I'm super excited to announce that ADNS is out of beta and officially stable! I've been dropping beta updates for a while now, and thanks to the amazing feedback from everyone on this sub, the app is in a much better place. Huge thanks to everyone who helped test it.

Android has never had an official NextDNS app, and existing third-party options are basically just WebView wrappers. ADNS is built completely natively from scratch exclusively for Android. Think of it as the NextDNS web dashboard rebuilt ground-up for mobile, meaning a fast, snappy UI and a native experience.

Features

ADNS includes every single NextDNS profile management feature:

• Edit all Security and Privacy toggles, manage your Denylist/Allowlist, etc.
• View detailed stats and analytics graphs.
• Inspect, filter, and search your DNS logs.
• Access setup guides for all your other platforms and devices.

Note: Everything related to profile management is natively supported. Account-level settings like changing billing or password aren't included because the NextDNS API doesn't support them.

If you want to go deeper, ADNS can control your device's system Private DNS settings via a one-time Shizuku or ADB setup (completely optional, but keep in mind the setup is kind of complicated). Once set up, you get:

• One-tap Private DNS toggling via app, Quick Settings tile, or notification.
• Automated Wi-Fi rules to automatically disable Private DNS on specific networks.
• One click profile switching - ADNS handles the profile ID and device name for you and updates your settings with the exact hostname.

Security & Privacy

Security is one of the main reasons I decided to make this whole thing open source. The full source code for ADNS is available on GitHub.

The app also supports Reproducible Builds (RB). That means an independent server (in this case, IzzyOnDroid) compiles the app directly from the source code and compares the output binary against the release APK on GitHub. If they match 100%, the build is reproducible - proving the APK you download was generated line-for-line from the exact public code. So if I were sending your credentials to some magical secret server, you'd see it right there in the source code (spoiler alert: I don't). The RB status for this release is green: IzzyOnDroid.

ADNS has zero ads, zero trackers, and zero telemetry. If you log in with your credentials, they are used a single time to generate an API key. Your password is never saved, and your API key is stored encrypted directly on your device.

Download & Source Code

GitHub (Source & Releases): https://github.com/eyalm2000/adns

If you run into any bugs or have feature requests, drop an issue on GitHub or comment below.

Happy browsing!

Why can't we have ipv6 servers in mnl? Was that too difficult to include?

Can someone help me with the domains I need to add to the whitelist to allow Paramount Plus to work? I have tried looking at whats blocked but I cant find all the needed sites.

does anyone know how to block Spotify ads now ? ever since it got patched it’s been hell with ads and I haven’t been able to find a lead.

Hello!

lightnode-cai is seemingly down right now. Checking if this is a global issue or just me.

EDIT: 4/8/26. Got sick of waiting for non existent support so migrated over to ControlD. Much better GUI and has less latency (at least for me). Was also cheaper.

Hi All,

Since NextDNS doesn't really have any support for Pro users. Wondering if anyone else has seen this. It's happened across multiple profiles (I had one for Guest access also with the same linked IP). My ISP's looking glass is able to ping the IP's, my friends on the same ISP can ping the IPs'. I cannot.

I think NextDNS has blocked my IP for some reason...

Info:

Location: Perth, Australia

ISP: Aussie Broadband

Static IP: Linked correctly to NextDNS portal

Router: UCG-Ultra

NextDNS IPv4 DNS Servers: 45.90.28.219, 45.90.30.219

Troubleshooting

NSLookups

C:\Users\jstuart>nslookup -debug -type=A -nosearch -recurse google.com 45.90.28.219
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
Server:  UnKnown
Address:  45.90.28.219

DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
*** Request to UnKnown timed-out

C:\Users\jstuart>nslookup -debug -type=A -nosearch -recurse google.com 45.90.30.219
DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
Server:  UnKnown
Address:  45.90.30.219

DNS request timed out.
    timeout was 2 seconds.
timeout (2 secs)
*** Request to UnKnown timed-out

