# Any NextDNS users here? **URL:** https://discuss.privacyguides.net/t/any-nextdns-users-here/29972 **Category:** Questions **Created:** 2025-08-12T00:25:09Z **Posts:** 47 ## Post 1 by @iluvprivacy — 2025-08-12T00:25:10Z I just configured Mullvad’s VPN app on both Android and iOS to use NextDNS. The problem is that all the devices’ analytics are lumped together. I can’t figure out how to isolate the analytics pertaining to the correct device. I’m reading that if I could use a secure protocol, the device name would be sent to NextDNS. Neither Mullvad nor Proton’s VPN apps allow me to use secure protocols. I can only enter both IPv6 addresses into the app so that I can use their VPNs, but with NextDNS rather than the VPN’s own DNS. If I can’t get the device information sent to NextDNS’ server, then how can I use Proton/Mullvad and NextDNS and have my device information sent? --- ## Post 2 by @anon57862721 — 2025-08-12T06:54:14Z It is generally not recommended to use custom DNS with your VPN. Beat to always use the VPNs DNS. But if still want to, the only way I can think of is to use different profiles of NextDNS for each device. --- ## Post 3 by @anon16234852 — 2025-08-12T08:45:44Z YogaDNS. > **[NextDNS Support in YogaDNS](https://yogadns.com/docs/nextdns/)** --- ## Post 4 by @iluvprivacy — 2025-08-12T08:51:15Z Why not? I haven’t heard anything bad about that. --- ## Post 5 by @iluvprivacy — 2025-08-12T08:52:34Z Has anyone here heard of RethinkDNS? I’m reading that it can use Proton over Wireguard and NextDNS over DoH? If true, that would be awesome and why aren’t more people doing this?! --- ## Post 6 by @anon16234852 — 2025-08-12T08:54:42Z You can do the same thing with a VPN through that YogaDNS. --- ## Post 7 by @anon16234852 — 2025-08-12T09:09:45Z Read and learn carefully, otherwise it’s better to use a VPN with its own DNS. Here’s a test page, and the status should be OK. [https://test.nextdns.io/](https://test.nextdns.io/) Don’t forget the leak tests. [https://dnscheck.tools/](https://dnscheck.tools/) --- ## Post 8 by @anon32162901 — 2025-08-12T09:40:41Z Not available for iOS though. I use Rethink on Android. It’s quite powerful. Takes a bit of time to configure properly. They really need a “Rethink for Idiots” guide. One of the Rethink devs used to be active here. Not sure why he/she isn’t posting anymore. Had some insightful opinions. --- ## Post 9 by @iluvprivacy — 2025-08-12T09:42:27Z Can you post what your use case is and a rough summary of your configuration? I agree. PG should make one! --- ## Post 10 by @anon57862721 — 2025-08-12T09:44:12Z I didn’t say it’s bad. I said it’s just not ideal. --- ## Post 11 by @anon32162901 — 2025-08-12T09:59:29Z I wasn’t implying that PG should create the guide. I meant the project devs. I use Rethink to split tunnel different apps through different VPN providers. Still learning as I go. This is probably the best place to start; [Guide for rethink DNS? - r/rethinkdns](https://redlib.perennialte.ch/r/rethinkdns/comments/1el0u0q/guide_for_rethink_dns/) See first reply by u/celzero. If the link doesn’t load, replace the domain with a redlib instance of your choice, or the vanilla reddit domain. --- ## Post 13 by @anon16234852 — 2025-08-12T10:46:11Z Here’s a good NextDNS guide for beginners > **[GitHub - yokoffing/NextDNS-Config: Setup guide for NextDNS, a DoH proxy with advanced...](https://github.com/yokoffing/NextDNS-Config)** > > Setup guide for NextDNS, a DoH proxy with advanced capabilities --- ## Post 15 by @anon16234852 — 2025-08-12T10:58:37Z And iOS ![image](https://forum-uploads.privacyguidesusercontent.com/original/2X/b/b5136f73077b219edf5c6afcc9dfb4540984cc94.png) edit. Fingers crossed no one managed to get the code from the first picture, so I don’t have to change the whole account. A mistake’s a mistake. --- ## Post 16 by @iluvprivacy — 2025-08-13T04:49:45Z No Android app. :frowning: --- ## Post 17 by @anon16234852 — 2025-08-13T05:50:15Z > **[How to turn on Android's Private DNS mode - and why turning it off is a big...](https://www.zdnet.com/article/how-to-turn-on-androids-private-dns-mode-and-why-turning-it-off-is-a-big-mistake/)** > > Unencrypted