4 ms·
That's not entierely true. If the domain doesn't resolve via DoH, Firefox will fallback to the system DNS server. network.trr.mode Needs to be set to 2 (f
by MayeulC 8y ago
That's not entierely true. If the domain doesn't resolve via DoH, Firefox will fallback to the system DNS server.
network.trr.mode
Needs to be set to 2 (fallback), 1 (pick faster), or 0 (dissable DoH) for this to happen. 3 disables the system resolver.
- protomyth 8y agoSo, the internal domain names leak to Mozilla unless I disable this totally?
- cpeterso 8y agoNot to Mozilla, but to whichever DoH service Firefox is configured to use, by default or by the user. Mozilla isn't running a DoH service.
- protomyth 8y agoWhat is the default?
- moosingin3space 8y agoCloudflare 1.1.1.1 is the default.
- protomyth 8y agoSo, when the user types in internal.mydomain.com, it gets sent to Cloudflare then they query my public domain server which doesn't have the entry so it falls back to checking the DNS the system has listed. Is Firefox going to cache the IP like the OS does?
- moosingin3space 8y agoThe behaviour depends on a few preferences: * network.trr.mode can be set to 0 (disabled), 1 (race native vs TRR), 2 (TRR first, OS DNS as fallback), 3 (TRR only), 4 (run native and TRR in parallel but use native results, save TRR timings for telemetry), or 5 (off by choice) * network.trr.uri configures which DoH endpoint is queried Firefox does maintain a DNS cache, even if you use the native DNS resolver. You can view the cache at about:networking#dns.
- protomyth 8y agoSo, I really need to set 5 because 0 will probably later become default consent to use DNS-over-HTTPS.
- xorcist 8y agoTo be fair, can anyone really expect otherwise? If you insist on using a third party resolver for name resolution they will have knowledge of your queries no matter what the protocol. Doing it over tcp and http is not any better, or worse, than doing it over udp. This is something you have to opt in to.
- protomyth 8y ago> This is something you have to opt in to. Does it come turned off by default?
- bzbarsky 8y agoDNS-over-HTTPS in Firefox? Yes, it does, at the moment. See https://searchfox.org/mozilla-central/rev/dd7e27f4a805e4115d0dbee70e1220b23b23c567/modules/libpref/init/all.js#5576-5578 https://searchfox.org/mozilla-central/rev/dd7e27f4a805e4115d... -- 0 means it's off.
- stock_toaster 8y ago5 is "off by choice"
- bzbarsky 8y agoYes, the difference is that 0 is the default value right now, so if you set it in about:config all Gecko remembers is "it's the default" and stores nothing in user.js; if the default then changes the value changes. 5 is not the default, so if you set it it will get stored in user.js and then even if the default changes the value will remain 5.
- laHiesh1 8y agoDo they bother resolving internal domain names such as example.lan? Otherwise that would be stupid and leaky.
- josteink 8y agoWith Windows and AD “internal” names are FQDN, which resolves fine with the DNS server provided with the DHCP settings. Of course DoH will break this and leak. Enterprises everywhere will hate this and ban Firefox.
- vetinari 8y agoAlso intranet.mycompany.com. There's not a chance that a resolver would know, which domains are internal and which are not.