feat(ui): align dashboard guidance with current settings

Author: tuanductran

skills/nextdns-ui/AGENTS.md

@@ -55,47 +55,67 @@ Visibility and troubleshooting tools
 
 Monitor your network activity and troubleshoot issues through real-time logs and detailed analytics.
 
-- **Real-time Monitoring**: See every DNS query hitting the NextDNS resolver.
+- **Real-time Monitoring**: See recent DNS events hitting the NextDNS resolver.
 
-- **Search and Filter**:
+- **Search and Filter**: Select a device scope such as **All devices** and search the log list for a
 
-  - **Blocked Queries Only**: Quickly identify what is being blocked.
+  domain or event. Keep account-wide filtering separate from per-device identification.
 
-  - **Raw DNS Logs**: View absolute DNS record details.
+- **Event inspection**: Expand an individual log row to inspect the event details exposed by the UI,
 
-- **Identification**: To find out **why** a domain is blocked, hover over the information icon
+  including the queried domain, source or device context, and relative time.
 
-  (**ⓘ**) next to the query. It will tell you the specific blocklist or security feature
+- **Identification**: To find out **why** a domain is blocked, use the event details and the profile's
 
-  responsible.
+  blocking controls to distinguish a blocklist, security feature, parental-control rule, or manual
 
-- **Direct Action**: You can allow or block domains directly from the log entry using the checkmark
+  deny rule.
 
-  or cross icons.
+- **Direct Action**: If the current UI exposes allow or block actions from a log entry, confirm the
 
-- **Reloading**: Use the reload icon to check for the most recent queries after making configuration
+  target domain and profile before applying the action.
 
-  changes.
+- **Reloading**: Refresh the log view after making configuration changes and verify that new events
 
-- **Global Overview**: Track total queries and the percentage of blocked requests.
+  use the intended profile and device scope.
 
-- **Insights**:
+Use the device selector and time-range selector before interpreting any chart. The dashboard can
 
-  - **Top Domains**: Identify the most requested domains.
+show a global view such as **All devices** over a recent period, but the selected scope changes the
 
-  - **Top Reasons**: See which rules are triggering the most blocks.
+meaning of every count.
 
-  - **Top Clients**: Identify which devices are the most active on your network.
+- **Global Overview**: Track total queries, blocked queries, and the blocked-query percentage.
 
-- **Retention**: Data in the Analytics tab respects your chosen retention period in Settings.
+- **Resolved versus blocked domains**: Compare domains resolved without a block to domains blocked
 
-- Periodically check the **Blocked Queries Only** filter to ensure no essential services are being
+  by Security, Privacy, Parental Control, or a manual deny rule.
 
-  blocked.
+- **Insights**: Review blocked reasons, devices, client IPs, root-domain aggregates, GAFAM dominance,
 
-- Use the **Analytics** to understand the traffic patterns on your network and identify potential
+  encrypted-DNS percentage, DNSSEC validation percentage, and traffic destinations by country.
 
-  issues (like a device making excessive requests).
+- **Retention**: Analytics and logs are bounded by the profile's retention and privacy settings;
+
+  do not infer historical completeness when retention or client-IP logging is limited.
+
+A domain count is not the same as a unique application or user count. Root-domain aggregates combine
+
+subdomains, IP sections may contain multiple addresses for one network, and **Unidentified devices**
+
+indicate that the selected connection did not provide a usable device identity. Use the Setup page's
+
+identification instructions before treating device-level analytics as complete.
+
+- Periodically use the device scope and search controls to inspect recent events and ensure that no
+
+  essential services are being blocked.
+
+- Use **Analytics** to understand traffic patterns, compare resolved and blocked domains, and identify
+
+  potential issues such as a device making excessive requests.
+
+- [NextDNS Dashboard](https://my.nextdns.io/)
 
 - [NextDNS Help Center](https://help.nextdns.io)
 
@@ -113,48 +133,72 @@ Manage your NextDNS profile settings, log storage, and performance optimizations
 
 - **Logs Enabled**: Toggle on/off log recording.
 
-- **Log Retention**: Choose how long to keep logs (from 1 hour to 3 months).
+- **Privacy adjustments**: Choose independently whether to retain client IP addresses and queried
+
+  domains in logs.
 
-- **Log Storage Location**: **Switzerland** is often recommended by privacy enthusiasts due to their
+- **Log Retention**: Choose a retention window from **1 hour** through **2 years**. Treat retention
 
-  strong data protection laws.
+  and storage location as profile settings, not as proof that a particular legal or privacy regime
 
-- **Block Page**: Display a dedicated page when a site is blocked.
+  applies to every deployment.
 