DNS requests can reveal your browsing habits, but Android's Private DNS Mode helps keep that info hidden. Here's how to turn it on. edit. I didn’t bother reading the article. I was only looking for “android private dns”. --- ## Post 18 by @anon32162901 — 2025-08-13T12:44:00Z > [@iluvprivacy](#): > > No Android app. :frowning: Last I checked, the official NextDNS mobile apps were dated. Don’t bother. Just copy-pasta the DNS over TLS address (for Android) or generate a mobile config file (for iOS). There’s a NextDNS Manager app on F-Droid that’s a front-end for the website which you can to monitor logs or analytics. --- ## Post 19 by @iluvprivacy — 2025-08-13T14:24:37Z I want to be able to identify my devices. The setup guide said the app can send it to NextDNS’ server to help identify the devices and the queries. --- ## Post 20 by @anon16234852 — 2025-08-13T14:32:35Z You just add /“name” after the address. --- ## Post 21 by @iluvprivacy — 2025-08-13T14:36:01Z You can’t do that with legacy addresses. --- ## Post 22 by @anon16234852 — 2025-08-13T14:43:41Z Where do u need it? What device? --- ## Post 23 by @muggletummeddlesome — 2025-08-13T16:40:10Z I use ReThinkDNS for exactly this. - Set NextDNS as DoH in the DNS section, make sure to add device name at the end of the doh address. - Then create a wireguard config file from ProtonVPN - Setup the Wireguard proxy and run in Advanced Mode - Select the apps you want using the proxy - In DNS settings select Never Proxy DNS Bam, now you have ProtonVPN and encrypted DNS resolution via NextDNS. They have a pre release version that I’m testing right now that is pretty nice, v055p. I do remember some funkiness with DNA resolution in the current stable version, v055n. Definitely recommend trying it out! This should let you see two entries in your NextDNS analytics (unknown devices - your iphone, and whatever you named your android in the ReThinkDNS doh address) --- ## Post 24 by @iluvprivacy — 2025-08-13T20:58:17Z Unbelievable! I just quickly set up a WG configuration to give it a try and maybe I’ll fine-tune it afterwards if I can get it to work. Well, it works!!! NextDNS is now able to identify my phone making the queries rather than lumping all my devices and queries together under “unidentified devices”. So a major goal has been accomplished and all thanks to you! Now, for me to fully trust this setup, are there any tests that you would recommend I run to validate that the VPN is fully working with no DNS and WebRTC leaks? Privacy and security are very important. How would I interpret those results to know this is working? I only have experience using Proton and Mullvad’s VPN apps with a custom DNS. It’s unfortunate that neither supports using custom DoH/DoQ servers or else I would never have created this thread. Their apps currently only support IPv6 addresses. What is nice about RethinkDNS 0.55p? Do you have any idea how to solve the iPhone’s problem then? Why do I have to run WG in advanced mode? What does “Never Proxy DNS” mean? Before I even try to learn how the firewall feature works, which other WG and DNS settings should I enable or disable? Thanks again!!! --- ## Post 25 by @muggletummeddlesome — 2025-08-14T17:05:32Z I guess for testing you could try observing network requests in termux or using adb (this might require some searching), I’m admittedly not familiar with each. Running the wg proxy in advanced mode allows: 1. VPN tunnelling - per app selection to pick which ones use the WG proxy 2. Forcing the use of your defined DNS for DNS resolution 3. You could run two or more WG configs and assign specific apps to each config like browsers use Mullvad, streaming use Proton or whatever. Simple mode selects all apps and uses the WG config for DNS What does “Never Proxy DNS” mean? - This means only use the DNS you declare in DNS settings. If you have the off I think it allows DNS to use both the WG config DNS or the defined DNS from DNS settings. What’s nice about 055p? - To me, nicer UI, more stable behavior with WG proxy - I’d