NextDNS (configurable DoH/DoT DNS filtering) Review
The strongest case on this site for 'sometimes the answer is a DNS blocker, not a VPN' - and a product whose limits the operator itself does not oversell. NextDNS (NextDNS Inc., launched March 2019, founded by ex-Dailymotion CTO Olivier Poitrey and Romain Cointepas) sits at the resolver: it encrypts DNS queries (DoH/DoT/DoQ), filters ads, trackers and malware domains against user-chosen blocklists and security feeds, and costs $19.90 a year for unlimited devices - verified live on the pricing page 2026-11-03. What it cannot do is equally clear from the operator's own positioning and independent reviews: it does not hide your IP, does not change your location, does not encrypt page content, cannot touch same-domain ads like YouTube's, is trivially bypassed by anyone who changes DNS or uses a VPN, and fails open - after the 300k free-tier quota, blocking silently stops while DNS keeps resolving. The evidence posture is honest but thin: a founder-owned company that publishes a strong, unusually specific privacy policy (WYSIWWH, user-selected retention 1h-2yrs, four log jurisdictions including Switzerland), yet no audit, no transparency report and no status page; community support only below the Business tier. For households, home offices and anyone who wants set-and-forget network-wide filtering it is close to unbeatable value; as a privacy guarantee it is one layer in a stack, not the stack.
open source4 red flagsfacts verified - operator pages (nextdns.io homepage, /pricing, /privacy, help.nextdns.io), Mozilla press release, Privacy Guides DNS recommendations page, four independent reviews (TechODash, Bitdoze, The Unhacked, Android Authority), privacytools.io app page, HN Algolia (comments + story index) and arctic-shift r/nextdns archive all fetched live 2026-11-03
No independent audit and no transparency report for a service that can, if logging is on, hold a record of every domain your network requested (TechODash and The Unhacked, both fetched live 2026-11-03) - the trust case rests entirely on the operator's own policy text
Logging-by-default ambiguity: Privacy Guides documents that account-based features enable insights/logging by default, so a user who never touches Settings may be logging under a brand associated with 'no logs'; the Mozilla-era 'no-logs trusted DNS resolver' phrasing refers to the public dns.nextdns.io endpoint, not necessarily an account profile
2020 'Tell HN' disclosure (story 25070699): signup emails transmitted to Intercom, presented by the reporter as contradicting the privacy policy's no-sharing pledge - a marketing-site incident, not a DNS-data incident, but a provenance note for the no-sharing claim
+1 more red flags - expand before signing up
Reliability anecdotes in 2026: r/nextdns reports of brief outages and multi-second resolution stalls (users recovered by switching resolvers), and the operator runs no public status page to verify incidents
Review
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 2 · prose updated 2026-11-03 · facts as of 2026-11-03 · how we verify
Honesty note: we have not run our own tests on NextDNS (configurable DoH/DoT DNS filtering) yet (leak tests, speed, kill switch). Everything on this page is source-based meta-research with dated links. When we test it, results appear here and on the change log.
Overview
NextDNS (configurable DoH/DoT DNS filtering) homepage - live capture 2026-09-29
NextDNS is a configurable cloud DNS filtering tool (DoH/DoT/DoQ), not a VPN. It blocks ads, trackers, malware domains and enables parental controls at the network level by securing and filtering DNS queries. Run by NextDNS Inc. (founded 2019 by ex-Dailymotion engineers), it offers granular control, analytics, and user-managed logging. The core caveat: it does not hide your IP, encrypt traffic beyond DNS, or replace a browser ad blocker - this is one layer, not a full privacy stack.
Logging & privacy
NextDNS claims no logging unless explicitly enabled by the user, under a “What You See Is What We Have” policy: when logging is off, request data is discarded immediately. However, this claim rests solely on the operator’s privacy policy - classified as policy-only evidence, with no third-party audit or transparency report. Logging is user-controlled (retention from 1 hour to 2 years) and storage location can be set to the US, EU, UK, or Switzerland. QNAME minimisation and anonymized EDNS Client Subnet are enforced. Crucially, Privacy Guides notes that account creation enables insights and logging by default, meaning the “no logs” stance is a manual setting, not the out-of-box state. Jurisdiction is reported as the United States, with no warrant canary.
