DOH appears to not resolve specific domains
I am using 140 ESR version on linux with Cloudflare's DNS over HTTPS and with DOH active for some reason resolving a domain like d3oklwo3y1bx83.cloudfront.net will resolve to local host IP 127.0.0.1.
I am using firefox about:networking#dnslookuptool to test resolution of the domain d3oklwo3y1bx83.cloudfront.net Both with DOH on and off the resolution remains local host. I tried another browser on the same workstation and I was able to receive a resolution of 13.225.193.203 13.225.193.133 13.225.193.64 13.225.193.58 Why is firefox ESR not able to resolve that domain? What are causes ?
Is is firefox dnslookuptool results.
Alle svar (4)
I have DoH set to Increased Protection using Cloudflare and when I do a DNS Lookup at about:networking#dnslookuptool I got the following back:
IPs 52.222.157.111 52.222.157.127 52.222.157.189 52.222.157.6 HTTPS RRs 1 d3oklwo3y1bx83.cloudfront.net (alpn="h2,h3" )
I am on Firefox release 147.0.3. So, seems like it should be working.
Thanks for the confirmation. However when I use DNSlookup today 3-march-2026 I get a different value.
IPs 3.168.117.220 3.168.117.227 3.168.117.34 3.168.117.160 HTTP RRs 1 d3oklwo3y1bx83.cloudfront.net (alpn="h2,h3" )
Ændret af natalkalyu den
Thanks for the response. when I perform a DNSlookup through FF I now get a different value as of 3-March-2026.
IPs 3.168.117.220 3.168.117.227 3.168.117.34 3.168.117.160 HTTP RRs 1 d3oklwo3y1bx83.cloudfront.net (alpn="h2,h3" )
The cloudfront host will optimize resolving via awsdns based on where the request comes from, meaning it's intended to point to your a) nearest, b) fastest location at the moment. So this is variable, even during the time of the day. For me e.g. the host resolves to:
- 108.156.61.57
- 108.156.61.198
- 108.156.61.182
- 108.156.61.137
which is an Amsterdam AWS location.
Unless Amazon's routing went bonkers or the operator had somehow included a loopback address, it should have never resolved to localhost. Seeing it with both DoH on AND off signals the issue is not with the tech, but something else… or it's falling back to the system resolver in both cases for some fallback reasons (like DHCP "search domains" prefixes)?