-  - **Caution**: This setting can break **PayPal 2FA**, **iCloud Private Relay**, **Microsoft
+- **Log Storage Location**: Select the location exposed by the dashboard for the profile.
 
-    Teams**, and **Yahoo! Mail**. Only enable if you have installed the NextDNS Root CA.
+- **Block Page**: Display a page when a domain is blocked. This can slightly increase page-load time
+
+  and may produce HTTPS warnings. When disabled, blocked queries are answered with the unspecified
+
+  address `0.0.0.0` or `::`.
+
+- **Log operations**: Use **Download logs** for export and treat **Clear logs** as destructive because
+
+  it permanently removes the profile's stored logs.
 
 - **Anonymized EDNS Client Subnet**: Often enabled by default to improve CDN routing without
 
   exposing your full IP.
 
 - **Cache Boost**: Recommended for performance. It tells clients to keep DNS answers longer.
 
-- **CNAME Flattening**: Reduces the number of DNS queries.
+- **CNAME Flattening**: Prevent CNAME-chasing resolvers from making unnecessary intermediate
+
+  queries that can pollute logs.
+
+- **Rewrites**: Override DNS responses for a domain and its subdomains. Local IP addresses are
 
-  - **Warning**: May break compatibility with services like **Yahoo! Mail**.
+  supported as answers.
 
-- **Rewrites**: Manually redirect any domain or subdomain (for example, `local.home` to `192.168.1.1`).
+- **Bypass Age Verification (beta)**: Acknowledge the legal-age requirement before enabling the
 
-- **Bypass Age Verification**: Allows accessing content that requires age verification via DNS
+  dashboard's age-verification bypass feature. Do not present this beta feature as a universal
 
-  identification (added August 2025).
+  content-access guarantee.
 
-  - **Known limitation**: Community reports (NextDNS Help Center, early 2026) describe the feature
+- **Web3 (beta)**: Enable the dashboard's unfiltered gateway for decentralized naming and content
 
-    as inconsistent — it has been intermittently pulled from the dashboard due to bugs, and
+  systems such as ENS, Unstoppable Domains, Handshake, and IPFS. Browsers may require a trailing `/`
 
-    behavior varies by site and country. Don't treat it as a guaranteed bypass; verify it still
+  when opening a Web3 domain directly.
 
-    works for the target site/region before relying on it.
+- **Access (beta)**: Invite another person with editing or viewing-only access to the profile. Share
 
-- **Web3**: Enable resolution of decentralised domains (HNS, ENS, and more).
+  access deliberately because an editor can change filtering and logging behavior.
+
+- **Duplicate**: Copy all profile settings to a new profile before experimenting with a high-impact
+
+  change.
+
+- **Delete**: Deleting a profile also permanently deletes its associated logs. Confirm the target
+
+  profile before using this action.
 
 - **Set-and-Forget**: If you want a trouble-free experience, stick to the **NORMAL** or **PRO**
 
   blocklists and avoid aggressive security settings like "Block Newly Registered Domains".
 
+- [NextDNS Dashboard](https://my.nextdns.io/)
+
 - [NextDNS Help Center](https://help.nextdns.io)
 
 ### 1.3 Denylist and Allowlist

skills/nextdns-ui/SKILL.md

@@ -7,7 +7,7 @@ description:
 license: MIT
 metadata:
   author: tuanductran
-  version: '1.0.1'
+  version: '1.1.0'
 ---
 
 # NextDNS web UI skills
@@ -21,8 +21,8 @@ metadata:
 | [parental-control](rules/parental-control.md)                 | apps and games, categories, recreation time, restricted mode | Set up restrictions for family members    |
 | [ddns-settings](rules/ddns-settings.md)                       | linked ip, ddns, noip, dynamic dns, router                 | Manage network IP linking and dynamic DNS |
 | [denylist-allowlist](rules/denylist-allowlist.md)             | block domain, allow domain, allowlist, fixing breakage     | Manually manage domain accessibility      |
-| [analytics-logs](rules/analytics-logs.md)                     | monitoring, logs, blocked queries, identifier              | Monitor network activity and troubleshoot |
-| [configuration-management](rules/configuration-management.md) | profile name, log location, performance, cache boost       | Manage profile global settings            |
+| [analytics-logs](rules/analytics-logs.md)                     | monitoring, logs, blocked queries, device filter, time range, DNSSEC, encrypted DNS | Interpret dashboard analytics and troubleshoot recent events |
+| [configuration-management](rules/configuration-management.md) | profile name, log location, retention, performance, cache boost, profile sharing, age verification, web3 | Manage profile settings and lifecycle safely |
 | [web3-settings](rules/web3-settings.md)                       | web3, blockchain, ens, unstoppable domains                 | Enable resolution for blockchain domains  |
 | [rewrites](rules/rewrites.md)                                 | rewrites, custom dns, hostname override, local dns, cname  | Override DNS resolution for hostnames     |
 | [root-ca-installation](rules/root-ca-installation.md)         | root ca, certificate, block page, https, ssl, windows, macos, ios, android | Install Root CA to enable HTTPS block pages |

