{"slug":"use-nextdns","title":"Use NextDNS","tags":["tailscale","dns"],"agent_summary":"Last validated: Dec 8, 2025","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Use NextDNS\r\n\r\nLast validated: Dec 8, 2025\r\n\r\n[NextDNS](https://nextdns.io/) is a personalized DNS nameserver, that can be used to increase the security of your network by blocking malicious domains, block ads and trackers, and limit the browsing experience users in your tailnet. Tailscale only uses NextDNS with DNS over HTTPS (DoH).\r\n\r\nYou can configure NextDNS as a global nameserver in Tailscale, and set different NextDNS profiles for different devices.\r\n\r\n## [What information is shared with NextDNS?](https://tailscale.com/docs/integrations/nextdns\\#what-information-is-shared-with-nextdns)\r\n\r\nBy default, when using NextDNS with Tailscale, your device information is sent to your NextDNS logs so you can have detailed logs and analytics. This includes: device name, OS, Tailscale IP, and Tailscale node ID.\r\n\r\nYou can [disable this metadata sharing](https://tailscale.com/docs/integrations/nextdns#disable-sharing-device-metadata-with-nextdns).\r\n\r\n## [Prerequisites](https://tailscale.com/docs/integrations/nextdns\\#prerequisites)\r\n\r\nUsing NextDNS with Tailscale requires Tailscale v1.32 or later.\r\n\r\nYou'll need a NextDNS profile. If you don't already have one, [create a NextDNS profile](https://my.nextdns.io/start).\r\n\r\n## [Use NextDNS as a global nameserver](https://tailscale.com/docs/integrations/nextdns\\#use-nextdns-as-a-global-nameserver)\r\n\r\nUse NextDNS as a global nameserver to route DNS queries from all devices in your tailnet to NextDNS.\r\n\r\nTo add NextDNS as a global nameserver:\r\n\r\n1. Open the [DNS](https://login.tailscale.com/admin/dns) page of the admin console.\r\n\r\n2. Go to **Nameservers**, then select **NextDNS** from the **Add nameserver** drop-down list.\r\n\r\n3. Enter the IPv6 address for your NextDNS profile. This address is available in the **Endpoints** section of the [setup tab](https://my.nextdns.io/setup) of the NextDNS web console.\r\n![The 'Add NextDNS configuration' dialog. The 'Endpoint' field contains an IPv6 address.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fnextdns-ipv6.73cc8f80.png&w=1080&q=75)\r\n4. Select **Save**. The NextDNS profile will save as a global nameserver for your profile ID. One NextDNS IPv6 address will automatically add all IPv6 addresses for that profile.\r\n\r\n5. Select **Override DNS servers** to force devices to use NextDNS as a global nameserver instead of what is locally configured on each device.\r\n![The DNS page of the admin console with the 'Global Nameservers' section. The example NextDNS profile is 'abc123'.](https://tailscale.com/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fnextdns-global-list.726c1f62.png&w=1080&q=75)\r\n\r\nIf you configure NextDNS as a global nameserver, you should not configure another global nameserver for your tailnet. This is because queries denied by NextDNS could be answered by other nameservers, accidentally circumventing privacy or content restrictions. Additionally, NextDNS cannot be used as a split DNS server.\r\n\r\n## [Use different NextDNS profiles for different devices](https://tailscale.com/docs/integrations/nextdns\\#use-different-nextdns-profiles-for-different-devices)\r\n\r\nNextDNS lets you create multiple profiles (also known as configurations) to protect different devices differently. For example, you might create a administrator control profile and a user control profile for your devices.\r\n\r\nYou must be using NextDNS as a global nameserver to use different profiles for different devices.\r\n\r\nTo specify a different profile than the global profile for a specific Tailscale device:\r\n\r\n1. Set up NextDNS as a global nameserver for your tailnet.\r\n\r\n2. Add a node attributes `nodeAttrs` section to your tailnet policy file. Set a `target` for the devices you want the profile to apply to. This can be a tag, user, group, or `*`.\r\n\r\n3. Set the attribute `nextdns:abc123` to use the desired NextDNS profile ID `abc123`.\r\n\r\n\r\nFor example, in your tailnet policy file:\r\n\r\n```json\r\n{\r\n \"grants\": [\"...\"],\r\n \"nodeAttrs\": [\\\r\n {\\\r\n \"target\": [\"user@example.com\", \"tag:server\"],\\\r\n \"attr\": [\\\r\n \"nextdns:abc123\",\\\r\n ],\\\r\n },\\\r\n ],\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n## [Disable sharing device metadata with NextDNS](https://tailscale.com/docs/integrations/nextdns\\#disable-sharing-device-metadata-with-nextdns)\r\n\r\nTo block sharing device metadata with NextDNS, in your tailnet policy file, set the attribute `nextdns:no-device-info`:\r\n\r\n```json\r\n{\r\n \"grants\": [\"...\"],\r\n \"nodeAttrs\": [\\\r\n {\\\r\n \"target\": [\"*\"],\\\r\n \"attr\": [\\\r\n \"nextdns:no-device-info\",\\\r\n ],\\\r\n },\\\r\n ],\r\n}\r\n```\r\n\r\nYou can use the [visual policy editor](https://tailscale.com/docs/features/visual-editor) to manage your tailnet policy file. Refer to the [visual editor reference](https://tailscale.com/docs/reference/visual-editor) for guidance on using the visual editor.\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"

