IoT Traffic Anomaly Detection & Alerts

Hi NextDNS team,

I would like to suggest a new feature for anomaly detection, specifically aimed at monitoring Smart Home and IoT devices (smart TVs, cameras, smart plugs, etc.).

The Problem:

IoT devices are often black boxes. Sometimes they start making thousands of unexpected DNS requests in the background, either due to aggressive telemetry, bad firmware updates, or worse—being compromised by malware or botnets. Currently, users only notice this suspicious activity if they manually sift through the Logs and spot a massive spike in requests, which is time-consuming and often too late.

The Proposed Solution:

Implement an automated "Anomaly Detection" system that analyzes DNS request patterns. If a specific device suddenly starts making an unusually high number of requests to a specific domain (especially newly seen or obscure ones) within a short timeframe, NextDNS should flag it.

Key Features:

Dashboard Alerts: Display a visual warning in the Analytics or Logs section (e.g., "Anomalous traffic detected from Device X"). Real-Time Notifications: Allow users to opt-in for an email or webhook alert when an anomaly is triggered. Quick Action: Provide a "One-Click Block" button in the alert to instantly block the suspicious domain. 

This feature would turn NextDNS into a proactive security system for smart homes, giving users peace of mind without needing to check logs every day. Thank you for considering!