r/technitium • u/Fun-Region-1576 • 5d ago

Using Technitium with NextDNS?

Currently, I have all my devices configured with NextDNS. It doesn't have all the blocklists that I want to use, especially when I'm home. Does it make sense to set up Technitium with the additional blocklists that I want, which NextDNS doesn't have, and then having them working simultaneously when I'm at home?

Is it possible to set up Technitium to block all DoT/DoQ traffic, and then force all devices in the home network to use NextDNS and Technitium?

2 Upvotes

100% Upvoted

18 comments sorted by

6

u/Historical-Side883 5d ago

Technitium can’t block ports.
You want to set up forwarding on your router/firewall.

You can just set up next DNS as your upstream for technitium and add your blocklists. I use quad9 and blocklits without issue

Unless I am misunderstanding what you’re asking

1

u/Fun-Region-1576 4d ago

Are you using Quad9 with its own blocklists plus the blocklists from Technitium?

1

u/Historical-Side883 4d ago

I’m not but you can use the filtered dns no problem.
Basically, when you make a DNS request, technitium checks if it’s on its block list, if it is, then the request just gets returned directly from technitium. If it’s not, then it queries the outside DNS (if it isn’t cached) and if it’s on their block list, then you get the same response as if there was no block list on technitium. It seems like your concern is that they are going to interfere somehow and they won’t because of how they work.

1

u/emelbard 4d ago

Why even query an upstream DNS resolver when you can create a root zone and have it all in house? Like 3 clicks

1

u/Historical-Side883 4d ago

It’s not all in house, you’re just querying different servers. Unless I’m misunderstanding what you’re saying

The threat model that the default setup solves is different than using DoQ. One spreads around queries so no single entity has all your queries (but the requests are plaintext and easily visible to anyone in the network chain) and the other encrypts DNS requests so they can’t be viewed. It’s still caches the same way but for my usage, I prefer using DNS-over-QUIC when I have to query uncached records.

1

u/emelbard 4d ago

Sorry. By ‘in-house’ I meant that technitium is building it from the root (stored locally) through the TLDs instead of querying a commercial upstream for the entire result. I have no upstream DNS resolvers in my config. For me it’s better for performance and privacy.

“A Technitium root zone setup makes your DNS server a full recursive resolver: instead of forwarding queries to an upstream provider like Quad9, it starts with the Internet’s DNS root servers and follows the chain itself (root → TLD like .com → the domain’s authoritative DNS) to get the answer, then caches it locally. The main advantage is independence and privacy: no single upstream DNS provider sees your complete DNS query history, you aren’t dependent on its filtering/policies or availability, and cached lookups can be extremely fast. “

1

u/Fun-Region-1576 4d ago

Well, the goal is to use something like NextDNS and Technitium. I'll add the blocklists that I want so both are working to get the job done. I don't want to disable NextDNS because as soon as I leave the WiFi network, I need a DNS service for cellular data.

1

u/Historical-Side883 4d ago

Yeah, my threat model is more concerned with people snooping my DNS traffic than an upstream resolver seeing it. At least with how Quad9 handles data. I’d be more worried using Google DNS.

Root servers don’t support encrypted DNS. But the caching still happens just the same so the vast majority of requests are handled by the technitium cluster.

1

u/Fun-Region-1576 4d ago

Sorry, but what do you mean by filtered DNS?

1

u/Historical-Side883 4d ago

Filtered DNS is dns with blocked domains built in

1

u/Fun-Region-1576 4d ago

Well, the goal is to use something like NextDNS and Technitium. I'll add the blocklists that I want so both are working to get the job done. I don't want to disable NextDNS because as soon as I leave the WiFi network, I need a DNS service for cellular data.

2

u/MarxJ1477 4d ago

As someone who went down this rabbit hole...

Running NextDNS as your upstream works well. I use NextDNS over DoH as my upstream DNS provider. And most important to me on my mobile devices so that when I'm not home I still get ad blocking. I picked NextDNS because I can load custom blocklists and have it be exactly the same at home and away.

As for blocking DNS/DoH/DoT....if you're router supports it you can use NAT to redirect any requests to port 53 to technitium. DoT you can just block on the router and likely won't experience any issues.

DoH is the real problem. There are DoH blocklists you can use with technitium but it's not worth it. If you use Apple devices you'll end up having to whitelist a bunch of apple domains to get things like updates to work. Along with that you'll get random websites that are blocked or don't work properly. It's just not worth it to go down this route.

1

u/Fun-Region-1576 4d ago

Right, but are there any issues with using both NextDNS and Technitium in the manner rtjat I want to?

To reiterate, the goal is to use something like NextDNS and Technitium. I'll add the blocklists that I want so both are working to get the job done. I don't want to disable NextDNS because as soon as I leave the WiFi network, I need a DNS service for cellular data.

1

u/SMFTKO 3d ago

You can also use TailScale and use TailScale DNS to use your Technitium DNS and blocklists to support all devices on your TailNet. In this way your DNS servers provide DNS with your blocking to devices even if they are not on your home network.

1

u/Fun-Region-1576 2d ago

Is this reliable and low latency?

1

u/SMFTKO 2d ago

Yes. I have been using it for months now with no issues. As an added security measure you can also route all the traffic on your TailNet through your home network - though you need decent internet at your home. I tend not to use an exit node but might on sketchy wifi (hotel, etc)

1

u/mystiquebsd 4d ago

Unencrypted DNS, you can redirect the port

Anything redirected and TLS is considered mitm man in the middle

HAGEZI has a VPN, DOH, DOT List

Using that you will stop everyone else from being able to resolve the names, but it won’t block quartz or the IP address addresses, so if someone is truly interested in avoiding your DNS, there are still ways

And because DOH is 443, censorship wins

You may block dns.quad.net, but unless you’re blocking all the IP’s the names resolved to, the potential exists; but are they motivated enough?

HTH