Use NextDNS

\n

Last validated: Dec 8, 2025

\n

NextDNS is a personalized DNS nameserver, that can be used to increase the security of your network by blocking malicious domains, block ads and trackers, and limit the browsing experience users in your tailnet. Tailscale only uses NextDNS with DNS over HTTPS (DoH).

\n

You can configure NextDNS as a global nameserver in Tailscale, and set different NextDNS profiles for different devices.

\n

What information is shared with NextDNS?

\n

By default, when using NextDNS with Tailscale, your device information is sent to your NextDNS logs so you can have detailed logs and analytics. This includes: device name, OS, Tailscale IP, and Tailscale node ID.

\n

You can disable this metadata sharing.

\n

Prerequisites

\n

Using NextDNS with Tailscale requires Tailscale v1.32 or later.

\n

You'll need a NextDNS profile. If you don't already have one, create a NextDNS profile.

\n

Use NextDNS as a global nameserver

\n

Use NextDNS as a global nameserver to route DNS queries from all devices in your tailnet to NextDNS.

\n

To add NextDNS as a global nameserver:

\n
    \n
  1. \n

    Open the DNS page of the admin console.

    \n
    2. \n
  2. \n

    Go to Nameservers, then select NextDNS from the Add nameserver drop-down list.

    \n
    3. \n
  3. \n

    Enter the IPv6 address for your NextDNS profile. This address is available in the Endpoints section of the setup tab of the NextDNS web console.\r\n\"The

    \n
    4. \n
  4. \n

    Select Save. The NextDNS profile will save as a global nameserver for your profile ID. One NextDNS IPv6 address will automatically add all IPv6 addresses for that profile.

    \n
    5. \n
  5. \n

    Select Override DNS servers to force devices to use NextDNS as a global nameserver instead of what is locally configured on each device.\r\n\"The

    \n
    6. \n
\n

If you configure NextDNS as a global nameserver, you should not configure another global nameserver for your tailnet. This is because queries denied by NextDNS could be answered by other nameservers, accidentally circumventing privacy or content restrictions. Additionally, NextDNS cannot be used as a split DNS server.

\n

Use different NextDNS profiles for different devices

\n

NextDNS lets you create multiple profiles (also known as configurations) to protect different devices differently. For example, you might create a administrator control profile and a user control profile for your devices.

\n

You must be using NextDNS as a global nameserver to use different profiles for different devices.

\n

To specify a different profile than the global profile for a specific Tailscale device:

\n
    \n
  1. \n

    Set up NextDNS as a global nameserver for your tailnet.

    \n
    2. \n
  2. \n

    Add a node attributes nodeAttrs section to your tailnet policy file. Set a target for the devices you want the profile to apply to. This can be a tag, user, group, or *.

    \n
    3. \n
  3. \n

    Set the attribute nextdns:abc123 to use the desired NextDNS profile ID abc123.

    \n
    4. \n
\n

For example, in your tailnet policy file:

\n
{\r\n  \"grants\": [\"...\"],\r\n  \"nodeAttrs\": [\\\r\n    {\\\r\n      \"target\": [\"user@example.com\", \"tag:server\"],\\\r\n      \"attr\": [\\\r\n        \"nextdns:abc123\",\\\r\n      ],\\\r\n    },\\\r\n  ],\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

Disable sharing device metadata with NextDNS

\n

To block sharing device metadata with NextDNS, in your tailnet policy file, set the attribute nextdns:no-device-info:

\n
{\r\n  \"grants\": [\"...\"],\r\n  \"nodeAttrs\": [\\\r\n    {\\\r\n      \"target\": [\"*\"],\\\r\n      \"attr\": [\\\r\n        \"nextdns:no-device-info\",\\\r\n      ],\\\r\n    },\\\r\n  ],\r\n}\n
\n

You can use the visual policy editor to manage your tailnet policy file. Refer to the visual editor reference for guidance on using the visual editor.

\n

\"Project

\n

Ask AI

\n

reCAPTCHA

\n

Recaptcha requires verification.

\n

protected by reCAPTCHA

\n"}