0

2024 Ubiquiti DNS Shield Configuration Issue

I noticed that Ubiquiti now allows the use of DNS Shield which allows DNS over HTTPS within the Dream Machine Pro's Controller software. I also noticed that NextDNS has 3 entries in the UniFi control panel by default (see attached screenshot). I have a paid NextDNS Pro account. How do I force Ubiquiti's settings to use my specific paid account? In other words, how do I set it to use "https://dns.nextdns.io/XXXXXX" as an entry?

22 replies

null
    • NextDNs
    • 7 mths ago
    • Reported - view

    You can’t with this feature. It’s best to install our CLI.

      • Marty_Boyle
      • 7 mths ago
      • Reported - view

       Are you saying to install this CLI on Ubiquiti or on NextDNS? This is not very clear.

      • NextDNs
      • 7 mths ago
      • Reported - view

      to install https://nextdns.io/cli on the router.

    • Rene.2
    • 1 mth ago
    • Reported - view

    Is there any update in this matter? What's the best practice to have Ubiquiti/Unifi use our paid NextDNS profile for DNS requests using encryption? 

    Is the latest best practice still to run the https://nextdns.io/cli on the router with specific instructions for UnifiOS from https://github.com/nextdns/nextdns/wiki/UnifiOS (Keep Content Filtering and the Ad Blocking OFF at UnifiOS) ?

      • NextDNs
      • 1 mth ago
      • Reported - view

       CLI is still the recommended solution for Unifi products.

      • Eric.9
      • 3 wk ago
      • Reported - view

      Network 8.4.59 (EA) allows you to use a custom DNS Shield option.  You can get your profile info under dnscrypt in NextDNS Setup page under either Linux or routers.  You'll need the sdns.

      Currently you can only do one profile.  I've heard they are implementing a per VLAN DNS Shield option.

      The CLI works great from what I hear, but I've never gotten the courage to use it.  I've heard of people having issues when they update UniOS firmware and it's incompatible.

    • JWARE
    • 3 wk ago
    • Reported - view

    First UNA beta was released with the option for „Custom DNS Shield settings“:

    https://community.ui.com/releases/UniFi-Network-Application-8-4-57/8f253914-6dff-469b-b33e-69781ac75f0a

    • Rene.2
    • 3 wk ago
    • Reported - view

    Based on the release notes forum comments at Ubiquiti I shall stick to CLI first. The DNS-SHIELD using the DnsCrypt settings in the Unifi Security Settings seems not to run very smoothly yet.

    BTW: After the update to the new ("EA") version at Ubiquiti Unifi I had to re-install the CLI using SSH. 

    • Dan.32
    • 2 wk ago
    • Reported - view

    Now the general release is out has anyone tried it with Nextdns without using the CLI method?  Why do you need the sdns://? I thought DNSCrypt was dying, is that what Unifi is using instead of TLS? I have a cloud gateway ordered and I'd really like it to work with Nextdns. 

      • JWARE
      • 2 wk ago
      • Reported - view

      Yes, I have and has worked fine on both UDM-P and UXG-L. After watching my logs I saw that the UDM/UXG itself also needed to have its WAN DNS pointed to 127.0.0.1 so when it resolved microsoft.com, google.com, and cloudflare.com as part of the internet health check, those DNS lookups did not escape. My Encrypted DNS metric in the Analytics tab is now 100% after over a week of use with 50+ LAN clients.

       

      • Mike_Brust
      • 2 wk ago
      • Reported - view

       works perfectly fine for me on my UDM-SE for 2 weeks

      • Dan.33
      • 2 wk ago
      • Reported - view

       In my setup NextDNS keeps flapping between being an unconfigured profile and a configured one.  Does your setup have that issue?

      • Dan.32
      • 2 wk ago
      • Reported - view

       That is awesome news and good catch on the WAN DNS. Thanks!

      • Dan.32
      • 2 wk ago
      • Reported - view

       I had that with another setup. Turned out it was working on IPv4 and not on IPv6 - so it sometimes worked and sometimes didn't.

      • Jason_Miles
      • 2 wk ago
      • Reported - view

       where do you obtain the DNS Stamp (sdns://) value for NextDNS?  Thank you.

      • R_P_M
      • 13 days ago
      • Reported - view

       The stamp can be found in the Linux setup section.

      Then visit https://dnscrypt.info/stamps/ and paste in the stamp for further editing of the info (like adding a device name).

      • Mike_Brust
      • 13 days ago
      • Reported - view

       device name does not work when using dns shield with custom option. It would require CLI to run 

      • R_P_M
      • 13 days ago
      • Reported - view

       You are correct that individual device names don’t work with dns stamps behind the router but I was referring to giving the router a device name. 

    • Safwan_Shaikh
    • 2 wk ago
    • Reported - view

    On new version 8.4.59 got an option to set the nextDNS how to setup this btw please anyone let me know 

      • tonycoco
      • 13 days ago
      • Reported - view

       

      Go to: https://my.nextdns.io.

      In the "Setup Guide" section click "Routers".

      Scroll to the "Stubby" section and copy the first part of the tls_auth_name. Should be something like 69a699.dns.nextdns.io. Copy that 69a699 part before the first period. That's the Server Name.

      Next you'll need to scroll to the "DNSCrypt" section and copy the entire URL starting with sdns://. This is the DNS Stamp.

      Apply those settings and you're done.

    • Jason_Miles
    • 2 wk ago
    • Reported - view

    BTW I did find this DNS Stamp Calculator for DNSCrypt.  Wasn't sure if there are instructions on how to use it to generate a DNS Stamp for NextDNS.  Thanks.
    https://dnscrypt.info/stamps/

    • Dex
    • 13 days ago
    • Reported - view

    On the NextDNS setup guide, select Linux, scroll down to DNSCrypt and you will find your sdns:// url

     

    Paste sdns:// into the Custom DNS Stamp within Unifi. Server name is for your own refrence.

Content aside

  • 9 days agoLast active
  • 22Replies
  • 6336Views
  • 13 Following