NextDNS is a configurable DNS resolver with filtering, logging, and privacy controls. When combined with Firefox's DNS over HTTPS (DoH), it gives you fine-grained control over DNS-level privacy and blocking. Here's how to set it up.
What NextDNS Is
NextDNS is a managed DNS resolver (like Cloudflare's 1.1.1.1 or Google's 8.8.8.8) but with:
- Custom blocklists you choose
- Per-device logs (or no logs if you prefer)
- Analytics on what domains you're querying
- Parental controls
- Analytics blocking
- Ability to block/allow specific domains
Free tier: 300,000 queries/month (usually enough for a personal device). Paid: unlimited queries.
Creating a NextDNS Profile
- Sign up at nextdns.io (email optional for basic use — you can create a profile without account for ephemeral use)
- You get a unique ID (e.g.,
abc123) - Your DoH URL:
https://dns.nextdns.io/abc123 - Configure which blocklists to enable
Recommended starting blocklists:
- AdGuard DNS Filter (general ads/trackers)
- NextDNS Ads & Trackers Blocklist
- OISD (comprehensive, low false positives)
- Steven Black's Hosts (additional coverage)
Configuring Firefox to Use NextDNS
Settings → Privacy & Security → DNS over HTTPS → Enable
Method 1: Pick NextDNS from dropdown
Firefox offers NextDNS as a preset provider. Select "NextDNS" and enter your profile ID.
Method 2: Manual URL
Set to "Custom" → enter https://dns.nextdns.io/YOUR-ID
For forced DoH (no fallback to OS DNS):
about:config → network.trr.mode → 3
about:config → network.trr.uri → https://dns.nextdns.io/abc123
Mode 3 forces DoH — if NextDNS is unreachable, DNS resolution fails. Use this only if you have reliable internet.
Verifying NextDNS is Working
Navigate to test.nextdns.io in Firefox. Should show:
- NextDNS Connected: ✓
- DoH: Active
- Your profile ID
Or check via about:networking#dns — DoH resolver should show your NextDNS URL.
The Privacy Tradeoffs
Using NextDNS vs not using DoH:
Without DoH, your ISP sees your DNS queries. With NextDNS DoH, NextDNS sees your queries instead of your ISP.
This is a trust transfer: you're trusting NextDNS more than your ISP. NextDNS has a privacy policy claiming no log selling and GDPR compliance. You can configure logging per profile.
Log settings in NextDNS dashboard:
- Logs: On (full logs, useful for troubleshooting)
- Logs: On (with anonymized IPs)
- Logs: Off (no query logging at all)
For maximum privacy: disable logs entirely. For troubleshooting: enable temporarily.
Combining with Firefox ETP and uBlock Origin
The three-layer approach:
- NextDNS (DNS layer): Blocks known advertising and tracking domains at DNS level — these don't even connect
- Firefox ETP (tracker blocking): Blocks third-party trackers from the browser's blocklist
- uBlock Origin (content filtering): Blocks based on cosmetic filters, network filters, specific URLs
These layers address different threats:
- DNS blocking: Catches entire domains (if you block
ad.doubleclick.net, all requests to that domain fail) - Browser-level blocking: Catches tracking pixels, specific paths on allowed domains, cosmetic content
- uBlock rules: The most specific level
There's overlap between layers — that's intentional (defense in depth).
Blocking Strategy
What to add to NextDNS blocklists:
- Standard ad/tracker blocklists (AdGuard, OISD)
- Optionally: social media blocklists if you want to limit social media from non-social contexts
- Malware/phishing lists (NextDNS includes Quad9 threat intelligence)
What to allow in NextDNS if over-blocked:
The NextDNS dashboard shows which domains are being blocked. If a site breaks, check the log for blocked domains and add exceptions.
NextDNS Analytics: What You Learn
With logging enabled, the NextDNS dashboard shows:
- Which domains are queried most (eye-opening — you query more than you think)
- Which queries are blocked and by which list
- Geographic distribution of queries
- Query volume over time
Seeing that a news article page queries 20+ tracking domains is a useful privacy education.
Android DoH Setup (Firefox for Android)
Same as desktop:
Firefox for Android → Settings → Privacy and Security → DNS over HTTPS → Custom → enter NextDNS URL.
Or: Configure NextDNS at the Android system level (Android 9+ supports Private DNS):
Settings → Network → Advanced → Private DNS → Enter abc123.dns.nextdns.io (NextDNS format for Android DNS-over-TLS).
System-level DNS covers all apps, not just Firefox.
When NextDNS vs Pihole
NextDNS: Cloud-hosted, works anywhere (mobile, different networks), no hardware required.
Pi-hole: Self-hosted on your local network (often Raspberry Pi). Gives you full control, no cloud trust, but only works on your home network.
NextDNS is better for users who need filtering on mobile/remote. Pi-hole is better for home network control with no external dependency.
The two aren't exclusive — many people use NextDNS on mobile and Pi-hole at home.
Top comments (0)