---
title: "Nextdns integration for LuumenAI"
url: "https://www.luumen.ai/integrations/nextdns/"
entity: SoftwareIntegration
category: "Identity & security"
audience: "SRE, DevOps, platform engineering, IT operations"
---

# Nextdns integration for LuumenAI

Read NextDNS query analytics, then change blocking rules as approved steps

## What LuumenAI can do with Nextdns

LuumenAI connects to Nextdns with an API token and exposes 68 tools (28 read-only · 28 write · 12 destructive). Reads answer immediately; writes are shown as a plan and require approval by default, configurable per tool by an administrator.

## Key facts

- Authentication: API token
- Tools available: 68 tools (28 read-only · 28 write · 12 destructive)
- Plan: available on all plans
- Category: Identity & security

## About Nextdns with LuumenAI

Connect NextDNS and your agent can read query analytics, blocking reasons, and the current allowlist for any profile without waiting on the dashboard. When a domain needs to be unblocked, denied, or rewritten, the change is proposed first and applied after you approve it. Authentication is by API key.

## Example tools

Read-only (28 in total):

- `NEXTDNS_DOWNLOAD_LOGS` — Retrieves the download URL for exported DNS query logs from a NextDNS profile.
- `NEXTDNS_GET_ALLOWLIST` — Retrieve the list of allowed domains for a NextDNS profile.
- `NEXTDNS_GET_ANALYTICS_DESTINATIONS` — Retrieve destination analytics for a profile showing query destinations by country or GAFAM company.
- `NEXTDNS_GET_ANALYTICS_DEVICES2` — Retrieve device analytics for a profile showing identified devices with names, models, and query counts.
- `NEXTDNS_GET_ANALYTICS_DNSSEC` — Retrieve DNSSEC validation analytics for a profile showing validated vs non-validated query counts.
- `NEXTDNS_GET_ANALYTICS_DOMAINS` — Retrieve analytics data for domains within a specific profile.
- `NEXTDNS_GET_ANALYTICS_ENCRYPTION` — Retrieve encryption analytics for a profile showing encrypted vs unencrypted query counts.
- `NEXTDNS_GET_ANALYTICS_IPS` — Retrieve analytics aggregated by client IP addresses.

Write and destructive (40 in total, approval required by default):

- `NEXTDNS_ADD_ALLOWLIST_ENTRY` — Add a domain to the allowlist of a NextDNS profile.
- `NEXTDNS_ADD_BLOCKED_TLD` — Add a top-level domain to the security blocklist for a NextDNS profile.
- `NEXTDNS_ADD_DENYLIST_DOMAIN` — Add a domain to the denylist of a NextDNS profile.
- `NEXTDNS_ADD_PARENTAL_CONTROL_CATEGORY` — Add a content category to the parental control categories list.
- `NEXTDNS_ADD_PARENTAL_CONTROL_SERVICE` — Add a service to the parental control services list of a NextDNS profile.
- `NEXTDNS_ADD_PRIVACY_BLOCKLIST` — Add a blocklist to the privacy blocklists for a NextDNS profile.
- `NEXTDNS_ADD_PRIVACY_NATIVE` — Add a native tracking service to the blocked list for a NextDNS profile.
- `NEXTDNS_ADD_REWRITE` — Add a DNS rewrite rule to a NextDNS profile.

## Frequently asked questions

### How does LuumenAI connect to Nextdns?

Authorize once with API token. Luumen lists the scopes each action needs before you approve the connection, and credentials never appear in the chat.

### Can LuumenAI change things in Nextdns on its own?

Read actions answer immediately. Anything that writes is shown as a plan and requires approval by default, including the 12 actions classified as destructive. Administrators configure that per tool.

### Is there an audit trail?

Every call to Nextdns — read or write, approved or declined — is recorded with the actor, the input, and the result.

Full page: https://www.luumen.ai/integrations/nextdns/