recommend checking the subreddit. There’s apparently an issue with the VPN lockdown feature, but they just pushed another update yesterday to address this. - They have an experimental relay feature where I guess you can create your own multi hop relay with two WG configs. Haven’t tested that though - Per app / per firewall logging Suggested settings - what im using in 055p Firewall (Universal): - Block when source app is unknown - Block newly installed apps by default - Block when DNS is bypassed DNS: - On device blocklists - Use in-app downloader - Prompt for blocklist updates - Show website icons: ON - Prevent DNS leaks: ON - Never Proxy DNS: ON - DNS Booster: ON Settings: - Enable logs Suggestions for iphone? - Beats me bro, I think that’s up to you to figure out :confused: One note: using this setup will report a DNS leak if you use dnsleaktest. That’s because you’re declaratively using a DNS that is different than your WG server. So when you check your NextDNS profile you will see the real IP address of your device. Further Exploration: If you have more questions they have a matrix channel where people are testing the new releases. Check the GitHub. I know that the developer has been working really hard at this for a while and these are pre-releases but I do think there’s a need for more user-friendly documentation on this. Maybe I’ll reach out to see if I can help with that … Best of luck! --- ## Post 26 by @muggletummeddlesome — 2025-08-14T17:15:57Z Oh also, in the apps setting of rethinkdns go through your apps and toggle off mobile and wifi access for shit that doesn’t need it (calculator, some system apps) If some apps are being assholes with your firewall you can exempt them here as well. --- ## Post 27 by @falcon — 2025-08-14T19:34:43Z > [@muggletummeddlesome](#): > > Show website icons Testing with this option enabled will also show an extra IP address not belonging to your DNS. --- ## Post 28 by @iluvprivacy — 2025-08-14T19:37:15Z I’m always curious as to why the calculator app needs Internet access. Potential source for spying? I think PG or someone truly experienced like you should make a guide for newbies like us! I’m just shocked that neither Mullvad/Proton is very interested in allowing the use of custom secured DNS within their apps. It makes no sense. I’ve already emailed them a few times over the years and no changes have been made. Is there a Rethink equivalent on iOS? What about on the desktop? --- ## Post 29 by @muggletummeddlesome — 2025-08-14T21:52:24Z Well shit, I guess I’ll disable that one! --- ## Post 30 by @muggletummeddlesome — 2025-08-14T22:07:39Z I appreciate that my answer helped you out, but I’m no expert, lol. Just another newbie with a high tolerance for trial and error! Fwiw, seems like proton is working on it for iOS: [Proton VPN summer roadmap: Exciting new features for Linux and macOS | Proton VPN](https://protonvpn.com/blog/vpn-roadmap-summer-2025) For desktop check out the PG recommendations: - [DNS Resolvers - Privacy Guides](https://www.privacyguides.org/en/dns/) - You can throw NextDNS onto a router directly for network wide protection. - Or use a SBC to run AdGuard Home/PiHole and find a way to setup a VPN on your router. Lots of different means/methods to wrangle DNS, lean into some different options, test, and have fun learning! I break my home network at least weekly experimenting and my partner…. still loves me! --- ## Post 31 by @iluvprivacy — 2025-08-14T23:08:59Z I looked at the roadmap, but I don’t see what you’re referring to. --- ## Post 32 by @muggletummeddlesome — 2025-08-15T01:24:44Z There’s a section under “what’s coming this summer” where they announce Custom DNS for macOS, iOS, and iPadOS --- ## Post 33 by @iluvprivacy — 2025-08-15T04:20:06Z Custom DNS is already available on iOS. They only accept IPv4 addresses though. :frowning: --- ## Post 34 by @anon16234852 — 2025-08-15T06:03:26Z You don’t need a custom DNS setting for anything. For Windows there’s YogaDNS, for Android Private DNS, and for iOS you just create a profile. All of these work with a VPN. edit. Ideally, it would