NextDNS review: a cloud resolver you configure yourself

The generic addresses give you DNS in a minute — but NextDNS earns its place through a free profile with custom filtering, analytics, and logging you control. Here's the honest picture, including the catches.

Updated July 18, 2026 9 min read

What is NextDNS?

NextDNS is a configurable cloud DNS resolver. Its generic addresses, 45.90.28.0 and 45.90.30.0, resolve names with no setup, but its real purpose is a free account with a custom profile that filters ads, trackers, malware, and adult content and reports what your network resolves.

Think of it less as a fixed public resolver and more as a dashboard: you decide what gets blocked, what gets allowed, how long queries are logged, and where those logs live. The IP addresses are just the on-ramp — the configuration is the product.

Two ways to use it: generic vs. a profile

NextDNS has a split personality, and understanding it is the whole point. The generic addresses resolve for anyone, with no sign-up and no filtering beyond ordinary lookups. A custom profile — the part most people actually want — requires a free account and a different, profile-scoped endpoint. Start with the generic addresses to confirm it works on your network, then create a profile when you want the filtering and analytics.

Generic IPv4 (no account, no filtering)

Resolves immediately — good for a quick trial, not for custom blocking.

Primary 45.90.28.0

Secondary 45.90.30.0

Generic IPv6

The IPv6 pair for the same no-setup generic endpoint.

Primary 2a07:a8c0::

Secondary 2a07:a8c1::

For encrypted transport, NextDNS's DNS-over-TLS hostname is dns.nextdns.io. Custom filtering, though, doesn't ride on the generic addresses at all — once you create a profile, NextDNS gives you a profile-scoped DNS-over-HTTPS URL (of the form https://dns.nextdns.io/<your-profile-id>) and matching linked-IP or DoT settings. That profile ID is what ties every query back to your rules, blocklists, and analytics, which is exactly why the generic addresses can't apply your filtering.

Filtering and analytics: the reason to sign up

A NextDNS profile is a control panel for what your network is allowed to reach. You pick from curated blocklists covering ads, trackers, and malicious domains, switch on parental controls or adult-content filtering when you need them, and add your own allow and deny entries to handle the edge cases every blocklist gets wrong. Because it all happens at the DNS layer, the rules apply to every device pointed at that profile — phones, TVs, and IoT gadgets included — without installing anything on them.

The analytics side is what sets NextDNS apart from a set-and-forget resolver. A live query log shows the domains your devices are actually requesting, so a blocked page or a suspiciously chatty app is easy to diagnose: find the domain, allow or deny it, done. That visibility is a genuine convenience, though it's worth remembering that seeing your own queries in a dashboard means those queries are being processed and, depending on your settings, retained — which brings us to logging.

Privacy and logging

The provider registry summarises NextDNS as privacy-oriented with configurable or zero log retention, and notes it states it does not sell query data. In practice that means logging is a dial, not a fixed policy: you can keep a full analytics history, shorten retention, choose the region where logs are stored, or turn retention off entirely and run without a stored history. That flexibility is a real strength for people who want analytics some of the time and privacy the rest — but it also means the privacy you get depends on how you configure it, not on a single blanket guarantee.

One honest caveat: the registry lists NextDNS as supporting EDNS Client Subnet, which helps CDNs route you to a nearby server but shares a coarse version of your network location with the authoritative servers it queries. That's a common speed-versus-privacy trade-off rather than a red flag, and it's the kind of setting worth reviewing in your profile if strict privacy matters more to you than CDN locality. As always, the resolver is only as private as the operator's stated policy, so read it yourself rather than taking a summary as gospel.

Who NextDNS suits

NextDNS is a strong fit if you like the idea of running your own filtered resolver but don't want to host a Pi-hole or maintain a box at home. You get most of the same control — custom blocklists, allow/deny rules, per-device visibility — as a hosted service you can change from anywhere. It's also a natural choice for parents who want configurable content filtering with an audit trail of what was blocked. It's a weaker fit if you want something you set once and never touch, since the generic addresses alone don't filter, or if you'd rather not think about a monthly query cap; in those cases a fixed no-setup filtering resolver may suit you better. If you're weighing it against similar tools, the Control D vs NextDNS and AdGuard vs NextDNS comparisons put the differences side by side.

