# NextDNS (free) security after 300K queries **URL:** https://discuss.privacyguides.net/t/nextdns-free-security-after-300k-queries/15025 **Category:** General **Created:** 2023-11-14T18:54:59Z **Posts:** 25 ## Post 1 by @anon21489307 — 2023-11-14T18:54:59Z I find myself using Quad9 instead of NextDNS due to the fact that NextDNS’s free tier is limited to **[300,000 queries per month](https://nextdns.io/pricing#:~:text=300%2C000%20queries%2Fmonth1)**, after that I will be left unprotected. I may never reach this limit, but it’s still something that bother me, and it might actually happen for whatever reason. This is a security flaw in my opinion. Also, all the benefit I would get with NextDNS is tided to my user account. If I want to use the service anonymously, I only have 7 days to fine tune the settings. After this period, a minor adjustment would require a new setting altogether. **EDIT:** If you’re not carefully look into the settings, logging is opt-out, not opt-in. And since you’re bound to 7 days limit with anonymous setup, there’s no way to check whether the logging is enabled :sweat_smile: --- ## Post 2 by @Valynor — 2023-11-14T19:18:22Z You can’t really compare Quad9 and NextDNS, though. From the two only NextDNS is blocking a large portion of ads and trackers. NextDNS after 300k queries is basically what Quad9 is like _all_ the time (not quite true, they block some known malware sites but no ads or trackers). --- ## Post 3 by @filen — 2023-11-14T19:22:21Z Quad9 ain’t on NextDNS’s level tho. Correct me if i’m wrong ? NextDNS just does a better job with much more servers around the world --- ## Post 4 by @Valynor — 2023-11-14T19:29:16Z I think Quad9 has a a very good number of servers all around the planet, too. They only block the worst malware/phishing domains though, Quad9 was created for different reasons (mainly free/secure/private/uncensored DNS for everyone). --- ## Post 5 by @anon21489307 — 2023-11-14T19:30:41Z > [@Valynor](#): > > NextDNS after 300k queries is basically what Quad9 is like _all_ the time (not quite true, they block some known malware sites but no ads or trackers). No, it’s not the same as Quad9. This is stated on NextDNS website: _“When exceeding the free monthly quota, NextDNS will continue to answer DNS queries like a classic non-blocking DNS service.”_ Basically, after 300k, NextDNS _does nothing at all_ (otherwise, you won’t be able to connect to the internet). For ads and trackers, I have a browser solution as an alternative. --- ## Post 6 by @Valynor — 2023-11-14T19:32:32Z > [@anon21489307](#): > > Basically, after 300k, NextDNS _does nothing at all._ It still works as a reverse DNS. It just doesn’t block anything. If you don’t click weird links blindly Quad9 will probably never block any URL for you. --- ## Post 7 by @anon21489307 — 2023-11-14T19:38:46Z > [@Valynor](#): > > Quad9 will probably never block any URL for you According to **[a recent test from Lawrence Systems](https://youtu.be/NUT4K3tk9Ns?si=PO5WnZ1_1DdJ8Kvb&t=310)**, Quad9 actually blocked a lot of malicious URLs :sweat_smile: --- ## Post 8 by @Valynor — 2023-11-14T19:52:30Z I’m not saying Quad9 does a bad job but in my day to day surfing I’m not visiting any malware/phishing domains. I don’t even know when a website was blocked the last time, has to be years. NextDNS is much more “tangible” in every day use from the huge amount of ads/trackers it blocks (+malware sites etc. on top). --- ## Post 9 by @xe3 — 2023-11-15T00:21:50Z As others have pointed out, NextDNS and Quad9 are not comparable services. Both are great privacy respecting DNS services, but that is where the similarity ends. If you want _just_ a DNS with a security blocklist Quad 9 is a great option. NextDNS appeals more to people who want more control and fine tunability as well as adblocking. > Also, all the benefit I would get with NextDNS is tied to my user account. You seem reluctant to use a user account or to enable logging and analytics. Which is fine, and reasonable, but NextDNS appeals to and is mostly intended for people who specifically want the features that a user account enables. If you don’t want that Quad9 or Adguard or Mullvad is a better alternative with no limits, but also a lot less features and customizability. > If I want to use the service anonymously I think that is a unrealistic expectation with either NextDNS or Quad9 or any other traditional DNS whether it has an account or not. The absence of a user account does not make you anonymous. Every time you query Quad9 or NextDNS you are giving them your IP Address + the domain you queried. This is the case with or without an account, and the way I see