Configure DNS Over HTTPS in Firefox

DNS over HTTPS is a relatively new feature to improve the privacy, security and connection reliability of DNS look-ups; the feature is currently in draft status and tested by companies such as Google, Cloudflare or Mozilla.

DNS resolves play an important part on today's Internet; domain names that you enter in your browser's address bar need to be linked to IP addresses, and that is what DNS is used for.

These DNS look-ups happen automatically and often without any form of encryption or protection from prying eyes or tampering.

Internet users up until now had options to connect to a non-leaking VPN provider, switch the DNS provider to one that promises better privacy and security, or use DNSCrypt to improve privacy and security.

DNS Over HTTPS in Firefox

DNS Over HTTPS offers another option. Mozilla added the core functionality in Firefox 60 and plans to run a test in Firefox Nightly to find out how good of a solution the new technology is.

Firefox users who run Firefox Nightly may configure the browser to use DNS over HTTPS right now.Type about:support to check the version of Firefox; it if it at least version 60.x, you may configure the feature. Please note that this may lead to connectivity issues (which may be limited by configuring a fallback).

It is necessary to change three Trusted Recursive Resolver preferences in the browser.

1. Load about:config in the Firefox address bar.
2. Confirm that you will be careful if the warning page is displayed.
3. Search for network.trr.mode and double-click on the name.
   • Set the value to 2 to make DNS Over HTTPS the browser's first choice but use regular DNS as a fallback. This is the optimal setting for compatibility.
   • You can set it to 1 to let Firefox pick whichever is faster, 3 for TRR only mode, or 0 to disable it.
4. Search for network.trr.uri. Firefox expects a DNS over HTTPS server. Double-click on the name. There are two public ones that you may use,
   1. https://dns.cloudflare.com/.well-known/dns
   2. https://dns.google.com/experimental
5. Search for network.trr.bootstrapAddress and double-click on it.
   1. Set the value to 1.1.1.1

Note: Mozilla has a special agreement with Cloudflare which limits the logged data and data retention. Cloudflare launched the public DNs service 1.1.1.1 yesterday which supports DNS over HTTPS as well.

 

Closing Words

The core benefit of DNS over HTTPS is that you limit exposure of your DNS queries. You need to trust the public provider, Cloudflare or Google are the only ones right now. It is likely that other providers will introduce support for it if the feature is integrated into the stable versions of popular web browsers.

Now You: Have you changed the DNS provider on your devices?