Pricing & the renewal trap
NextDNS (configurable DoH/DoT DNS filtering) pricing page - live capture 2026-09-29
There is no renewal trap: the price is flat at $1.99/month or $19.90/year for the Pro plan (personal and family use). The renewal ratio is 1, meaning no price jump after the first term. The Free tier offers 300,000 queries/month - enough for light use but exhausted in days by a household - after which filtering stops silently while DNS resolution continues. Payment methods include cards, PayPal, and cryptocurrencies via BitPay. No refund window is published, and the billing cycle is monthly by default, though annual payment saves 17%. The three_year_cash_total is null in derived_pricing, so the exact three-year cost cannot be verified from available data.
Features & performance
NextDNS supports DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and DNS-over-QUIC (DoQ), with user-selectable blocklists, security filters (e.g., cryptojacking, typosquatting), parental controls, and real-time analytics. It works on all devices via router, OS, or app-level configuration, including IoT and smart TVs. The service is open-source (CLI tools on GitHub) and scales to 132 server locations. However, it lacks a kill switch, split tunneling, multihop, or dedicated IP features - expected, as it’s not a tunneling service. P2P and streaming are unaffected since IP masking isn’t provided. Performance claims (e.g., latency) are not independently tested here, but user reports cite occasional resolution delays and outages, with no public status page to verify uptime.
Ownership & track record
NextDNS Inc. is described as founder-owned and independent, with no corporate parent or affiliate ties disclosed. Founders are Romain Cointepas and Olivier Poitrey, both with engineering backgrounds at Dailymotion and Netflix. Data quality is verified via operator pages, independent reviews, and community archives. Red flags include the absence of audits or transparency reports despite handling sensitive DNS data, a 2020 incident where signup emails were sent to Intercom (a GDPR complaint, though not involving DNS logs), and recurring user complaints about poor support and development stagnation. Reliability anecdotes from 2026 on r/nextdns and HN report outages and latency issues, with no status page to confirm or address them.
Censorship resistance
NextDNS does not offer obfuscation methods like domain fronting or traffic masking, and its protocols (DoH, DoT, DoQ) are detectable and blockable by sophisticated censors. It is not designed for use in highly censored environments like China, Iran, or Russia. While it can bypass basic network-level filtering (e.g., school or ISP blocklists), it will fail under active DPI or state-level blocking. The service does not position itself as a censorship circumvention tool, and user reports confirm it has been blocked in parts of Russia due to Cloudflare infrastructure dependencies.
Verdict
NextDNS is a powerful, cost-effective DNS filtering layer for households and home offices wanting network-wide ad, tracker, and malware blocking with full control over logs. It’s not a privacy replacement for a VPN and does not hide your IP. Given the lack of audits and default logging with accounts, treat it as a convenience and control tool, not a trustless privacy guarantee. The flat renewal pricing and strong feature set make it safe to recommend for personal use - especially the free tier to test. There is no evidence this provider pays review sites; affiliate links exist but are disclosed.
++ What holds up
Exceptional value: $19.90/year for unlimited queries, unlimited devices and unlimited configurations - verified live on the pricing page (free tier: 300k queries/month, all features)
Real filtering control at the resolver: 11 security toggles, 84+ blocklists, native OS-level tracking protection, parental controls with schedules and bypass blocking - covering devices (smart TVs, consoles, IoT) that can never run an extension
Encrypted DNS by default paths (DoH/DoT/DoQ) plus enforced QNAME minimisation and anonymized in-house ECS that does not expose your IP to authoritative servers (operator privacy policy)
Logging is user-sovereign by design: choose retention 1 hour to 2 years or none, and choose log residency among US, EU, UK or Switzerland; WYSIWWH view/export/delete (operator docs)
Founder-owned and bootstrapped per its own privacy policy ('100% funded, owned and controlled by its founders'), no VC pressure documented; Mozilla TRR partner since December 2019
Open-source MIT CLI client and a well-maintained public blocklists repo; native OpenWrt and Tailscale integrations
Widely recommended by the independent privacy community (Privacy Guides cloud-based DNS filtering pick, updated September 2026) with a 4.7/19 community rating on PrivacyTools.io
-- What to watch
Not a VPN and not a privacy tunnel: it does not hide your IP, does not change your location and sees only domain lookups, never page content (stated plainly by The Unhacked and TechODash)
Free tier fails open silently: after 300,000 queries/month, blocking stops with no warning while DNS keeps resolving - protection degrades invisibly (operator footnote + Bitdoze/TechODash)
Support is community-only below Business tier; 'absolutely zero support' and 'no customer support' are recurring 2026 HN complaints, and two users describe switching to Control D over it
Development pace and communication have visibly slowed per 2026 reviews; no public status page, no transparency report, no independent audit
DNS-layer limits are structural: YouTube/same-domain ads survive, raw-IP and hardcoded-DNS malware bypasses it, and any user can walk around the filtering by changing DNS or using a VPN
DNSPerf-based comparisons put it mid-pack on latency (roughly 25-30ms North America versus Cloudflare's 8-11ms), and r/nextdns users report occasional resolution slowdowns and brief outages
Aggressive lists (NRD, whole-TLD, HaGeZi Ultimate) cause false positives that beginners struggle to debug from the logs
Pricing reality check
Intro price
$1.99 /mo · renews $1.99/mo
Renewal price
$1.99/mo
Notes
Live pricing page 2026-11-03: Free $0 (300,000 queries/month), Pro $1.99/month or $19.90/year (personal and close family use), Business $19.90/month or $199/year per 50 employees, Education $19.90/month or $199/year per 250 students. All prices USD. 'We accept cards, PayPal and cryptocurrencies' (BitPay named as the crypto processor in the privacy policy).