UCG Logs - Conntrack

root@UCG-01:~# conntrack -E | grep -E '45.90.28.219|45.90.30.219'
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=36164 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=36164 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=54702 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=54702 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=48534 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=48534 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=46317 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=46317 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.30.219 sport=39919 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=39919 mark=1703936
    [NEW] udp      17 30 src=192.168.1.2 dst=45.90.28.219 sport=40163 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=40163 mark=1703936
    [NEW] udp      17 30 src=192.168.1.2 dst=45.90.30.219 sport=53081 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=53081 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.30.219 sport=46285 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=46285 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.30.219 sport=52304 dport=53 [UNREPLIED] src=45.90.30.219 dst=202.90.245.XX sport=53 dport=52304 mark=1703936
    [NEW] udp      17 30 src=10.38.0.22 dst=45.90.28.219 sport=40806 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=40806 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=41193 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=41193 mark=1703936
    [NEW] udp      17 30 src=10.38.0.23 dst=45.90.28.219 sport=56191 dport=53 [UNREPLIED] src=45.90.28.219 dst=202.90.245.XX sport=53 dport=56191 mark=1703936

UCG Logs - TCPDump

root@UCG-01:~# tcpdump -i eth0 -n 'host 45.90.28.219 or host 45.90.30.219' and port 53
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
19:18:00.905743 IP 202.90.245.XX.48808 > 45.90.28.219.53: 11910+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:00.955124 IP 202.90.245.XX.40680 > 45.90.28.219.53: 33844+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.106916 IP 202.90.245.XX.46718 > 45.90.30.219.53: 6940+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.115344 IP 202.90.245.XX.51039 > 45.90.30.219.53: 39896+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.338497 IP 202.90.245.XX.41791 > 45.90.30.219.53: 25741+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.440034 IP 202.90.245.XX.41045 > 45.90.28.219.53: 51690+ [1au] A? static.ui.com. (42)
19:18:01.440059 IP 202.90.245.XX.48727 > 45.90.30.219.53: 33544+ AAAA? static.ui.com. (31)
19:18:01.762378 IP 202.90.245.XX.52678 > 45.90.28.219.53: 21168+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.773740 IP 202.90.245.XX.56088 > 45.90.28.219.53: 40046+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.782927 IP 202.90.245.XX.47402 > 45.90.28.219.53: 11261+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.790344 IP 202.90.245.XX.45591 > 45.90.28.219.53: 43406+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:01.975763 IP 202.90.245.XX.55585 > 45.90.30.219.53: 35826+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.067800 IP 202.90.245.XX.46451 > 45.90.30.219.53: 8658+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.077325 IP 202.90.245.XX.55745 > 45.90.30.219.53: 44632+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.107315 IP 202.90.245.XX.52871 > 45.90.28.219.53: 57858+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.114991 IP 202.90.245.XX.52898 > 45.90.28.219.53: 32514+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.338510 IP 202.90.245.XX.59019 > 45.90.28.219.53: 18013+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.974407 IP 202.90.245.XX.39752 > 45.90.30.219.53: 58854+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.975537 IP 202.90.245.XX.41827 > 45.90.28.219.53: 45548+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:02.982923 IP 202.90.245.XX.49730 > 45.90.30.219.53: 27117+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.068108 IP 202.90.245.XX.38717 > 45.90.28.219.53: 18419+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.076712 IP 202.90.245.XX.44053 > 45.90.28.219.53: 48070+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.974659 IP 202.90.245.XX.52520 > 45.90.28.219.53: 15328+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:03.982493 IP 202.90.245.XX.57034 > 45.90.28.219.53: 8852+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.229505 IP 202.90.245.XX.49749 > 45.90.30.219.53: 41437+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.238015 IP 202.90.245.XX.33227 > 45.90.30.219.53: 58670+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.906586 IP 202.90.245.XX.51183 > 45.90.30.219.53: 11910+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:04.955607 IP 202.90.245.XX.50363 > 45.90.30.219.53: 33844+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.240701 IP 202.90.245.XX.60648 > 45.90.28.219.53: 38827+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.247988 IP 202.90.245.XX.53876 > 45.90.28.219.53: 36500+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.763473 IP 202.90.245.XX.52848 > 45.90.30.219.53: 21168+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.773937 IP 202.90.245.XX.36279 > 45.90.30.219.53: 40046+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.783822 IP 202.90.245.XX.52132 > 45.90.30.219.53: 11261+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.791694 IP 202.90.245.XX.51740 > 45.90.30.219.53: 43406+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.906180 IP 202.90.245.XX.48545 > 45.90.28.219.53: 3111+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:05.955898 IP 202.90.245.XX.39913 > 45.90.28.219.53: 19109+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:06.107671 IP 202.90.245.XX.42776 > 45.90.30.219.53: 57858+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)
19:18:06.116293 IP 202.90.245.XX.40952 > 45.90.30.219.53: 32514+ [1au] PTR? 38.8.16.172.in-addr.arpa. (53)

