How to use NextDNS to block ads on every device

NextDNS is one of the simplest ways to block ads and trackers across a messy modern home: iPhones, Android phones, Macs, Windows laptops, Linux machines, smart TVs, browsers, and routers that all behave slightly differently.

Think of it as a cloud version of Pi-hole. Instead of installing a box on your network, you create a NextDNS profile, turn on the blocklists and security features you want, then point each device or router at your personal DNS endpoint.

The important part is this: there is no single setup method that is perfect for every device. A router setup covers the house. A phone profile covers mobile data. Browser DNS-over-HTTPS covers browsers that ignore system DNS. The best setup is layered, but not complicated.

What NextDNS can and cannot block

NextDNS blocks at the DNS level. When a device asks for an ad, tracker, malware, or telemetry domain, NextDNS can refuse to resolve it. That works well for many web ads, app trackers, smart TV telemetry, known malware domains, phishing domains, and unwanted services.

It does not remove every ad on the internet.

What works well	What is harder
Ads and trackers served from separate domains	YouTube video ads and other first-party ads
App telemetry and known tracking SDK domains	Cosmetic blank spaces where ads were blocked
Malware, phishing, typosquatting, cryptojacking domains	Apps that hardcode their own DNS or use VPN tunnels
Whole-network blocking through a router	Devices outside the house unless they have their own profile
Per-device logs and allow/deny rules	Breaking nothing while using aggressive blocklists

The right expectation is cleaner browsing, quieter apps, better privacy visibility, and fewer junk requests. It is not a magic ad eraser.

Start with a NextDNS profile

1. Go to my.nextdns.io.
2. Create or open a configuration.
3. Copy your profile ID from the Setup tab. In this guide, it is shown as PROFILE_ID.
4. In the Privacy tab, enable an ads and trackers blocklist. Start with one mainstream list before stacking several aggressive ones.
5. In Security, enable protections such as threat intelligence feeds, Google Safe Browsing, DNS rebinding protection, IDN homograph protection, typosquatting protection, and newly registered domain blocking if you want stricter protection.
6. Use Allowlist for sites or apps that break.
7. Use Logs while tuning, then choose a retention period you are comfortable with, or disable logs if you want a stricter privacy setup.

Useful endpoints:

Type	Endpoint
DNS-over-HTTPS	https://dns.nextdns.io/PROFILE_ID
DNS-over-TLS	PROFILE_ID.dns.nextdns.io
Plain IPv4 DNS	Shown in your NextDNS Setup tab, often using NextDNS anycast addresses
Test page	https://test.nextdns.io

Plain IPv4 DNS cannot carry your profile ID by itself. NextDNS handles that with Linked IP, which associates your current public IP address with a profile. That is useful for routers, but it can break when your ISP changes your IP unless you refresh the link or use Dynamic DNS.

Encrypted DNS is cleaner when the device supports it.

Android

Android has the easiest native setup because Private DNS supports DNS-over-TLS.

1. Open Settings.
2. Go to Network & internet.
3. Open Private DNS. On some phones, this is under Connections or More connection settings.
4. Choose Private DNS provider hostname.
5. Enter:

PROFILE_ID.dns.nextdns.io

6. Save.
7. Visit https://test.nextdns.io in a browser and check the NextDNS dashboard logs.

Samsung phones usually place the same option under:

Settings -> Connections -> More connection settings -> Private DNS

Notes:

• This should work on Wi-Fi and mobile data.
• If the phone uses a VPN, the VPN may override DNS.
• If you want a visible toggle, use the official NextDNS Android app, but the native Private DNS path is usually cleaner.

iPhone and iPad

For iOS and iPadOS, NextDNS recommends Apple configuration profiles because they use Apple’s native encrypted DNS support.

1. Open apple.nextdns.io on the device.
2. Enter your NextDNS profile ID.
3. Choose a device name if you want logs grouped cleanly.
4. Generate and download the .mobileconfig profile.
5. Open Settings.
6. Tap Profile Downloaded.
7. Install the NextDNS profile.
8. Check https://test.nextdns.io.

You can also use the NextDNS iOS app from the App Store. The profile method is neater for most people because it behaves like a system-level DNS setting rather than a VPN-style toggle.

If you enable a custom block page and want it to load cleanly over HTTPS, NextDNS documents a separate Root CA installation flow at https://nextdns.io/ca. Most people do not need this for basic ad blocking.

macOS

Mac users have three good choices.

The simple Apple-native method:

1. Go to apple.nextdns.io.
2. Generate a macOS profile with your profile ID.
3. Install it in System Settings.
4. Confirm it under Profiles.
5. Test with https://test.nextdns.io.

The official GUI app method:

1. Install the NextDNS app from the Mac App Store.
2. Open the app menu.
3. Go to Preferences.
4. Enter your configuration ID as a custom config.
5. Click Connect.

The CLI method, useful for technical users:

brew install nextdns/tap/nextdns
sudo nextdns install \
  -config PROFILE_ID \
  -report-client-info \
  -auto-activate

Use nextdns log if you need to troubleshoot.

Windows

The official Windows app is the easiest path.