Check the renewal price above before any multi-year plan - true-cost calculator.
Is NextDNS legit?
Legal domicile: United States - operator is NextDNS Inc. (AS34939); operator pages name only 'NextDNS Inc.' and its two founders without stating incorporation or headquarters; the US base is reported by PrivacyTools.io ('Based in United States') and TechODash ('a US-based company'). Logging claim: No logging unless the user requests it: 'If not specifically requested by the user, no data is logged... our users are given the option, control, and full access to what is logged and for how long', under a stated 'What You See Is What We Have' policy; when logging is off, 'the server discards all request and response data immediately after sending back the response'. - evidence class: promise only (no proof). No incidents on file in our research - absence of evidence is not proof of innocence. Facts verified - operator pages (nextdns.io homepage, /pricing, /privacy, help.nextdns.io), Mozilla press release, Privacy Guides DNS recommendations page, four independent reviews (TechODash, Bitdoze, The Unhacked, Android Authority), privacytools.io app page, HN Algolia (comments + story index) and arctic-shift r/nextdns archive all fetched live 2026-11-03 (not fully verified) as of 2026-11-03 - read the sources below.
The money trail - what review sites earn by recommending this
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
On the website
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
NextDNS (configurable DoH/DoT DNS filtering) homepage - live capture 2026-09-29NextDNS (configurable DoH/DoT DNS filtering) pricing page - live capture 2026-09-29
Before you pay: check the renewal price, the refund window, and whether a cheaper or free path covers your use case - the honest checklist.
Is NextDNS (configurable DoH/DoT DNS filtering) legit?
Based on our checks as of 2026-11-03: NextDNS (configurable DoH/DoT DNS filtering) scores 3.6/10 in our weighted review. We logged 4 red flags (listed above). User reports, ownership and the incident record are documented with dated sources in the meta-review below.
What do I actually get for $1.99/month?
Full access to all filtering features, unlimited devices, user-controlled logging with jurisdiction choice, and priority support. The yearly plan ($19.90) saves 17% over monthly billing.
What is the renewal price and total cost over three years?
The renewal price is $1.99/month - the same as the intro rate. The **`three_year_cash_total`** is null in `derived_pricing`, so the exact three-year cost cannot be verified.
What proof is there that NextDNS doesn’t log my data?
Only the operator’s privacy policy supports the no-logs claim - classified as **policy-only**. There is no independent audit or transparency report.
Does it work in countries with heavy censorship like China or Iran?
No. NextDNS lacks obfuscation and is detectable; it is not suitable for use in China, Iran, Russia, or similar environments.
Can I pay and sign up anonymously?
Yes. Email signup requires no ID, and cryptocurrency payments are accepted via BitPay, though specific coins aren’t listed.
What happens if NextDNS shuts down or stops working?
Your DNS queries will fail until you switch to another resolver. The free tier continues as unfiltered DNS after quota, but blocking stops.
What’s the honest free or cheap alternative?
Use the free tier (300,000 queries/month) or switch to a public encrypted resolver like dns.nextdns.io, Cloudflare (1.1.1.1), or Quad9 - but without custom filtering or analytics.
The meta-review: what the internet says about NextDNS (configurable DoH/DoT DNS filtering)
We do not expect you to trust us. This review is a meta-review: below you see what other review sites claim - with their conflicts of interest labeled - what users report on Reddit and forums, and who actually operates NextDNS (configurable DoH/DoT DNS filtering). Every claim links to its source so you can verify it yourself.
