Compare Revisions
Firefox DNS over HTTPS
Revision 225447:
Revision 225447 by Mozinet on
Revision 240105:
Revision 240105 by Fabi.L on
Keywords:
Search results summary:
DoH improves privacy by hiding domain name lookups from anyone lurking on public WiFi, your ISP or others on your local network. Learn more
DoH improves privacy by hiding domain name lookups from anyone lurking on public WiFi, your ISP or others on your local network. Learn more
Content:
__TOC__
=About DNS-over-HTTPS=
When you type a web address or domain name into your address bar (example: [http://www.mozilla.org www.mozilla.org]), your browser sends a request over the Internet to look up the IP address for that website.
Traditionally, this request is sent to servers over a plain text connection. This connection is not encrypted, making it easy for third-parties to see what website you’re about to access.
[https://wikipedia.org/wiki/DNS_over_HTTPS DNS-over-HTTPS] (DoH) works differently. It sends the domain name you typed to a DoH-compatible DNS server using an encrypted HTTPS connection instead of a plain text one. This prevents third-parties from seeing what websites you are trying to access.
=Benefits=
DoH improves privacy by hiding domain name lookups from someone lurking on public WiFi, your ISP, or anyone else on your local network. DoH, when enabled, ensures that your ISP cannot collect and sell personal information related to your browsing behavior.
==Risks==
*Some individuals and organizations rely on DNS to block malware, enable parental controls, or filter your browser’s access to websites. When enabled, DoH bypasses your local DNS resolver and defeats these special policies. When enabling DoH by default for users, Firefox allows users (via settings) and organizations (via enterprise policies and a canary domain lookup) to disable DoH when it interferes with a preferred policy.
*When DoH is enabled, Firefox by default directs DoH queries to DNS servers that are operated by a trusted partner, which has the ability to see users' queries. Mozilla has a strong [https://wiki.mozilla.org/Security/DOH-resolver-policy Trusted Recursive Resolver (TRR) policy] in place that forbids our partners from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.
*DoH could be slower than traditional DNS queries, but in testing, we found that the [https://blog.mozilla.org/futurereleases/2019/04/02/dns-over-https-doh-update-recent-testing-results-and-next-steps/ impact is minimal and in many cases DoH is faster].
=About our rollout of DNS over HTTPS=
In 2019 we completed our rollout of DoH to all Firefox desktop users in the United States. We are currently working toward rolling out DoH in more countries. As we do so, DoH is enabled for users in “fallback” mode. For example, if the domain name lookups that are using DoH fail for some reason, Firefox will fall back and use the default DNS configured by the operating system (OS) instead of displaying an error.
=Opt-out=
For existing Firefox users in locales where we’ve rolled out DoH by default, the notification below will display if and when DoH is first enabled, allowing the user to choose not to use DoH and instead continue using their default OS DNS resolver.
[[Image:DoH89|width=500]]
In addition, Firefox will check for certain functions that might be affected if DoH is enabled, including:
*Are parental controls enabled?
*Is the default DNS server filtering potentially malicious content?
*Is the device managed by an organization that might have a special DNS configuration?
If any of these tests determine that DoH might interfere with the function, DoH will not be enabled. These tests will run every time the device connects to a different network.
=Manually enabling and disabling DNS-over-HTTPS=
You can enable or disable DoH in your [[Connection settings in Firefox|Firefox connection settings]]:
[[Template:dohtoggle]]
=Switching providers=
#[[Template:optionspreferences]]
#Scroll down to ''Network Settings'' and click the {button '''Settings…'''} button.
#Click the '''Use Provider''' drop-down under '''Enable DNS over HTTPS''' to select a provider.
#;{for not fx73}[[Image:change dns provider|width=620]]{/for}
#;{for fx73}[[Image:Change DNS Provider fx73]]{/for}
#Click {button OK} to save your changes and close the window.
=Excluding specific domains=
You can configure exceptions so that Firefox uses your OS resolver instead of DoH:
#[[Template:aboutconfig]]
#Search for {pref network.trr.excluded-domains}.
#Click the ''Edit'' [[Image:Fx71aboutconfig-EditButton]] button next to the preference.
#Add domains, separated by commas, to the list and click on the checkmark [[Image:Fx71aboutconfig-Checkmark]] to save the change.<br>'''Note:''' Do not remove any domains from the list.
{note}'''About subdomains:''' Firefox will check all the domains you've listed in {pref network.trr.excluded-domains} and their subdomains. For instance, if you enter [http://example.com example.com], Firefox will also exclude [http://www.example.com www.example.com].{/note}
=Configuring Networks to Disable DoH=
See [[Configuring Networks to Disable DNS over HTTPS]] and the [[DNS-over-HTTPS (DoH) FAQs|DNS over HTTPS (DoH) FAQs]].