it, your IP is a much more sensitive piece of info than some non-personal account credentials or an email alias. Don’t let not having an account fool you into thinking DNS is anonymous or private, it is not, and a no logs policy means they don’t _store_ that sensitive data, not that they don’t or can’t see it. > **As to the Lawrence Systems test** > > > [@anon21489307](#): > > > > According to **[a recent test from Lawrence Systems](https://youtu.be/NUT4K3tk9Ns?si=PO5WnZ1_1DdJ8Kvb&t=310)**, Quad9 actually blocked a lot of malicious URLs :sweat_smile: > > Both NextDNS and Quad9 were very effective in those tests, BUT that test is testing against a list made up of purely _known/suspected malicious domains_ so of course it will block a lot. What Valynor said is correct in my eyes, if you have moderately safe browsing habits, you are unlikely to encounter these type of domains too often. > > That said, considering the cost/benefit, I definitely prefer the strongest anti malware/phishing blocking I can have, we all get lazy or impulsive occasionally, best to have more layers of defense than relying on self-discipline alone. Quad9 is a great option if all you care about is security (dont care about adblocking or a control panel / logging / analytics). > > One reason I do really appreciate NextDNS and its logging, is that I can see real world stats for _my own_ browsing. I can tell you that of 150K total queries, 9K were blocked, and of that 9K only 9 requests were blocked for security reasons, and those 9 were all a single domain that appears to have been a false positive according to virustotal. --- ## Post 10 by @anon21489307 — 2023-11-15T02:31:07Z > [@xe3](#): > > As others have pointed out, NextDNS and Quad9 are not comparable services. Both are great privacy respecting DNS services, but that is where the similarity ends. Both are comparable IMO since both are DNS resolver services with differences in the feature sets. Otherwise, we wouldn’t see many comparisons online. However, not both of them are respecting users privacy due to the fact that _only NextDNS logs users IPs and domains by default (opt-out)_, while Quad9 doesn’t log any identifiable user data. Moreover, NextDNS’s privacy policy #3 could be the most confusing privacy policy I have ever read. They said, _“If not specifically requested by the user, no data is logged…”_. If only by this statement, I would assume that the logging is opt-in, but it’s opt-out, though :sneezing_face: > [@xe3](#): > > You seem reluctant to use a user account or to enable logging and analytics. Of course, we’re talking about privacy, after all. How could I am not reluctant about having to create my account or feeling good about having my log _on the cloud_? :sweat_smile: > [@xe3](#): > > I think that is a unrealistic expectation [using the service anonymously] with either NextDNS or Quad9 or any other traditional DNS whether it has an account or not… Every time you query Quad9 or NextDNS you are giving them your IP Address + the domain you queried. The problem is logging, as explained on above. Whether I have to send them my IP and domain is not relevant here, as long as they’re not logging me. Unfortunately, NextDNS is happily logging you by default, while you don’t even have an option to have Quad9 logging you. > [@xe3](#): > > the way I see it, your IP is a much more sensitive piece of info than some non-personal account credentials or an email alias. I prefer to use any service as anonymously as much as possible. Having to give my email (even if it’s just an alias) instead of just saving a link, which is uniquely identifiable to my setup anyway, is not my cup of tea. My point is that NextDNS seems to love my personal info for no appearance reason. > [@xe3](#): > > Both NextDNS and Quad9 were very effective in those tests [**[a recent test from Lawrence Systems](https://youtu.be/NUT4K3tk9Ns?si=PO5WnZ1_1DdJ8Kvb&t=310)**], BUT that test is testing against a list made up of purely _known/suspected malicious domains_ so of course it will block a lot. I am not even sure whether both you and Valynor actually watch the test result. Otherwise, you wouldn’t keep saying that both of them are good at blocking sites, both of them are doing the same thing, etc. Even with the testing list that made up of purely _known/suspected malicious domains_ like you said, **NextDNS lets those domains in at a whopping number at 33.11% out of 8,333 domains tested!!!