nextdns/nextdns
Nextdns
NextDNS is a network DNS client and proxy that functions as a local resolver, forwarder, and DNS-over-HTTPS proxy. Its primary purpose is to route local name resolution requests to external providers using encrypted HTTPS traffic to improve privacy and bypass network restrictions.
The service distinguishes itself by embedding client identity metadata—collected via mDNS or DHCP—into outgoing queries, allowing for per-device tracking and the application of unique filtering profiles. It features advanced routing logic, including split-horizon DNS for balancing public and private resolution, domain-based query steering, and a health-check failover mechanism to automatically reroute traffic during provider outages.
Broadly, the project covers DNS traffic management through TTL rewriting and local hosts file integration, as well as performance optimization via in-memory caching with automatic invalidation. It also includes network management capabilities such as captive portal detection and system time synchronization to ensure certificate validity.
The service can be deployed as a declarative system component in NixOS or integrated directly into home router firmwares.
Features
- DNS-over-HTTPS Relays - Translates standard UDP DNS requests into encrypted HTTPS traffic to improve privacy and bypass network restrictions.
- Encrypted DNS Proxies - Translates standard UDP DNS requests into encrypted HTTPS traffic to secure name resolution and bypass network restrictions.
- DNS Caches - Implements a local DNS cache to reduce resolution latency and minimize redundant external network requests.
- Client Identity Embedding - Collects local network metadata via mDNS or DHCP to tag outgoing queries for per-device policy application.
- DNS Forwarding Routing - Coordinates with local services to handle recursive lookups and specific hostname forwarding.
- Identity-Embedding Clients - Implements a system agent that tags outgoing DNS queries with client identity for per-device filtering.
- Conditional DNS Resolvers - Directs DNS queries to different providers based on the destination domain or the identity of the requesting client.
- DNS-over-HTTPS Clients - Converts standard DNS requests into encrypted HTTPS traffic to secure network queries and bypass local DNS restrictions.
- DNS Filtering - Routes network requests through specific provider configurations to apply custom filtering and security rules.
- DNS Security - Sends network DNS requests over HTTPS to designated providers to improve privacy and security.
- Network Traffic Filters - Intercepts and blocks network requests to specific domains to enforce security rules and privacy settings.
- Filtering Profile Mapping - Enables the application of unique DNS filtering profiles and tracking for individual devices on the network.
- In-Memory Caches - Stores recently resolved DNS records in RAM to reduce latency and minimize redundant external network requests.
- Client Identity Reporting - Sends detailed client identifiers to a service provider to enable per-device tracking and policy application.
- Metadata Collection Mechanisms - Collects and embeds client hostnames via mDNS or DHCP into outgoing network queries.
- Split-Horizon Views - Directs specific queries to different providers based on the destination to balance primary and secondary resolvers.
- Domain-Based Routing - Directs requests to different upstream providers based on the specific domain being queried.
- DNS Forwarding Automations - Automates the setup of DNS forwarding across various router firmwares to secure all devices on a local network.
- Router DNS Integration - Allows securing all connected local devices by forwarding router-level DNS queries to an encrypted provider.
- Conditional Routing - Directs network traffic to different profiles based on the requesting client's identity or network location.
- Identity-Based Policy Assignment - Applies specific DNS configuration settings based on a client's IP address, MAC address, or subnet.
- Provider Failover Mechanisms - Monitors the availability of primary DNS providers and automatically reroutes traffic to backup servers during service outages.
- DNS Failover - Implements automated switching to backup DNS providers when the primary resolver is detected as unavailable.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