What other reviewers say (5)
Every source carries a conflict label from our review-site database. "Affiliate-funded" means the site earns money if you buy what it recommends. We include critical voices deliberately.
Fetched live 2026-11-03 (HTTP 200): independent SOHO review, 4.3/5, affiliate-disclosed ('may earn a small commission'). Strongest cons list found: development slowed and the company 'communicates very little'; community-only support; Business tier thin for its price; free tier is 'a two-week trial for one person' that 'fails open silently'; no transparency report or independent audit; YouTube ads unaffected; per-device visibility requires the CLI/apps. Also quantifies latency expectations (DNSPerf mid-pack, 25-30ms NA vs Cloudflare 8-11ms) and names it 'a US-based company'. Verdict: strong buy for home/remote users, caution for business.
Fetched live 2026-11-03 (HTTP 200): two years of whole-network use; documents the 2025-2026 feature waves (Bypass Age Verification shipped August 2025 on all plans, log data residency US/EU/UK/CH, Tracker Insights), the 11-toggle security tab, 84+ blocklists with concrete recommendations (OISD, AdGuard DNS filter, Steven Black, HaGeZi ladder), the free-tier quota cliff ('blocking silently stops... no warning anywhere in the UI'), the missing status page ('there is no status.nextdns.io'), the honest logging note that the live query view still shows requests even with logging off, and that the CLI is MIT-licensed at v1.47.x (mid-2026). Affiliate link used (go.bitdoze.com/nextdns).
Fetched live 2026-11-03 (HTTP 200): disclosure-first review (affiliate link on the /go/ route, disclosed). The most useful section is 'What NextDNS does not do': does not hide your IP, does not see or protect page content, cannot block traffic that skips DNS (hardcoded IPs), is not antivirus, same-domain trackers are hard, router-only setup stops at the front door, some VPNs bypass it, over-blocking happens. Also documents that the operator pages do not state where the company is incorporated, that no independent audit was found, and that scale figures (100B queries/month) are self-reported. Verdict: worth trying on the free tier; 'not a VPN and does not hide your IP address, so treat it as one layer rather than a complete privacy stack'.
Fetched live 2026-11-03 (HTTP 200): mainstream editorial hands-on (Andy Walker), run after a reader survey where 23% of 4,169 respondents already used NextDNS and 36% were considering it. Confirms the no-app nature (Android Private DNS hostname), the ~87,000-entry default blocklist, Native Tracking Protection as beta, TLD blocking, parental controls including blocking bypass methods like VPNs and Tor, and the analytics value. Caveats given: the 300k query cap ('10,000 queries in two days' on one phone) and that standalone ad-blockers have no query limit. Site carries affiliate links.
Fetched live 2026-11-03 (HTTP 200): community-maintained listing, 4.7 from 19 user ratings, tagged Ad Blocking + DNS, 'Based in United States', 'Supports: DNS-over-TLS (DoT), DNS-over-HTTPS (DoH) and DNSCrypt' (the DNSCrypt claim is contradicted by r/nextdns users - NextDNS speaks DoH/DoT/DoQ, and DNSCrypt works only via proxy). 'Our take': strong network-level blocker whose edge is control (per-device profiles, parental controls, tunable logs); honest note that it is a cloud service so you trust NextDNS with your queries, and the free tier has a cap. NOTE on provenance: the site carries an affiliate link on this page, and per the site's own research file (review_sites.json, 2026-09-27) privacytools.io is community-labeled but operator-unclear since the 2024 community split to Privacy Guides - weight accordingly.
What users say (3)
Reddit, forums, HN - paraphrased and linked, never quoted out of context. Anecdotes, not proof - but refund complaints and leak reports are the best early-warning system this market has.
Fetched live 2026-11-03 (HTTP 200): 2026 HN voices show both poles - strong blocking/value praise (fake-shop and phishing domains blocked, TV telemetry blocked, families covered, Pi-hole refugees citing reliability) against a consistent complaint cluster: 'absolutely zero support', 'not innovating at all' with departures to Control D, and the 300k free-quota cliff being burned by chatty devices. Full comment texts cited individually in the voices array.
