I think the typical way to do DNS over HTTPS is to run a DoH client/DNS proxy and then point your nameservers at localhost. I'm not really sure what benefit th

I think the typical way to do DNS over HTTPS is to run a DoH client/DNS proxy and then point your nameservers at localhost. I'm not really sure what benefit there is to doing this compared to DNS over TLS with a resolver like Unbound but I suppose that's a different discussion. What Firefox seems to be doing, unless I'm mistaken, is running their own resolver that implements DoH/connects to Cloudflare and bypasses OS settings.[1][2] I haven't dug into the details yet to see how it interacts with the hosts file. It does sound like it falls back to the OS if it fails to resolve with DoH but this solution at first glance appears unideal. Wouldn't it be best if Microsoft/Apple/*nix distros/ISPs/third party nameservers used resolvers and nameservers that support DNS over TLS? Then end users/administrators could choose who they trust and everything would still be encrypted. [1] https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1434852 https://bugzilla.mozilla.org/show_bug.cgi?id=1434852