be good to have one, but there are ways to manage until then… edit2. I remembered that iOS is the same as Android. My bad. --- ## Post 35 by @anon32162901 — 2025-08-15T13:58:17Z True for Android where the Private DNS setting has authority over all DNS queries, but on iOS/iPadOS, activating your VPN tunnel overrides the DNS mobileconfig and uses whatever DNS server is specified in the tunnelling app (usually the VPN provider’s own DNS servers by default). OP’s issue is with the iOS Mullvad app only accepting legacy IPv4/IPv6 addresses for custom DNS servers instead of encrypted DoH/DoT domains. Personally I don’t have an issue with that (since you’re already trusting the VPN provider with your traffic anyway) but it’s what the OP wants. --- ## Post 36 by @anon16234852 — 2025-08-15T15:16:16Z I’m on Android myself and I thought it was the same on iOS. I was wrong about that. --- ## Post 37 by @iluvprivacy — 2025-08-15T15:34:39Z Exactly, and I thought that was the same issue with Android too? Is the other guy correct where if I change the private DNS and use Mullvad VPN, Android will override Mullvad’s DNS and utilize NextDNS? --- ## Post 38 by @anon32162901 — 2025-08-15T15:47:03Z Yes, in my experience that’s how it works on Android. You can test it out yourself. Input the DoT domain you get in your NextDNS control panel into Android’s Private DNS section. Then connect to a Mullvad server, launch a browser and visit [test.nextdns.io](http://test.nextdns.io) to check. You can also check on sites like [https://dnscheck.tools](https://dnscheck.tools) where you should see something like dns.nextdns under the DNS resolvers section. --- ## Post 39 by @iluvprivacy — 2025-08-15T16:07:29Z What the heck? I’ll test this out. I’m surprised this isn’t mentioned more often. Very exciting news if true. Sucks that Android doesn’t support DoH or DoQ. Why? DoT is better than nothing, but in 2025, I want to aim for DoH or DoQ. --- ## Post 40 by @iluvprivacy — 2025-08-15T16:30:24Z Wow, you’re right, I think it does work. I’ve never heard of dnscheck.tools, please help me out. I see two IP addresses after finishing the test. The first entry appears to be IPv4. The second looks like IPv6? Why would I have two IP addresses? I see “ptr: [dns.nextdns.io](http://dns.nextdns.io)”. What does ptr mean? I’ve passed all the signature tests for both Firefox (246ms EDNS DNSSEC IPv6) and Brave (56ms EDNS DNSSEC IPv6) on Android, but there is a huge difference in response time. Why? --- ## Post 41 by @iluvprivacy — 2025-08-15T16:45:11Z I would prefer using Android’s Private DNS over RethinkDNS until I fully understand that app. However, I have noticed some things while testing things out. I’m using Mullvad VPN’s app with NextDNS as mentioned earlier. The custom DNS option was still enabled in the app despite enabling Android’s Private DNS. Will this cause any problems like a DNS leak? The test does say no, but I do have two instances running. I want a set-and-forget setup. I don’t mind disabling the custom DNS in Mullvad’s app and then turning off all the features in Mullvad’s VPN app since you said Android will override Mullvad’s DNS while using Mullvad’s VPN. I am still a little worried that with an extra complication or step in this process that my privacy and security could somehow be compromised. Sort of like an increased attack surface area. On a 5G cellular connection, everything seems to be fine. My home has two WiFi networks. One is from the ISP-supplied modem/router. The DNS test also seems to validate that things are ok. There is a problem when connecting to my GL.iNet router. That router is set up to use Adguard Home, where the upstream DNS server is using Quad9. As soon as my phone connects to the GL.iNet router, I get an error notification. It says the “Private DNS server cannot be accessed”. If I disable Android’s Private DNS, then everything is ok again. It’ll be inconvenient having to disable and enable Android’s Private DNS depending on which WiFi network or cellular connection I use. How do I address this and better optimize this setup? Is RethinkDNS the best long-term solution? --- ## Post 42 by @anon16234852 — 2025-08-15T17:03:56Z I don’t get why there are so many different services and why you make things so complicated. --- ## Post 43 by @anon32162901 — 2025-08-15T17:45:58Z @iluvprivacy Will attempt to answer as best as I can, although bear in mind that I am far from an expert. 