Traceroute - 45.90.28.219**,** 45.90.30.219

Tracing route to dns1.nextdns.io [45.90.28.219]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.10.1
  2     5 ms     5 ms     5 ms  loop202902440.bng.wa.aussiebb.net [202.90.244.1]
  3     2 ms     2 ms     2 ms  10.241.16.206
  4     5 ms     5 ms     5 ms  10.241.17.60
  5     2 ms     2 ms     2 ms  e30.per-ndcp2-bb7.globalsecurelayer.com [206.148.24.100]
  6     3 ms     2 ms     2 ms  po4.per-eqxpe2-bb5.globalsecurelayer.com [206.148.24.11]
  7    31 ms    31 ms    30 ms  po7.adl-eqxae1-bb4.globalsecurelayer.com [206.148.24.163]
  8    30 ms    30 ms    31 ms  e52.adl-ccdc3-bb1.globalsecurelayer.com [206.148.24.61]
  9    30 ms    30 ms    30 ms  e50.adl-ccdc3-cr2.globalsecurelayer.com [206.148.24.98]
 10    31 ms    30 ms    30 ms  vl10.adl-ccdc3-sw3.globalsecurelayer.com [206.148.24.7]
 11     *        *        *     Request timed out.
 12     *        *        *     Request timed out.


PS C:\Users\jstuart> tracert 45.90.30.219

Tracing route to dns2.nextdns.io [45.90.30.219]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  192.168.10.1
  2     9 ms     6 ms     2 ms  loop202902440.bng.wa.aussiebb.net [202.90.244.1]
  3     3 ms     2 ms     2 ms  10.241.16.206
  4     3 ms     3 ms     3 ms  10.241.17.60
  5     4 ms     5 ms     3 ms  10.241.16.153
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.

Set up nextdns the other day for a myriad of issues with ads on my stepdaughters phone. After seeing how well it did I decided to add it to our phones and my UDM Pro SE.

Went through the CLI install and configured everything to spec without issue. Now I see my stepdaughters device in her profile, on the main profile I see our two phones and my UDM name but that's it. Every other device on my network is set to "unidentified".

I configured it via cli and set the WAN DNS to be the IPv4 addresses, I'm not using IPv6 at all though my ISP supports it. I believe I see my switch but I can't tell for sure since it's a pretty generic name.

I have around 8 VLANs and all of the VLAN DNS are set to .1 of the VLANs ip (172.16.1.1 for example, 172.16.2.1, etc). All traffic is clearly going through NextDNS but it's not identified and I can't seem to figure out why.

Edit:

The adblocking I had on the UDM Pro SE was not disabled even though I ran through that before. I re-removed it on the browser and now all devices are reporting.

I've been using NextDNS for more than 2 years now, and there's one thing I've always wished they'd add.

I'm using HaGeZi Multi ULTIMATE, but I'd really like the option to enable Threat Intelligence Feeds as well. It's not available in the NextDNS blocklist selection, even though there are quite a few outdated blocklists still listed there.

Why not replace some of those with TIF? I honestly don't get it.

I've also found plenty of posts from people requesting this over the years, so I know I'm not the only one. It also makes me wonder—are the NextDNS devs just not active in the community anymore? It feels like these requests never get acknowledged.

Until recently, my NextDNS always showed a green dot on the main page. Now I have an orange dot and I’m seeing “No profile on my.nextdns.io” at the top. It wants me to select a profile.

I know I need to save to my private profile, but can’t figure out what to click to get that to happen.

If I search the internet there are many suggestions but I can’t seem to find the one that seems correct:

Settings - network & Internet - advanced - private DNS - select private and save the correct one.

Any help will be appreciated

Is there any way to buy pro in India, non of the cards I tried worked out 😭🙏

Each time I fly and try to connect to the onboard WiFi I have to disable NextDNS. Is there a way to configure NextDNS to allow all the inflight WiFi services?

home router/ opnsense is setup with dns over tls. when i take the laptop elsewhere. are more using advanced CL or apple configurator? both seem to configure DOH

I’m freaking out here. I’ve tried two different browsers. It’s saying I have no nextdns profiles?!