1. Download the official Windows app from:

https://nextdns.io/download/windows/stable

2. Install it.
3. Right-click the NextDNS icon in the system tray.
4. Open Settings.
5. Enter your configuration ID.
6. Right-click the tray icon again and enable NextDNS.
7. Test with https://test.nextdns.io.

There is also a CLI install path. Open Command Prompt or PowerShell as Administrator and run:

iwr https://nextdns.io/install -OutFile $env:TEMP\n.ps1;& $env:TEMP\n.ps1

Follow the prompts and enter your profile ID.

On Windows, browser-level Secure DNS can still matter. Chrome, Edge, Brave, Firefox, and other browsers may use their own DNS-over-HTTPS setting instead of the system resolver.

Linux

For Linux, NextDNS’s official CLI is the cleanest option. It runs a local DNS proxy and points the system at it.

The universal installer works on most distributions:

sh -c 'sh -c "$(curl -sL https://nextdns.io/install)"'

You will need your PROFILE_ID during setup.

Useful commands after installation:

nextdns status
nextdns log
sudo nextdns restart
sudo nextdns activate
sudo nextdns deactivate

Debian, Ubuntu, Linux Mint, Raspberry Pi OS

Quick path:

sudo apt-get install curl
sh -c "$(curl -sL https://nextdns.io/install)"

Manual package path:

sudo wget -qO /usr/share/keyrings/nextdns.gpg https://repo.nextdns.io/nextdns.gpg
echo "deb [signed-by=/usr/share/keyrings/nextdns.gpg] https://repo.nextdns.io/deb stable main" | sudo tee /etc/apt/sources.list.d/nextdns.list
sudo apt install apt-transport-https
sudo apt update
sudo apt install nextdns

Then configure a workstation:

sudo nextdns install \
  -profile PROFILE_ID \
  -report-client-info \
  -auto-activate

For a Linux box acting as a router:

sudo nextdns install \
  -profile PROFILE_ID \
  -report-client-info \
  -setup-router

Fedora, RHEL, CentOS, Rocky, AlmaLinux

Quick path:

sh -c "$(curl -sL https://nextdns.io/install)"

Manual RPM repository path:

sudo curl -Ls https://repo.nextdns.io/nextdns.repo -o /etc/yum.repos.d/nextdns.repo
sudo yum install -y nextdns

On Fedora you can use dnf instead of yum:

sudo dnf install -y nextdns

Then:

sudo nextdns install \
  -config PROFILE_ID \
  -report-client-info \
  -auto-activate

Arch and Manjaro

The universal installer works:

sh -c "$(curl -sL https://nextdns.io/install)"

Or install from the AUR:

yay -S nextdns

Then:

sudo nextdns install \
  -profile PROFILE_ID \
  -report-client-info \
  -auto-activate

openSUSE and SUSE-family systems

NextDNS lists openSUSE under the installer-supported platforms, so use the universal installer first:

sh -c "$(curl -sL https://nextdns.io/install)"

Then choose the install/configure path and enter your profile ID. Afterward, check:

nextdns status
nextdns log

If your desktop uses NetworkManager, systemd-resolved, or another DNS manager, test after a reboot. Linux DNS stacks vary, and the CLI is usually easier than trying to manually wire every resolver file.

Routers

Router-level setup is the best way to cover devices that do not let you install profiles: smart TVs, consoles, printers, speakers, guest devices, and IoT hardware.

There are two router strategies.

Router method	Best for	Tradeoff
Plain DNS in router DHCP/WAN settings	Basic coverage on almost any router	Usually unencrypted and may need Linked IP
NextDNS CLI on router firmware	Better logging, encrypted DNS, client names	Requires compatible firmware and SSH access

Generic router DNS

1. Open your router admin page.
2. Find Internet, WAN, DHCP, or LAN DNS settings.
3. Enter the IPv4 DNS servers shown in your NextDNS Setup tab.
4. In the NextDNS dashboard, link your current IP if using plain IPv4 DNS.
5. Reconnect a client device or renew DHCP.
6. Test with https://test.nextdns.io.

This is the fallback method. It is good enough for many homes, but it is weaker than encrypted DNS and may lose profile association when your public IP changes.

OpenWrt

SSH into the router, then:

opkg update && opkg install curl
sh -c "$(curl -sL https://nextdns.io/install)"

On OpenWrt 19.07.01-rc2 and newer, NextDNS also documents a LuCI package route:

System -> Software -> Update lists -> install luci-app-nextdns
Services -> NextDNS

AsusWRT-Merlin

1. In the router GUI, go to Administration.
2. Open the System tab.
3. Enable SSH for LAN only.
4. SSH into the router.
5. Run:

sh -c "$(curl -sL https://nextdns.io/install)"

UniFi OS, UDM, UXG

1. Open the UniFi admin interface.
2. Select the device, not just the controller settings.
3. Go to Settings.
4. Open Advanced.
5. Enable SSH and set a password.
6. SSH into the router:

ssh root@setup.ui.com

7. Run:

sh -c 'sh -c "$(curl -sL https://nextdns.io/install)"'

NextDNS notes that queries from the UDM itself may not be routed through NextDNS because of system limitations, but traffic from network clients can be.