Pros and cons

Pros

The generic addresses resolve the moment you enter them — no account, no config file — so you can try an encrypted, DNSSEC-validating resolver in under a minute.
A free account turns NextDNS into a filter you actually control: toggle curated ad, tracker, malware, and parental-control lists, then layer your own allow and deny entries on top.
A live query log shows exactly what every device on your profile is looking up, which makes it easy to catch a chatty app, a tracker, or a false-positive block and fix it in seconds.
Log retention is configurable down to zero, and you can pick the region where any retained logs are stored — the registry notes NextDNS states it does not sell query data.
One profile can be pointed at many devices, or you can run separate profiles with different rules for, say, the kids' tablets versus your own machines.
Encrypted transport (DNS-over-HTTPS and DNS-over-TLS) and DNSSEC validation are supported, so queries aren't sent in the clear and forged records are rejected.

Cons

Its real value is locked behind setup: the no-account generic addresses give you resolution but none of the custom ad, malware, or family filtering, which needs a free profile.
The free tier includes a monthly query allowance (widely reported at roughly 300,000 queries). Once you pass it, NextDNS stops applying your filtering for the rest of the month but keeps resolving — nothing breaks, you just lose the blocking. Tiers can change, so check current pricing.
The registry lists NextDNS as supporting EDNS Client Subnet, which sharpens CDN routing but shares a coarse slice of your network location with authoritative servers — a small privacy trade-off to be aware of.
Because the generic endpoint isn't exposed as a CORS-enabled DoH URL, NextDNS is reference-only in this site's in-browser speed test and can't be timed from client-side JavaScript (see below).

How to set up NextDNS

For a no-account trial, enter 45.90.28.0 as your primary and 45.90.30.0 as your secondary DNS (or the IPv6 pair) in your device or router settings, replacing whatever your ISP assigns. For the full experience, create a free profile at nextdns.io, then follow the setup instructions it generates for your platform — they include your profile ID so filtering and analytics actually apply. The generic per-platform steps are the same as for any resolver:

Setting a profile on your router applies your NextDNS rules to every device on the network at once, but note that a router usually shows all devices as one client in your analytics — use per-device setup if you want to tell them apart.

NextDNS — questions

What is NextDNS, and what do 45.90.28.0 and 45.90.30.0 do?

NextDNS is a cloud-based DNS resolver you configure yourself. The generic addresses 45.90.28.0 and 45.90.30.0 resolve domain names immediately with no account, giving you plain, encrypted-capable DNS. To get custom ad, tracker, malware, and family filtering you create a free profile and point your device at your profile's own endpoint instead.

Is NextDNS free, and is there a limit?

NextDNS offers a free tier with a monthly query allowance — widely reported to be around 300,000 queries. When you exceed it, NextDNS stops applying your custom filtering until the next month but continues resolving normally, so your internet keeps working; you simply lose the blocking until the counter resets. Because pricing and limits can change, confirm the current numbers on NextDNS's own site before you rely on them.

Does NextDNS keep logs of my queries?

NextDNS gives you a live analytics view of your own queries, and its log retention is configurable — you can shorten it, choose the storage region, or set it to keep nothing at all. The provider registry summarises its stance as configurable or zero log retention, with a statement that it does not sell query data. As with any resolver, you are trusting the operator's published policy, so read it yourself for the legal detail.

Why can't I test NextDNS in the browser speed test?

This site's in-browser test can only time resolvers whose DNS-over-HTTPS endpoint sends permissive cross-origin (CORS) headers, and NextDNS's generic endpoint isn't published as a browser-timeable DoH URL — partly because custom filtering lives at a profile-specific endpoint rather than one shared URL. That's a browser and configuration limitation, not a verdict on NextDNS's speed. Run the live test to compare the resolvers that can be measured from your connection.

Do I need an account just to use NextDNS?

No. The generic addresses work without signing up if all you want is resolution. You only need a free account when you want the part that makes NextDNS worth choosing — a custom profile with your own blocklists, allow and deny lists, analytics, and logging preferences.