=About DNS-over-HTTPS=
When you type a web address or domain name into your address bar (example: www.mozilla.org), your browser sends a request over the Internet to look up the IP address for that website. Traditionally, this request is sent to servers over a plain text connection. This connection is not encrypted, making it easy for third-parties to see what website you’re about to access.
[https://wikipedia.org/wiki/DNS_over_HTTPS/ DNS-over-HTTPS] (DoH) works differently. It sends the domain name you typed to a DoH-compatible DNS server using an encrypted HTTPS connection instead of a plain text one. This prevents third-parties from seeing what websites you are trying to access.
=Benefits=
DoH improves privacy by hiding domain name lookups from someone lurking on public WiFi, your ISP, or anyone else on your local network. DoH, when enabled, ensures that your ISP cannot collect and sell personal information related to your browsing behavior.
=Risks=
*Some individuals and organizations rely on DNS to block malware, enable parental controls, or filter your browser’s access to websites. When enabled, DoH bypasses your local DNS resolver and defeats these special policies. When enabling DoH by default for users, Firefox allows users (via settings) and organizations (via enterprise policies and a canary domain lookup) to disable DoH when it interferes with a preferred policy.
*When DoH is enabled, Firefox by default directs DoH queries to DNS servers that are operated by a trusted partner, which has the ability to see users' queries. Mozilla has a strong [https://wiki.mozilla.org/Security/DOH-resolver-policy/ Trusted Recursive Resolver (TRR) policy] in place that forbids our partners from collecting personal identifying information. To mitigate this risk, our partners are contractually bound to adhere to this policy.
*DoH could be slower than traditional DNS queries, but in testing, we found that the [https://blog.mozilla.org/futurereleases/2019/04/02/dns-over-https-doh-update-recent-testing-results-and-next-steps/ impact is minimal and in many cases DoH is faster].
=About our rollout of DNS over HTTPS=
We completed our rollout of DoH by default to all United States Firefox desktop users in 2019 and to all Canadian Firefox desktop users in 2021. We began our rollout by default to Russia and Ukraine Firefox desktop users in March 2022. We are currently working toward rolling out DoH in more countries. As we do so, DoH is enabled for users in “fallback” mode. For example, if the domain name lookups that are using DoH fail for some reason, Firefox will fall back and use the default DNS configured by the operating system (OS) instead of displaying an error.
=Opt-out=
If you’re an existing Firefox user in a locale where we’ve rolled out DoH by default, you’ll receive a notification in Firefox if and when DoH is first enabled, allowing you to choose not to use DoH and instead continue using your default OS DNS resolver.
[[Image:OptIn_Infobar]]
In addition, Firefox will check for certain functions that might be affected if DoH is enabled, including:
*Are parental controls enabled?
*Is the default DNS server filtering potentially malicious content?
*Is the device managed by an organization that might have a special DNS configuration?
If any of these tests determine that DoH might interfere with the function, DoH will not be enabled. These tests will run every time the device connects to a different network.
=Manually enabling and disabling DNS-over-HTTPS=
You can enable or disable DoH in your [https://support.mozilla.org/kb/connection-settings-firefox/ Firefox connection settings]:
#In the Menu bar at the top of the screen, click Firefox and select Preferences.
#In the General panel, scroll down to Network Settings and click the Settings… button.
#In the dialog box that opens, scroll down to Enable DNS over HTTPS.
*'''On''': Select the '''Enable DNS over HTTPS''' checkbox. Select a provider or set up a custom provider.
*'''Off''': Deselect the '''Enable DNS over HTTPS''' checkbox
#;[[Image:DoH_Enable]]
#Click OK to save your changes and close the window.
=Switching providers=
#In the Menu bar at the top of the screen, click Firefox and select Preferences.
#Scroll down to Network Settings and click the Settings… button.
#Click the Use Provider drop-down under Enable DNS over HTTPS to select a provider.
#;[[Image:DoH_Provider]]
#Click OK to save your changes and close the window.
=Excluding specific domains=
You can configure exceptions so that Firefox uses your OS resolver instead of DoH:
#Type '''about:config''' in the [https://wikipedia.org/wiki/Address_bar/ address bar] and press Return.
A warning page may appear. Click Accept the Risk and Continue to go to the about:config page.
#Search for network.trr.excluded-domains.
#Click the ''Edit'' button next to the preference.
#Add domains, separated by commas, to the list and click on the checkmark to save the change.
{note}Do not remove any domains from the list.{/note}
'''About subdomains:''' Firefox will check all the domains you've listed in network.trr.excluded-domains and their subdomains. For instance, if you enter example.com, Firefox will also exclude www.example.com.
=Configuring Networks to Disable DoH=
See [https://support.mozilla.org/kb/configuring-networks-disable-dns-over-https/ Configuring Networks to Disable DNS over HTTPS] and the [https://support.mozilla.org/kb/dns-over-https-doh-faqs/ DNS over HTTPS (DoH) FAQs].