Agentic Fabriq
NextDNS
SECURITY · DEVELOPER
Profiles, blocklists, filtering settings and query logs on their own account.
Connecting NextDNS in practice
NextDNS is where a household or company’s full DNS query log lives, and one unscoped X-Api-Key header from account settings reaches all of it — the logs endpoint returns every domain each device on the profile looked up, and the same key rewrites the blocklists. The API is also still described as beta and "subject to breaking changes without notice".
Scopes that draw scrutiny
X-Api-KeyThe single account credential, taken from account settings. There are no scopes, so an agent that only needs the analytics summary holds the key that can read raw query logs and change what the network is allowed to resolve.
Worth knowing
- Analytics and log endpoints are cursor-paginated with a limit capped at 500 on most endpoints, and a null cursor is the only end-of-data signal — there is no total count to size a job against.
- NextDNS describes the API as beta and subject to breaking changes without notice, so endpoint shapes can move without a deprecation window.
- No rate limit is published anywhere in the API documentation, so throughput has to be measured against a live key rather than designed for.
- The query log is the most sensitive object in the product: reading it reconstructs browsing history per device, which makes this an unusually high-consequence read scope for a DNS integration.
Checked against NextDNS API documentation (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put NextDNS behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.