skills/nextdns-ui/rules/analytics-logs.md

@@ -10,6 +10,10 @@ tags:
   - query count
   - analytics
   - traffic analysis
+  - device filter
+  - time range
+  - dnssec
+  - encrypted dns
 ---
 
 # Analytics and logs
@@ -20,34 +24,48 @@ Monitor your network activity and troubleshoot issues through real-time logs and
 
 ## Logs tab
 
-- **Real-time Monitoring**: See every DNS query hitting the NextDNS resolver.
-- **Search and Filter**:
-  - **Blocked Queries Only**: Quickly identify what is being blocked.
-  - **Raw DNS Logs**: View absolute DNS record details.
-- **Identification**: To find out **why** a domain is blocked, hover over the information icon
-  (**ⓘ**) next to the query. It will tell you the specific blocklist or security feature
-  responsible.
-- **Direct Action**: You can allow or block domains directly from the log entry using the checkmark
-  or cross icons.
-- **Reloading**: Use the reload icon to check for the most recent queries after making configuration
-  changes.
+- **Real-time Monitoring**: See recent DNS events hitting the NextDNS resolver.
+- **Search and Filter**: Select a device scope such as **All devices** and search the log list for a
+  domain or event. Keep account-wide filtering separate from per-device identification.
+- **Event inspection**: Expand an individual log row to inspect the event details exposed by the UI,
+  including the queried domain, source or device context, and relative time.
+- **Identification**: To find out **why** a domain is blocked, use the event details and the profile's
+  blocking controls to distinguish a blocklist, security feature, parental-control rule, or manual
+  deny rule.
+- **Direct Action**: If the current UI exposes allow or block actions from a log entry, confirm the
+  target domain and profile before applying the action.
+- **Reloading**: Refresh the log view after making configuration changes and verify that new events
+  use the intended profile and device scope.
 
 ## Analytics tab
 
-- **Global Overview**: Track total queries and the percentage of blocked requests.
-- **Insights**:
-  - **Top Domains**: Identify the most requested domains.
-  - **Top Reasons**: See which rules are triggering the most blocks.
-  - **Top Clients**: Identify which devices are the most active on your network.
-- **Retention**: Data in the Analytics tab respects your chosen retention period in Settings.
+Use the device selector and time-range selector before interpreting any chart. The dashboard can
+show a global view such as **All devices** over a recent period, but the selected scope changes the
+meaning of every count.
+
+- **Global Overview**: Track total queries, blocked queries, and the blocked-query percentage.
+- **Resolved versus blocked domains**: Compare domains resolved without a block to domains blocked
+  by Security, Privacy, Parental Control, or a manual deny rule.
+- **Insights**: Review blocked reasons, devices, client IPs, root-domain aggregates, GAFAM dominance,
+  encrypted-DNS percentage, DNSSEC validation percentage, and traffic destinations by country.
+- **Retention**: Analytics and logs are bounded by the profile's retention and privacy settings;
+  do not infer historical completeness when retention or client-IP logging is limited.
+
+### Interpret dashboard metrics carefully
+
+A domain count is not the same as a unique application or user count. Root-domain aggregates combine
+subdomains, IP sections may contain multiple addresses for one network, and **Unidentified devices**
+indicate that the selected connection did not provide a usable device identity. Use the Setup page's
+identification instructions before treating device-level analytics as complete.
 
 ## Best practices
 
-- Periodically check the **Blocked Queries Only** filter to ensure no essential services are being
-  blocked.
-- Use the **Analytics** to understand the traffic patterns on your network and identify potential
-  issues (like a device making excessive requests).
+- Periodically use the device scope and search controls to inspect recent events and ensure that no
+  essential services are being blocked.
+- Use **Analytics** to understand traffic patterns, compare resolved and blocked domains, and identify
+  potential issues such as a device making excessive requests.
 