** About the same as Cloudflare 1.1.1.1 (unblocked setting). While only 0.79% of the domains survive Quad9 blocking. * * * I am not here to defense for Quad9 or to attack NextDNS. I am here to expose my concern to _the fact_ regarding my security and privacy when using NextDNS. It’s not even my debate. I didn’t even debate anything until this post. Having a 300,000 queries per month limit along with an inability to know whether I am getting log (after 7 days) is a “tangible” downside in my every day usage with NextDNS. Ads and tracking can be mitigated by Brave Shield that I use, plus Brave show me how many ads I blocked without cloud logging. --- ## Post 11 by @xe3 — 2023-11-15T03:01:57Z > [@anon21489307](#): > > I am not even sure whether both you and Valynor actually watch the test result. Otherwise, you wouldn’t keep saying that both of them are good at blocking sites, both of them are doing the same thing, etc. Even with the testing list that made up of purely _known/suspected malicious domains_ like you said, NextDNS lets those domains in at a whopping number at 33.11% He posted [a followup / correction video](https://youtu.be/RIu9aXWn5Xo?si=zuKqA2JT6SzSkpL9) that it sounds like you may not have seen yet. NextDNS with a profile scored 100%, the best of the bunch. --- ## Post 12 by @anon21489307 — 2023-11-15T03:07:37Z > [@xe3](#): > > He posted [a followup / correction video](https://youtu.be/RIu9aXWn5Xo?si=zuKqA2JT6SzSkpL9) that it sounds like you may not have seen yet. NextDNS with a profile scored 100%, the best of the bunch. Which is not related to our conversion here or my conversion with Valynor on the above. We’re not talikng about the maximum setting on NextDNS. We’re talking about my concern regarding what it will do after the 300,000 queries per month limit. That’s the reason why I shared the non-follow up test in the first place. --- ## Post 13 by @Valynor — 2023-11-15T03:11:35Z You really are nitpicking here, IMHO. NextDNS losing at this comparison without block lists is uh .. not a surprise? Also you can look up how many queries you are doing per month in your [account](https://my.nextdns.io/account). I usually do about 150k, with several devices, so I can quite confidently say that I will not reach 300k, period. There is a really simple way to prevent running into the 300k limit and it will only cost you $2 per month. --- ## Post 14 by @anon21489307 — 2023-11-15T03:22:57Z > [@How is a NextDNS account private?](https://discuss.privacyguides.net/t/how-is-a-nextdns-account-private/14018/21): > > NextDNS losing at this comparison without block lists is uh … not a surprise? I thought you would be surprised since you said _“NextDNS after 300k queries is basically what Quad9 is like all the time”_. That’s the reason I shared the test. It’s the test I watched sometime ago and remember the result. It’s a good example showing how NextDNS would perform after 300k limit. Whether I could reach that limit is another matter entirely. --- ## Post 15 by @xe3 — 2023-11-15T03:31:47Z I think NextDNS is just not right for you, which is fine. It seems like you (1) don’t want a DNS that requires any configuration (2) don’t want a query limit but also prefer not to pay (3) don’t really care about the control NextDNS offers. If that’s true, I think Quad9 is a great choice for you, much better than NextDNS for what you want. Another option would be self-hosting (e.g. Pi-Hole or Adguard Home) --- ## Post 16 by @anon21489307 — 2023-11-15T03:47:29Z 1. Configuration is fine. But it should be a good default configuration. Logging by default, which seems to contrary to the service’s privacy policy itself, is not a good default in my opinion. 2. Yes, I really don’t want to pay if it’s possible :sweat_smile: I believe that a paywall service would essentially make it harder for me to recommend it to my family and friends to use, especially in the DNS resolver market that many good free options are available. 3. I do care about what NextDNS offers. But I prefer to use it freely without any limitations, anonymously _as much as possible_ (not having to create any account), and the most importantly, not logging any of my usage on the cloud (this would make their dashboard/analytic a con/to avoid feature to me). Quad9 that has a good malicious site blocking + Brave Shield to block ads and tracking _locally_. This setup seems to work for me currently. --- ## Post 17 by @jonah — 2023-11-15T04:06:33Z I’m kind of inclined to agree with you. I think we’ll remove NextDNS from the general list of generic DNS providers and add it to a new category of “cloud-based custom filtering providers,” seeing as we probably wouldn’t recommend the free version of NextDNS in the first place over the other 5 options. > > > Changes proposed in this PR: > > - https://discuss.privacyguides.net/t/split-dns-…recommendations-into-secure-non-filtering-providers-and-filtering-saas-providers/15026?u=jonah > > Additional changes: > > - Remove NextDNS until their privacy policy reflects their current defaults: https://discuss.privacyguides.net/t/nextdns-logging-is-opt-out-not-opt-in-as-stated-on-pgs-dns-resolvers-recommendations-page/17206/31 > - Add dns0.eu https://discuss.privacyguides.net/t/dns0-dns-provider/12231 > - Closes #2430 > > > > > - [x] I have disclosed any relevant conflicts of interest in my post. > - [x] I agree to grant Privacy Guides a perpetual, worldwide, non-exclusive, transferable, royalty-free, irrevocable license with the right to sublicense such rights through multiple tiers of sublicensees, to reproduce, modify, display, perform, relicense, and distribute my contribution as part of this project. > - [x] I am the sole author of this work. > - [x] I agree to the [Community Code of Conduct](https://www.privacyguides.org/en/code_of_conduct/). --- ## Post 18 by @anon90831229 — 2023-11-15T14:07:54Z [ZERO — Hardened security for highly sensitive environments — dns0.eu](https://www.dns0.eu/zero) is from NextDNS and completely free to use. However there are only servers inside the EU, that might be good or bad for you. It does not offer customization but has a lot of the categories already activated, so as a general more secure DNS it might be what you’re looking for. --- ## Post 19 by @Valynor — 2023-11-15T14:26:23Z > [@anon21489307](#): > > Quad9 that has a good malicious site blocking + Brave Shield to block ads and tracking _locally_. Brave is using Google’s Safe Browsing list which should have pretty much all of the malicious sites in it anyway. Where NextDNS really shines is that it can extend this protection to all of your device (esp. important on mobile devices). While e.g. a malicious mobile app might contact a malicious/phishing site many apps and the OS itself contact trackers and ad servers all the time and that’s where NextDNS really can make a difference. --- ## Post 20 by @FlipSid — 2023-11-15T16:19:46Z Using the 2$ Version of nextDNS at the Moment for testing. Some things just cost $$$, which i am fine with. So far so good. Opt Out of logging but: Maby I will opt back in to see w h a t is beeing blocked. Because it will show you what trackers etc if you do. Then opt back out. > [@How is a NextDNS account private?](https://discuss.privacyguides.net/t/how-is-a-nextdns-account-private/14018/4): > > An account is less identifiable than the information any DNS resolver will already have regardless of whether there is an account or not. A DNS service will necessarily know (1) Your IP Address (2) The domains you request. Using a DNS service, nextDNS or otherwise, involves some trust. Don’t let not requiring an account give you a false sense of anonymity, any DNS service can log your queries. As to why NextDNS uses accounts, it is for the more advanced/custom features it allows. (Optional) Log… This pretty much sums it up. --- ## Post 21 by @Valynor — 2023-11-15T16:33:20Z > [@FlipSid](#): > > Maby I will opt back in to see w h a t is beeing blocked. Because it will show you what trackers etc if you do. I use 1 day log retention, you kind of need some logging so you can see when a site breaks (it happens occasionally). --- ## Post 22 by @FlipSid — 2023-11-15T16:45:37Z Will try that setting. Thank you:) --- ## Post 23 by @xe3 — 2023-11-16T02:41:40Z > [@Valynor](#): > > I use 1 day log retention, you kind of need some logging so you can see when a site breaks (it happens occasionally). There was another service (I don’t recall which, probably ControlD or Adguard Private DNS) which gave users control of separate retention policies for _logs_ and _statistics/analytics_ which I thought was pretty cool (depending on how it’s implemented of course). The value I see in this is you can set _logs_ to be discarded after a short period, something like 1 day, but retain accurate _statistics_ for a longer timeframe. This seems like a really intelligent middleground, that allows making the most of the analytics and stats without having to keep months worth of logs of every site you visit. Obviously still not as private as no logs at all, or self-hosting, but it seems like a great option to have. --- ## Post 24 by @FlipSid — 2023-11-17T14:15:58Z Running 1 day log retention is nice. Since, i can block or allow more precise :+1:t5: --- ## Post 25 by @silverfaze — 2024-11-11T03:11:53Z What is your definition of anonymous? If you think it means you doing something and they wont be able to track it? You better use a tor service instead. Nothing is anonymous on the internet. So far it connects to something it can be tracked back to you… even VPN