29 ms·

So, the internal domain names leak to Mozilla unless I disable this totally?

cpeterso 8y ago
Not to Mozilla, but to whichever DoH service Firefox is configured to use, by default or by the user. Mozilla isn't running a DoH service.
- protomyth 8y ago
  What is the default?
  - moosingin3space 8y ago
    Cloudflare 1.1.1.1 is the default.
    - protomyth 8y ago
      So, when the user types in internal.mydomain.com, it gets sent to Cloudflare then they query my public domain server which doesn't have the entry so it falls back to checking the DNS the system has listed. Is Firefox going to cache the IP like the OS does?
      - moosingin3space 8y ago
        The behaviour depends on a few preferences: * network.trr.mode can be set to 0 (disabled), 1 (race native vs TRR), 2 (TRR first, OS DNS as fallback), 3 (TRR only), 4 (run native and TRR in parallel but use native results, save TRR timings for telemetry), or 5 (off by choice) * network.trr.uri configures which DoH endpoint is queried Firefox does maintain a DNS cache, even if you use the native DNS resolver. You can view the cache at about:networking#dns.
        protomyth 8y ago
        So, I really need to set 5 because 0 will probably later become default consent to use DNS-over-HTTPS.
xorcist 8y ago
To be fair, can anyone really expect otherwise? If you insist on using a third party resolver for name resolution they will have knowledge of your queries no matter what the protocol. Doing it over tcp and http is not any better, or worse, than doing it over udp. This is something you have to opt in to.
- protomyth 8y ago
  > This is something you have to opt in to. Does it come turned off by default?
  - bzbarsky 8y ago
    DNS-over-HTTPS in Firefox? Yes, it does, at the moment. See https://searchfox.org/mozilla-central/rev/dd7e27f4a805e4115d0dbee70e1220b23b23c567/modules/libpref/init/all.js#5576-5578 https://searchfox.org/mozilla-central/rev/dd7e27f4a805e4115d... -- 0 means it's off.
    - stock_toaster 8y ago
      5 is "off by choice"
      - bzbarsky 8y ago
        Yes, the difference is that 0 is the default value right now, so if you set it in about:config all Gecko remembers is "it's the default" and stores nothing in user.js; if the default then changes the value changes. 5 is not the default, so if you set it it will get stored in user.js and then even if the default changes the value will remain 5.

Not to Mozilla, but to whichever DoH service Firefox is configured to use, by default or by the user. Mozilla isn't running a DoH service.

protomyth 8y ago
What is the default?
- moosingin3space 8y ago
  Cloudflare 1.1.1.1 is the default.
  - protomyth 8y ago
    So, when the user types in internal.mydomain.com, it gets sent to Cloudflare then they query my public domain server which doesn't have the entry so it falls back to checking the DNS the system has listed. Is Firefox going to cache the IP like the OS does?
    - moosingin3space 8y ago
      The behaviour depends on a few preferences: * network.trr.mode can be set to 0 (disabled), 1 (race native vs TRR), 2 (TRR first, OS DNS as fallback), 3 (TRR only), 4 (run native and TRR in parallel but use native results, save TRR timings for telemetry), or 5 (off by choice) * network.trr.uri configures which DoH endpoint is queried Firefox does maintain a DNS cache, even if you use the native DNS resolver. You can view the cache at about:networking#dns.
      - protomyth 8y ago
        So, I really need to set 5 because 0 will probably later become default consent to use DNS-over-HTTPS.

xorcist 8y ago

To be fair, can anyone really expect otherwise? If you insist on using a third party resolver for name resolution they will have knowledge of your queries no matter what the protocol. Doing it over tcp and http is not any better, or worse, than doing it over udp. This is something you have to opt in to.

protomyth 8y ago
> This is something you have to opt in to. Does it come turned off by default?
- bzbarsky 8y ago
  DNS-over-HTTPS in Firefox? Yes, it does, at the moment. See https://searchfox.org/mozilla-central/rev/dd7e27f4a805e4115d0dbee70e1220b23b23c567/modules/libpref/init/all.js#5576-5578 https://searchfox.org/mozilla-central/rev/dd7e27f4a805e4115d... -- 0 means it's off.
  - stock_toaster 8y ago
    5 is "off by choice"
    - bzbarsky 8y ago
      Yes, the difference is that 0 is the default value right now, so if you set it in about:config all Gecko remembers is "it's the default" and stores nothing in user.js; if the default then changes the value changes. 5 is not the default, so if you set it it will get stored in user.js and then even if the default changes the value will remain 5.