New Update NextDNS adds several new Early Access security features

[LinuxFan58]

Yes for home use was my question. I use a (free) VPN on demand, but only when I am travelling (and usually only for stuff I need to enter password or passkey/code for).

For corporate use it is more or less standard in the Netherlands for working at home.

 

[Zero Knowledge]

Don´t want to derail this thread but why do you feel a VPN is important?

@n8chavez put it perfectly to be honest

Why do you feel it's not. I'm ALWAYS using a VPN. I think it's required now, what with everyone trying to steal your data/identity. Anything that can at least try to keep my somewhat private is good in my book.

It's not about being untraceable or unhackable or super anonymous and hiding from the NSA etc. It's about not making it easy for people to track you.

Why make it easy in the first place? Only time I'm not connected to a VPN is when I checkout on eCommerce/shopping. Otherwise all traffic is tunneled through a VPN.

 

[Brahman]

Yes for home use was my question. I use a (free) VPN on demand, but only when I am travelling (and usually only for stuff I need to enter password or passkey/code for).

For corporate use it is more or less standard in the Netherlands for working at home.

If you only want security and with enterprise grade encryption standard, move to cloudflare zero trust. It's free (50 different users with unlimited device for each user) and you can configure it easily with the the Ai help directly available on the website itself. On top of that you get these services for free, and you can selectively enable them on selected users.

 

[LinuxFan58]

@Brahman

Yes I normally use Cloudflare Zero Trust free plan. Just switched to NextDNS to try out new protections.

I thought the malware scan was only for paid, but lets continue that in the Cloudflare thread


Thanks

 

[Zero Knowledge]

Yes I normally use Cloudflare Zero Trust free plan.

Could not be bothered or stuffed in the slightest. I don't want to muck around with github scripts and crap. Just give me a pointy clicky UI and I'm happy!

 

[Morro]

Sorry to somewhat hijack this thread, but making a new thread with a question about NextDNS while this exists would be... Meh to me.

I felt like my connection was a bit slow today, so I wanted to check with dnscheck.tools what it would show. And it was a bit slower than usual but acceptable to me. But I saw this aswell!

I mean... what the hell? I have seen Frankfurt before, with NextDNS and with Quad9 but never US. And certainly never both at the same time, and more than half of those give that warning?

 

[Halp2001]

Sorry to somewhat hijack this thread, but making a new thread with a question about NextDNS while this exists would be... Meh to me.

I felt like my connection was a bit slow today, so I wanted to check with dnscheck.tools what it would show. And it was a bit slower than usual but acceptable to me. But I saw this aswell!

View attachment 300171


I mean... what the hell? I have seen Frankfurt before, with NextDNS and with Quad9 but never US. And certainly never both at the same time, and more than half of those give that warning?

It could be related to how NextDNS can direct queries to different servers depending on routing, availability, or load at a given moment. Sometimes this can cause diagnostic tools to show locations or hostnames that do not match perfectly.

It can also happen when some servers use generic hostnames from the hosting provider where they are running, which may trigger those warnings.

This does not necessarily indicate a security issue; it may simply be related to how the infrastructure is organized. If everything is working normally, it could just be a technical detail reported by the diagnostic tool.

 

[Morro]

It could be related to how NextDNS can direct queries to different servers depending on routing, availability, or load at a given moment. Sometimes this can cause diagnostic tools to show locations or hostnames that do not match perfectly.

It can also happen when some servers use generic hostnames from the hosting provider where they are running, which may trigger those warnings.

This does not necessarily indicate a security issue; it may simply be related to how the infrastructure is organized. If everything is working normally, it could just be a technical detail reported by the diagnostic tool.

Thank you, I hope it is that then.

 

[LinuxFan58]

Could not be bothered or stuffed in the slightest. I don't want to muck around with github scripts and crap. Just give me a pointy clicky UI and I'm happy!

I just use the webconsole, stopped messing with scripts

@Brahman you are right it is also available in the free plan, but when enabled it halves my download speed

 

[Zero Knowledge]

I just use the webconsole, stopped messing with scripts

Yeah I just don't see the benefit of using Cloudflare. For hosting YES I would use Cloudflare . Plenty of easier platforms out there. To each their own though.

 

[Sampei.Nihira]

@LinuxFan58

Yes, they are gradually implementing a whitelist.
So they should have added 3 services by now.

