based on user reports and queries over the last 24 hours
NextDNS outage statistics
If a domain you''ve added to the allowlist still gets blocked, the issue is usually in the order of rule processing. NextDNS applies blocklists before the allowlist in some configurations. Go to Privacy → Blocklists and check if the domain appears in multiple lists. Add it explicitly to the allowlist with a leading dot — for example, .example.com — to cover all subdomains. Then flush your local DNS cache: on Windows run ipconfig /flushdns, on macOS use sudo dscacheutil -flushcache.
Financial services often use tracking scripts and fingerprinting tools that NextDNS blocks by default. Disable the "Block disguised third-party trackers" option temporarily and test again. If that helps, add the bank''s domain to the allowlist rather than turning off protections globally. Common culprits: analytics.bank.com, cdn.bank.com — check the query log to see exactly what''s being blocked.
Open nextdns.io/profile and run the built-in connectivity test. If it shows your default ISP resolver instead of NextDNS, the configuration isn''t applied system-wide. On Windows, check if DNS-over-HTTPS is set in network adapter settings — Windows 11 sometimes resets it after updates. On Android, verify that Private DNS points to your unique hostname like xxxx.dns.nextdns.io, not the generic one.
- Open the Logs tab and look at the "Server" column — if all queries route through a distant PoP, latency spikes.
- Switch the protocol from DNS-over-HTTPS to DNS-over-TLS and compare response times.
- If you use the CLI client, set --hardcode-bootstrap to avoid resolver bootstrapping delays.
- On routers running custom firmware, set the nearest anycast address manually instead of relying on auto-detection.
Each device needs to use its own configuration ID or be linked via the app. If you''ve set up NextDNS on a router and also on a device separately, they may use different profiles with conflicting rules. Check Settings → Devices in the dashboard — the device might be fingerprinted under a different name. Remove duplicate entries and re-link using the correct profile URL.
This usually means queries bypass the resolver entirely. Disable any system-level DNS cache services — on Linux, check if systemd-resolved is overriding your settings. Run dig example.com and inspect the SERVER field in the output. If it doesn''t show NextDNS addresses, the resolver isn''t reached at all. Re-run the setup guide for your OS from the official documentation.
NextDNS
Your message will be published in about
5 minutes
Service administration will see your message