Fetched live 2026-11-03 (HTTP 200): the canonical threads - 'Show HN: nextdns.io - A Combination of Cloudflare DNS and Pi-Hole' (May 2019, 372 points, 146 comments, posted by the company), 'NextDNS Is Out of Beta' (May 2020, 334 points), 'NextDNS is my new favourite DNS service' (Apr 2020, 350 points), 'Show HN: NextDNS Adds Bypass Age Verification' (Aug 2025, 537 points, 199 comments, founder-posted with the text 'handing over government documents to random sites is a huge privacy risk'), 'NextDNS Joins Firefox's Trusted Recursive Resolver' (Dec 2019, 144 points), Tailscale integration blog (Oct 2022), and the adversarial 'Tell HN: Nextdns.io, a privacy company, leaks users' email and violates GDPR' (Nov 2020 - Intercom email transmission on signup).
Fetched live 2026-11-03 (HTTP 200): 25 recent r/nextdns comments (Sept-Nov 2026). Signal mix: reliability complaints ('fail to resolve DNS 8-10 times per day', 'brief outages yesterday', Minneapolis image-loading stalls fixed by switching to 1.1.1.1), protocol corrections (no DNSCrypt), VPN coexistence workarounds (Proton/Nord + iOS profiles + linked-IP re-linking pain), a detailed cataloguing of 11 new Early Access security features (DNS Data Exfiltration, Fast Flux Networks present since September), and satisfied family/household users. NOTE: the instructed empty-body search (?body=&limit=25) returned HTTP 400; a body term was required - noted in data_quality.
AI fact summary - everything we know, compressed
Generated by Qwen3 on 2026-11-03 from our fact database plus the linked sources. It summarizes - it does not add facts. Check anything that matters against the linked sources.
Bottom line: NextDNS is a DNS filtering tool, not a VPN. It blocks ads, trackers and malware domains across all devices on your network for $1.99/month, with full user control over logging. It does not hide your IP, encrypt traffic beyond DNS, or bypass geoblocks.
The logging truth: The operator claims no logging unless enabled by the user, with data discarded immediately if off, under a "What You See Is What We Have" policy. Evidence is policy-only: no independent audit or transparency report exists. Logging jurisdiction is user-selectable (US, EU, UK, CH), but the company, NextDNS Inc., is US-based, and account creation enables logging by default for features.
Pricing reality: Pricing is flat at $1.99/month or $19.90/year - no bait-and-switch. A free tier offers 300,000 queries/month, unlimited devices, all features, but filtering silently stops when quota is exceeded, with no in-app warning. Crypto payments accepted via BitPay, no KYC.
What reviewers say vs what users say: Affiliate reviewers (TechODash, Android Authority, PrivacyTools.io) praise control, value and ease of use, calling it best-in-class for network filtering. Users confirm effectiveness but report reliability issues - outages, slow resolution - and near-zero support. Conflict: reviewers highlight privacy; users note silent filtering failure and stagnation, with some migrating to Control D.
Who runs it: Founded in 2019 by Olivier Poitrey (ex-CTO of Dailymotion, Director of Engineering at Netflix) and Romain Cointepas. The company is 100% founder-owned, US-based, with no outside investment disclosed. No public corporate address or incorporation details.
Sources & how this review was built
Every external source used on this page, with the date we fetched it and its evidence class [A]-[D] (A = primary/operator, B = serious press/research, C = community, D = our own measurements). Methodology: how we verify. Sources disappear or change - if a link is dead, tell us via contact.
Evidence classes on this page:[A] A: 4[B] B: 7[C] C: 3[D] D: 0(D stays empty until our own test phase)
A censorship-unblocking tool that now wears nonprofit clothes: Lantern's parent became the 501(c)(3) Brave New Software Project and the site now reads like a…
A DNS-layer filtering service that has grown up in public: born January-April 2021 out of the Windscribe team (same three founders, spun out precisely because…
open source
intro $3 /mo
Canada - CONTROLD, Inc., Toronto, Ontario; operator about-us page states 'Founded in 2021 - Toronto, Canada' and site footer reads '2026 CONTROLD, Inc.'; free-dns FAQ calls it 'based in Toronto, Canada... the sister company of Windscribe'privacy tool 9 d ago
Hysteria 2 is not a VPN provider - it is free, MIT-licensed proxy software you deploy on your own server, and this dossier treats it that way: there is no…
open source
intro $5 /mo
none - Hysteria is not a company; it is MIT-licensed open-source software (Go) developed by a volunteer community around lead developer 'Toby' (GitHub: tobyxdd), with the repo on GitHub and docs at hysteria.networkprivacy tool 9 d ago
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.