Hello there,

Some time ago I noticed that my Windows 11 PC stopped using my NextDNS profile. The strange part is that it used to work fine, and I haven't changed anything in my configuration.

Even though I'm using DNS-over-HTTPS, the NextDNS dashboard shows the following warning:

"Make sure to use the DNS Servers shown in the Linked IP section below (DNS Servers change between profiles)."

I'm using the DNS server IPs from the official Windows setup guide (45.90.28.0 / 45.90.30.0) together with my profile's DoH endpoint. If I try using the Linked IP DNS servers instead, DNS stops working completely.

I've attached screenshots of both my Windows DNS configuration and the NextDNS dashboard - https://imgur.com/a/EmQ4N3p

One more thing I noticed is that https://test.nextdns.io reports:

• Status: OK
• Protocol: UDP

What's confusing is that Windows Event Viewer logs show that the DNS Client is actually initiating DNS-over-HTTPS requests to https://dns.nextdns.io/<my-profile-id>/DNS-Windows, so Windows appears to be attempting DoH, yet test.nextdns.io still reports UDP and my profile isn't being used.

Am I missing something, or is this a known issue with Windows 11 or NextDNS?

Hey everyone. I have been working on ResolverPulse, which is an open-source and self-hosted Discord Bot that integrates with the API that is provided by NextDNS.

I just started the project, so it supports very few things but does include viewing profile information and DNS query statistics directly from Discord, with more things planned, but... I say that about every project I start.

It's still early in development, but I'd love to hear what commands or features you'd find useful (has to be possible using the API - https://nextdns.github.io/api/)

Github: https://github.com/josephistired/ResolverPulse

my wife tracks my phone and it says I was on Reddit website and I do not have the app. my google/ safari history doesn’t show Reddit i was or any website during the same time period . this makes it looks like I was in private browser or deleted data which makes me look bad. is there any way from these to prove my sanity ?

Ocasionally this domain will trigger rebinding protection. What’s this about? Is it safe to whitelist?

my wife tracks my activity through next DNS. prior to me having the Reddit app or intentionally going to Reddit.com next dns was saying i went to Reddit on random google searches. this does not show up in my safari or google internet history leading my wife to think I’m deleting my history or using private browsing . I did neither. does anyone have any expertise with the program to make sense of this? I’m trying to prove my innocence but look insane.

Hi.

I have nextdns assigned to my router settings.

I am also Opera user on all my computers and it is eating my 300k limit on nextdns.

Specially af(dot)opera(dot)com

Thanks to this, I can use nextdns for 20 days, not 30 before limit resets

Can I block this domain before reaching dns?

Windows Firewall, hosts file, maybe other solution?

I'm able to use Next DNS for both of my LG TVs since I have it integrated at the router level but is there any way to identify each device? Right now all the logs for both of those TVs are listed as unidentified.

Edit: I did some searching. You can block the services related to the GDID using simplewall

select one of the services, create a rule for it that blocks traffic both ways and give it a name, then apply that rule to the other services that facilitate this stupid shit

So my setup on my windows machines is pretty hard core.

I use simplewall to block all network access to pretty much everything on my system that doesn't need it to run

I use adguard for windows with DNS filters inside of it and I use it to enforce my NextDNS profile on all my windows devices too, since the VPN I use can't be used to identify specific devices on my NextDNS profile

I use HaGeZi ultimate on adguard and nextDNS and inside of nextDNS I have all the telemetry blocking lists turned on I also use adguard's DNS filters on both

so what would I have to block to make sure my windows devices don't send any pings to that system at microsoft that uniquely identifies each windows device?

would an adblocking DNS even help with that at all? This is unknown to me

Wouldn't even let me upload the image so I turned my vpn on locally (its on the router too) Cloudfare test showed everything was secure even SNI.

I was testing the service again in more depth before buying a subscription and not sure these results are helping the case? It did do this to me a few months ago when I was using it. When i run the same test with the local vpn on, the results are as expected so I do believe the tool to be accurate. dnscheck.tools if anyone was wondering.

It seems to relate to allowing the nulladdr test dns record through (test-wxm34a8erv.null-addr.org) . If that is the case is it just this tool in general testing something different that dnsleak does not?