1. No, I don’t think having any custom DNS settings in the Mullvad Android app will be an issue. As far as I know, Android will always override that with its Private DNS setting. 2. PTR = Pointer Record. Used for reverse DNS lookups. Basically, it’s used to map a domain to an IP address. 3. Depending to which NextDNS server you’re assigned/anycasted to, you may get both IPv4 and IPv6 DNS servers. As long as the PTR points to a [nextdns.io](http://nextdns.io) server(s), you’re good. 4. I have never used AdGuard Home, so can’t offer much insight. My only suggestion is to add [nextdns.io](http://nextdns.io) to its whitelists, or better still, exempt that Android phone from AdGuard Home filtering via MAC address or device IP, if possible. 5. I do agree with @anon16234852 on your setup being overcomplicated. You seem to have too many “layers” all attempting to do the same thing. Try to streamlime stuff a bit. You know, K.I.S.S and all that. 6. Rethink DNS/Firewall would indeed be a great solution since you can use multiple VPN configs each tied to different DNS resolvers and dedicate them to different apps if you desire, but it’s a convoluted application and I’m far from the best person to ask for guidance since I’m still learning it myself. Also, your issues with AdGuard Home are bound to overcomplicate things even further. Hope this helps. --- ## Post 44 by @iluvprivacy — 2025-08-15T17:51:50Z I agree that I will have to simplify things, but keep in mind how I got here with someone saying Android’s Private DNS. It’s not like I just experienced a problem all of a sudden. I just thought I would give what you said a try. Everything was working more or less perfectly. Are you saying Rethink can use multiple VPNs simultaneously? I thought Android could only use one at a time? --- ## Post 45 by @anon16234852 — 2025-08-15T18:02:33Z ![image](https://forum-uploads.privacyguidesusercontent.com/original/2X/8/83cc38e558c2ed815329106a9e5fc05f31112ad0.png) --- ## Post 46 by @muggletummeddlesome — 2025-08-15T18:37:32Z Correct, in advanced mode on ReThinkDNS you can enable more than one WG proxy to use multiple vpns at once. An alternative would be to enable Android private space or a work profile. Each of those also gets you an additional VPN slot. My current setup/use case on Android (Pixel with vanilla Android) Primary profile - general use applications, uses Rethinkdns to: 1. Enable per-app firewalling to prevent unnecessary network access for certain apps (system apps/calculator/locking down mobile data access) 2. Enable per app domain firewalls. I noticed too many apps making calls to `graph.facebook.com`and was able to block those on a per app level with domain firewalls 3. Block stealth DNS. 4. Add on-device blocklists (Hagezi multi pro) and use NextDNS as a fallback 5. Do all of this while using a WG VPN config. Work Profile (no Google account added here) - streaming and self hosted services 1. All streaming apps on this profile, plus web apps for my self hosted services (AdGuard, FreshRSS, Stirling PDF) 2. Use Tailscale as always on VPN 3. Use Zimaboard on home network as Tailscale exit node 4. Set Tailscale DNS to use AdGuard Home on my Zimaboard Android Private Space - again, no Google account here, mostly for browsing / Wikipedia rabbit holes, etc: 1. Proton VPN always on with multi hop 2. A few browser apps Admittedly, this isn’t really a KISS approach but it’s what I’ve found works for me right now. --- ## Post 47 by @iluvprivacy — 2025-08-16T04:24:30Z I’m noticing an issue with using a device identifying string and Android’s Private DNS. When I use this “Google–Pixel–7–[xxxx.dns.nextdns.io](http://xxxx.dns.nextdns.io)”, it shows up as Google Pixel 7- in NextDNS. I used a double dash to represent a space. What’s going on?