS ~ Avast ~ Symantec (differences in the testing error interval).
On Newly Registered Domains: NextDNS (perfect) > Symantec (very good) > Avast (poor)

Effectiveness on random samples: NextDNS > Symantec > Avast

Avast extension does not add much to NextDNS phishing blocks.
Symantec can add some blocks to NextDNS. However, this increases the number of false positives.

The best combo for security: NextDNS (NRD blocks enabled) + Symantec Browser Protection

Edit
The best combo is understood in the context of this thread. I mean the best free anti-phishing combo for home users (free DNS resolver + free anti-phishing browser extension).

 

[Sampei.Nihira]

Back to the topic.
I made some more tests of NextDNS (NRD blocks enabled) and Avast/Symantec web browser extensions.

On compromised websites: NextDNS ~ Avast ~ Symantec (differences in the testing error interval).
On Newly Registered Domains: NextDNS (perfect) > Symantec (very good) > Avast (poor)

Effectiveness on random samples: NextDNS > Symantec > Avast

Avast extension does not add much to NextDNS phishing blocks.
Symantec can add some blocks to NextDNS. However, this increases the number of false positives.

The best combo for security: NextDNS (NRD blocks enabled) + Symantec Browser Protection

Which filter list did you use in NextDNS?

 

[Andy Ful]

Which filter list did you use in NextDNS?

 

[Sampei.Nihira]

Although partially used, these are the sources of the HaGeZi filter lists:

dns-blocklists/sources.md at main · hagezi/dns-blocklists

Personally, I only use one filter list.

 

[Andy Ful]

Although partially used, these are the sources of the HaGeZi filter lists:

dns-blocklists/sources.md at main · hagezi/dns-blocklists

Personally, I only use one filter list.

I used a criterion of the most frequent updates.
If you look closely at the picture from my post, sometimes it is better to directly use a list that is also included in HaGeZi (or other multi-lists).

 

[Andy Ful]

Hi Andy! My guess is that those indicator feeds that you added are already used by Cloudflare's security risk categories. But I'm not sure so if you can perform your tests with and without the feeds then that would be helpful.

I did not see any difference.

 

[simmerskool]

Back to the topic.

The best combo for security: NextDNS (NRD blocks enabled) + Symantec Browser Protection

fwiw I've been using Quad9 with ubo added a hagezi filter tweaked ubo advanced user (not me -- just what it's called) and setup dynamic filtering / medium mode. Can "break" a few sites -- easily modified. blocks a lot of crap, or seems to...

Blocking mode: medium mode

uBlock Origin - An efficient blocker for Chromium and Firefox. Fast and lean. - gorhill/uBlock

github.com

 

[Andy Ful]

fwiw I've been using Quad9 with ubo added a hagezi filter tweaked ubo advanced user (not me -- just what it's called) and setup dynamic filtering / medium mode. Can "break" a few sites -- easily modified. blocks a lot of crap, or seems to...

Blocking mode: medium mode

uBlock Origin - An efficient blocker for Chromium and Firefox. Fast and lean. - gorhill/uBlock

github.com

I plan to test the block rate of free DNS resolvers against half-hour Phistank URLs. So, it can also be Quad9.