Router DNS Configuration
Replaces: Default ISP router DNS
Change your router's DNS to a filtered resolver that blocks tracking, ads, and malware for every device on your network.
Sources
Phase
Home Network — router access, 30-90 min
General
Deployment
NextDNS (configure in router, all devices benefit)
⚠ NextDNS enables logging by default (3 months, US servers). MUST disable all logging during setup: Settings → Logs → disable all log retention. Set analytics to disabled. Choose EU server if outside US. NextDNS is a 4-person US company — your DNS queries are visible to them. If this concerns you, self-host AdGuard Home (see dns-blocking-self-hosted card).
AdGuard Home (self-hosted on a Raspberry Pi, LXC, or any server)
Related Cards
Research Findings
NextDNS logging is ON by default (3 months, US). Privacy policy claims "no data logged if not specifically requested" — contradicted by actual default behavior (flagged in their help center). 4-person US company. You CAN disable all logging. Tailscale + NextDNS: Tailscale encrypts DNS queries via DoH before reaching NextDNS, so ISP can't see queries. Official integration exists (tailscale.com/docs/integrations/nextdns). However, this combination is untested by us — noted but not recommended yet.