Also disable UniFi Content Filtering or Ad Blocking before using the CLI. NextDNS documents those features as incompatible with the CLI path.

EdgeOS / USG

Enable SSH in the router admin page, connect with SSH, then:

sh -c 'sh -c "$(curl -sL https://nextdns.io/install)"'

Firewalla

1. Open the Firewalla app.
2. Open Settings.
3. Go to Advanced.
4. Open Configuration.
5. Enable SSH Console and set a password.
6. SSH into the box and run:

sh -c 'sh -c "$(curl -sL https://nextdns.io/install)"'

DD-WRT

NextDNS documents DD-WRT as a JFFS-based install.

1. Enable JFFS2 support in Administration.
2. Enable flash storage, save, apply, then complete the JFFS initialization steps.
3. SSH into the router.
4. Run:

sh -c "$(curl -sL https://nextdns.io/install)"

DD-WRT users should read the NextDNS DD-WRT notes before changing cache or dnsmasq behavior. Time sync and dnsmasq configuration can matter on that firmware.

pfSense

pfSense uses Unbound, so NextDNS documents a DNS Resolver custom options setup.

Go to:

Services -> DNS Resolver -> General Settings -> Custom Options

Then add:

server:
  forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 45.90.28.0#PROFILE_ID.dns1.nextdns.io
    forward-addr: 2a07:a8c0::#PROFILE_ID.dns1.nextdns.io
    forward-addr: 45.90.30.0#PROFILE_ID.dns2.nextdns.io
    forward-addr: 2a07:a8c1::#PROFILE_ID.dns2.nextdns.io

NextDNS warns that Unbound’s recursive behavior can create unexpected behavior when combined with a blocking DNS resolver. Test carefully after applying.

Browsers

Modern browsers can bypass system DNS with their own Secure DNS or DNS-over-HTTPS settings. That can be good if you want browser-specific protection, but confusing if your router is already configured.

Use this custom DoH endpoint:

https://dns.nextdns.io/PROFILE_ID

Chrome

1. Open Settings.
2. Go to Privacy and security.
3. Open Security.
4. Enable Use secure DNS.
5. Choose Custom.
6. Enter https://dns.nextdns.io/PROFILE_ID.

Microsoft Edge

1. Open Settings.
2. Go to Privacy, search, and services.
3. Find Security.
4. Enable secure DNS.
5. Choose a custom service provider.
6. Enter https://dns.nextdns.io/PROFILE_ID.

Brave

1. Open Settings.
2. Go to Privacy and security.
3. Open Security.
4. Enable Secure DNS.
5. Choose custom provider.
6. Enter https://dns.nextdns.io/PROFILE_ID.

Firefox

1. Open Settings.
2. Go to Privacy & Security.
3. Scroll to DNS over HTTPS.
4. Enable it.
5. Choose Custom.
6. Enter https://dns.nextdns.io/PROFILE_ID.

If you want Firefox to always use DoH rather than falling back silently, use its stricter DoH mode. That is useful on managed machines, but it can break captive portals, enterprise VPNs, or local network names.

A sensible home setup

For most people, the clean version looks like this:

1. Put NextDNS on the router for home devices.
2. Install the Apple profile on iPhone, iPad, and MacBook so they stay protected off Wi-Fi.
3. Use Android Private DNS on Android phones and tablets.
4. Install the Windows app on Windows laptops.
5. Install the Linux CLI on Linux laptops or servers.
6. Set browser DoH only when the browser ignores system DNS or you want a browser-specific profile.
7. Use https://test.nextdns.io and the NextDNS logs to verify each device.

Do not enable every blocklist on day one. Start modestly, use the web normally for a few days, then tighten. If a banking app, streaming service, work VPN, or smart TV breaks, check the logs and allowlist the blocked domain only if you trust it.

Quick troubleshooting

Problem	Likely cause	Fix
Test page says you are not using NextDNS	Device is still using router, ISP, VPN, or browser DNS	Check the exact device path and browser Secure DNS
Router setup works at home but not on mobile data	Router only covers the home network	Add a phone profile or Android Private DNS
Dashboard says no profile	Plain IPv4 DNS is not linked, or DoH/DoT URL is wrong	Use the Setup tab endpoint exactly
Some apps stop loading	Blocklist is too aggressive	Check logs and allowlist only the required domain
Browser ignores router DNS	Browser Secure DNS is enabled with another provider	Set browser DoH to NextDNS or disable browser Secure DNS
Captive portal fails on hotel or airport Wi-Fi	Encrypted DNS blocks the portal flow	Temporarily disable NextDNS or use the app/profile toggle

Bottom line

NextDNS is at its best when you treat it as a control layer, not a one-click miracle. Put it on the router for the house, put it on mobile devices for life outside the house, and check browsers that insist on doing their own DNS.

Once it is tuned, it becomes the quiet kind of upgrade: fewer ads, fewer trackers, clearer logs, and a network that feels less like every device is shouting into the internet all day.

Support independent practical tech guides at buymeacoffee.com/gearpulse.site.