 ## Reference
 
+- [NextDNS Dashboard](https://my.nextdns.io/)
 - [NextDNS Help Center](https://help.nextdns.io)

skills/nextdns-ui/rules/configuration-management.md

@@ -10,6 +10,9 @@ tags:
   - performance
   - cache boost
   - cname flattening
+  - profile sharing
+  - age verification
+  - web3
 ---
 
 # Configuration management
@@ -22,28 +25,42 @@ Manage your NextDNS profile settings, log storage, and performance optimizations
 
 - **Profile Name**: Use descriptive names like "Router - Stable" or "Browser - Aggressive".
 - **Logs Enabled**: Toggle on/off log recording.
-- **Log Retention**: Choose how long to keep logs (from 1 hour to 3 months).
-- **Log Storage Location**: **Switzerland** is often recommended by privacy enthusiasts due to their
-  strong data protection laws.
-- **Block Page**: Display a dedicated page when a site is blocked.
-  - **Caution**: This setting can break **PayPal 2FA**, **iCloud Private Relay**, **Microsoft
-    Teams**, and **Yahoo! Mail**. Only enable if you have installed the NextDNS Root CA.
+- **Privacy adjustments**: Choose independently whether to retain client IP addresses and queried
+  domains in logs.
+- **Log Retention**: Choose a retention window from **1 hour** through **2 years**. Treat retention
+  and storage location as profile settings, not as proof that a particular legal or privacy regime
+  applies to every deployment.
+- **Log Storage Location**: Select the location exposed by the dashboard for the profile.
+- **Block Page**: Display a page when a domain is blocked. This can slightly increase page-load time
+  and may produce HTTPS warnings. When disabled, blocked queries are answered with the unspecified
+  address `0.0.0.0` or `::`.
+- **Log operations**: Use **Download logs** for export and treat **Clear logs** as destructive because
+  it permanently removes the profile's stored logs.
 
 ## Performance and advanced
 
 - **Anonymized EDNS Client Subnet**: Often enabled by default to improve CDN routing without
   exposing your full IP.
 - **Cache Boost**: Recommended for performance. It tells clients to keep DNS answers longer.
-- **CNAME Flattening**: Reduces the number of DNS queries.
-  - **Warning**: May break compatibility with services like **Yahoo! Mail**.
-- **Rewrites**: Manually redirect any domain or subdomain (for example, `local.home` to `192.168.1.1`).
-- **Bypass Age Verification**: Allows accessing content that requires age verification via DNS
-  identification (added August 2025).
-  - **Known limitation**: Community reports (NextDNS Help Center, early 2026) describe the feature
-    as inconsistent — it has been intermittently pulled from the dashboard due to bugs, and
-    behavior varies by site and country. Don't treat it as a guaranteed bypass; verify it still
-    works for the target site/region before relying on it.
-- **Web3**: Enable resolution of decentralised domains (HNS, ENS, and more).
+- **CNAME Flattening**: Prevent CNAME-chasing resolvers from making unnecessary intermediate
+  queries that can pollute logs.
+- **Rewrites**: Override DNS responses for a domain and its subdomains. Local IP addresses are
+  supported as answers.
+- **Bypass Age Verification (beta)**: Acknowledge the legal-age requirement before enabling the
+  dashboard's age-verification bypass feature. Do not present this beta feature as a universal
+  content-access guarantee.
+- **Web3 (beta)**: Enable the dashboard's unfiltered gateway for decentralized naming and content
+  systems such as ENS, Unstoppable Domains, Handshake, and IPFS. Browsers may require a trailing `/`
+  when opening a Web3 domain directly.
+
+## Sharing and lifecycle
+
+- **Access (beta)**: Invite another person with editing or viewing-only access to the profile. Share
+  access deliberately because an editor can change filtering and logging behavior.
+- **Duplicate**: Copy all profile settings to a new profile before experimenting with a high-impact
+  change.
+- **Delete**: Deleting a profile also permanently deletes its associated logs. Confirm the target
+  profile before using this action.
 
 ## Maintenance
 
@@ -52,4 +69,5 @@ Manage your NextDNS profile settings, log storage, and performance optimizations
 
 ## Reference
 
+- [NextDNS Dashboard](https://my.nextdns.io/)
 - [NextDNS Help Center](https://help.nextdns.io)