The catch with putting NextDNS’s IPv4 addresses into Proton’s custom DNS is identification. Plain DNS to NextDNS only reaches your configuration through the linked IP, and behind the VPN that is Proton’s exit IP, which is shared and changes with every server. So the filtering and logs won’t reliably be yours. Custom DNS in Proton also only works with NetShield turned off.
What works better on Windows is encrypted DNS that carries your config ID itself: the NextDNS app, or the DoH address from your NextDNS setup page (it ends in your config ID) entered in the browser. That traffic just goes through the tunnel like any other HTTPS, so the VPN and NextDNS don’t fight over it. Worth checking with a leak test afterwards that queries actually show up in your NextDNS log.
The catch with putting NextDNS’s IPv4 addresses into Proton’s custom DNS is identification. Plain DNS to NextDNS only reaches your configuration through the linked IP, and behind the VPN that is Proton’s exit IP, which is shared and changes with every server. So the filtering and logs won’t reliably be yours. Custom DNS in Proton also only works with NetShield turned off.
What works better on Windows is encrypted DNS that carries your config ID itself: the NextDNS app, or the DoH address from your NextDNS setup page (it ends in your config ID) entered in the browser. That traffic just goes through the tunnel like any other HTTPS, so the VPN and NextDNS don’t fight over it. Worth checking with a leak test afterwards that queries actually show up in your NextDNS log.