Facebook intermittently blocked by NextDNS even after adding .facebook.com to Allowlist

Hello NextDNS Team,

I am having a persistent/intermittent problem accessing Facebook through my NextDNS profile.

My NextDNS configuration ID is:

846dcc

Network:
- OpenWrt router
- https-dns-proxy
- NextDNS DNS-over-HTTPS
- ISP: Uttara Online BD, Bangladesh
- Client: Windows 11
- Browser: Brave

The problem is unusual because Facebook works normally sometimes, but after an electricity/power interruption it stops working. This has happened on two consecutive days.

Google and Cloudflare continue to work normally.

I have already performed extensive troubleshooting.

WHAT I TESTED:

1. DNS resolution through my OpenWrt router:

nslookup www.facebook.com

Result:

2a09:8280:1::d3:83c2:0
149.248.211.216

So DNS resolution is working.

2. I tested NextDNS IPv4 resolvers directly:

nslookup www.facebook.com 45.90.28.109
nslookup www.facebook.com 45.90.30.109

Both return:

2a09:8280:1::d3:83c2:0
149.248.211.216

3. I tested NextDNS IPv6 resolvers directly:

nslookup -type=AAAA www.facebook.com 2a07:a8c0::84:6dcc
nslookup -type=A www.facebook.com 2a07:a8c0::84:6dcc

Both return Facebook addresses.

4. I tested IPv4 HTTPS directly:

curl.exe -4 -Iv https://www.facebook.com

The TLS handshake fails.

5. I tested IPv6 HTTPS:

curl.exe -6 -Iv https://www.facebook.com

The TLS connection sometimes fails with:

SEC_E_UNTRUSTED_ROOT

and at other times, when using -k, I receive:

HTTP/1.1 200 OK
Blocked-By: NextDNS
Cache-Control: no-store

This strongly suggests that NextDNS is actively returning a blocking response for Facebook.

6. I tested the Facebook IPv6 address directly using --resolve.

The connection reached the Facebook hostname, but NextDNS returned:

HTTP/1.1 200 OK
Blocked-By: NextDNS

7. I checked the NextDNS Logs.

The logs show many Facebook domains being blocked, including:

www.facebook.com
graph.facebook.com
b-graph.facebook.com
web.facebook.com
z-m-gateway.facebook.com
graph-fallback.facebook.com

The log specifically shows:

"Blocked by Denylist, Facebook and Social Networks."

and also:

"Blocked by Denylist and HaGeZi - Multi ULTIMATE."

8. I added:

*.facebook.com

to the NextDNS Allowlist.

The Allowlist entry is enabled.

According to the NextDNS interface, Allowlist should take precedence over other filtering rules.

However, Facebook is still being blocked.

9. I also tested:

nslookup graph.facebook.com 2a07:a8c0::84:6dcc

At one point NextDNS returned:

Address: ::
Address: 0.0.0.0

The NextDNS Logs showed graph.facebook.com being blocked.

10. I restarted the OpenWrt HTTPS DNS proxy:

/etc/init.d/https-dns-proxy restart

The service is running.

11. I flushed the Windows DNS cache:

ipconfig /flushdns

The problem remains.

12. I tested Google:

curl.exe -6 -Iv https://www.google.com

Google successfully establishes TLS and returns:

HTTP/1.1 200 OK

13. I tested Cloudflare:

curl.exe -4 -Iv https://www.cloudflare.com

Cloudflare successfully establishes TLS and returns:

HTTP/1.1 200 OK

Therefore this does not appear to be a general HTTPS, IPv6, WAN, or Windows problem.

The most important observation is:

Facebook sometimes works, but after the router/electricity is restarted it can stop working again.

The NextDNS logs clearly show Facebook domains being blocked even though *.facebook.com is currently in the Allowlist.

Could you please investigate whether:

1. There is a problem with the NextDNS filtering engine for Facebook;
2. Facebook domains are being incorrectly blocked by one of the blocklists;
3. There is a problem with Allowlist precedence;
4. There is an issue with the NextDNS resolver/edge currently serving my connection in Bangladesh;
5. There is an issue with IPv6/IPv4 routing or filtering;
6. There is a stale/cached policy being applied to my configuration;
7. The NextDNS configuration/profile 846dcc has any abnormal state.

Please let me know what additional diagnostics you need.

I can provide:
- NextDNS diagnostic output
- NextDNS log screenshots
- OpenWrt configuration
- curl output
- nslookup output
- ping.nextdns.io results

Thank you.