New hidden security features found in NextDNS strings and API

Today, NextDNS quietly released 5 new security features, but after digging through the strings files used by the dashboard and looking at the API responses, I found 6 additional security features that appear to exist but aren't currently exposed in the UI.

Here’s how they appear in the string file:

• DNS Data Exfiltration
• Block domains that use the DNS protocol to smuggle data out of your network or receive hidden commands (C2). This heuristic analyzes DNS query patterns in real time—such as abnormally long subdomains, high entropy, and unusual request types (e.g., TXT)—to detect and stop low-and-slow data theft and malware beacons (like Cobalt Strike) that evade traditional firewalls.
• DNS Payload Delivery
• Prevent DNS responses from being used to deliver hidden commands or payloads to your devices. Queries for record types that can carry arbitrary data but are unnecessary for everyday browsing — such as TXT or NULL — are blocked entirely. CNAME chains are flattened to their final address, removing intermediate records that could encode hidden data. For standard record types like A and AAAA, oversized answer sections are randomly truncated to corrupt any data encoded across multiple records, while preserving normal DNS functionality.
• Fast Flux Networks
• Block domains that rapidly rotate their IP addresses across a distributed network of compromised devices (botnets) to evade detection. This heuristic identifies specific anomalies in DNS Time-To-Live (TTL) and IP diversity that are characteristic of malicious infrastructure and distinct from legitimate Content Delivery Networks (CDNs).
• High-Risk TLDs
• Automatically block Top-Level Domains (TLDs) that are statistically dominated by malicious activity — e.g., .zip, .mov, .top. The list is updated in real time based on global abuse reputation data, protecting you from vast networks of cheap, disposable domains used for phishing and spam without requiring manual configuration.
• Newly Active Domains
• Block domains that are being accessed for the first time or have historically low activity. This prevents zero-day attacks and "sleeper" threats by requiring a proven footprint of legitimate usage before a domain is trusted, effectively neutralizing attempts to "pre-warm" malicious domains.
• Untrusted Certificates
• Block domains that serve SSL/TLS certificates signed by untrusted or unknown Certificate Authorities (e.g., self-signed). While legitimate websites almost exclusively use trusted certificates, nearly 60% of commodity malware Command-and-Control (C2) servers rely on self-signed certificates or certificates issued by untrusted authorities to encrypt their traffic without leaving a paper trail.

The interesting part is that these aren't just leftover strings, you can already toggle them through the API, and from a quick test, they actually seem to work. I'm going to try adding them to my NextDNS Android app tomorrow, and if you want to test them yourself, these are the API paths:

• "security/dnsDataExfiltration"
• "security/dnsPayloadDelivery"
• "security/fastFluxNetworks"
• "security/highRiskTlds"
• "security/newlyActiveDomains"
• "security/untrustedCertificates"

Pretty cool to see NextDNS finally adding some new features😃