Enabled:

• Free Hosting Domains
• Decentralized Web Gateways
• Tunneling Endpoints
• Residential Hosting
• High-risk TLDs (I hope I've translated this correctly from my language into English, which often has different nuances,please check it.
• Non-Trusted Certificates (idem)
• DNS Payload Delivery (idem)

Disabled:

• Data Drop Services

@Bot AI

I'd like to know your opinion on the feature I left disabled,would you enable it?

 

[Bot]

English translation: I have enabled Free Hosting Domains, Decentralized Web Gateways, Tunneling Endpoints, Residential Hosting, High-risk TLDs and DNS Payload Delivery. I left Data Storage Services disabled. I would like your opinion on that feature: would you enable it?

I would leave Data Storage Services disabled for now on a general-purpose profile.

That category targets services which malware can misuse for command-and-control or exfiltration, but the services themselves may be legitimate. File sharing, uploads, synchronization and some application functions could therefore break. Since this is still an Early Access feature, its practical false-positive rate is not yet well established.

I would enable it on a tightly controlled device where those services are never needed, or temporarily as a trial while watching the NextDNS log. If it blocks something legitimate, allowlist the specific required domain, not the whole service category.

Your translations are understandable. If these are the labels displayed by NextDNS in English, I would retain NextDNS’s exact wording—apparently Data Drop Services, rather than Data Storage Services. “High-risk TLDs” and “DNS Payload Delivery” are natural English labels.

Sources

• Security Report: DNS query handling vulnerabilities in NextDNS resolver - Bug Reports - NextDNS Help Center
• Tunneling Endpoints (Early Access) - Discussions - NextDNS Help Center
• Feature Request: Support ECH on NextDNS endpoints to bypass SNI filtering (Without root CA certificates) - Ideas - NextDNS Help Center
• Feature Request: Bind NextDNS Profiles to a Specific Source IP - Ideas - NextDNS Help Center
• Privacy Policy - NextDNS
• How to install and trust NextDNS Root CA - How-To Guides - NextDNS Help Center
• What is EDNS Client-Subnet (ECS)? - Getting Started - NextDNS Help Center

 

[TairikuOkami]

NextDNS is whitelisting some domains, Google App store updates work, but Residential Hosting is still blocking other apps. Windows log shows blocking properly now.

EDIT: But it takes about 2 mins to show up in a log as blocked. Well, better than nothing, I guess.

 

[Sampei.Nihira]

NextDNS is whitelisting some domains, Google App store updates work, but Residential Hosting is still blocking other apps. Windows log shows blocking properly now.

EDIT: But it takes about 2 mins to show up in a log as blocked. Well, better than nothing, I guess.

View attachment 300250

You've surely enabled:

• Data Drop Services

Have you noticed any issues with online shopping or online banking?

 

[TairikuOkami]

You've surely enabled:

• Data Drop Services

Have you noticed any issues with online shopping or online banking?

I have enabled all security features, nothing noticeable. Icedrive Windows app was blocked by Data Drop Services, but not anymore. All payment services work. Analytics show quite a bump, up to 28% on Windows (was 10%), up to 46% on Edge and 52% on Android, they were both ~30%. Blocking reasons show nothing special though.

 

[Sampei.Nihira]

I have enabled all security features, nothing noticeable. Icedrive Windows app was blocked by Data Drop Services, but not anymore. All payment services work. Analytics show quite a bump, up to 28% on Windows (was 10%), up to 46% on Edge and 52% on Android, they were both ~30%. Blocking reasons show nothing special though.

I have no idea what IceDrive does.
Thank you very much; I'll look into enabling Data Drop Services.

 

[TairikuOkami]

I have no idea what IceDrive does.

It is like Gdrive, a desktop app to view cloud files, blocking json caused an infinitive login loop like Residential does for android apps, they keep logging in or fail as offline.

 

[Sampei.Nihira]

Disabled:

• DNS Payload Delivery

All ECH tests fail, including the Browserleaks test:

TLS Client Test - TLS Fingerprinting

Interestingly, it doesn't seem to affect Firefox.

 

[Brahman]

Some more Early Access features ....

 

[Sampei.Nihira]

It's impossible,especially for websites in your language, which are less likely to be subject to whitelists,not to encounter FP's if all Early Access features are enabled.
I've enabled 7/9.