4 ms·

I have to give them credit; because of this article, I found out that Firefox now supports dns over https and I just enabled it in my browser. Thanks!

function_seven 7y ago
Same here. Just toggled it on. Mozilla can wear this nomination as a badge of honor.
climb_stealth 7y ago
For anyone else searching for the option: > Firefox -> Preferences -> General -> Network Settings -> Enable DNS over HTTPS
- StavrosK 7y ago
  This overrides my DNS server, right? I use dnsmasq to rewrite all local addresses to their local IPs when I'm on my LAN, but it looks like this will break that.
  - judge2020 7y ago
    Likely. Instead of using DNS at all, it performs its own HTTPS request to get the DNS results; maybe FF reads the hosts file first, though.
    - StavrosK 7y ago
      That's unfortunate, but I guess I can't have it both ways... It would be nice if this feature were disabled per-network, at least.
  - deleted 7y ago
    [deleted]
  - hcs 7y ago
    One option is to use the .local TLD for local domains, those will never be resolved via DoH.rDoH. ref https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
    - fanf2 7y ago
      .local is reserved for multicast DNS so it is a really bad idea to use it for private DNS
      - hcs 7y ago
        Thanks for pointing that out, I'll stop recommending this.
    - StavrosK 7y ago
      Unfortunately that isn't ideal because the domains do resolve from the outside. I want my laptop to resolve to my router away from home, but to the actual computer inside the NAT when I'm home. Maybe I just need IPv6.
ghoulfarmer 7y ago
you should enable ESNI (encrypted SNI) on top of that next.
- wtmt 7y ago
  Instructions for others: * Type about:config in the address bar and hit Enter. * Accept the "This will void your warranty" warning. * Type network.security.esni.enabled in the search box (you can also just type esni to filter to this setting). * If it's set to false, double click it to set it to true. * Confirm that it's working and that your DNS requests are secure, by visiting the Cloudflare test page. [1] [1]: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
inspector14 7y ago
thanks to you & the ispa for the heads up
jliptzin 7y ago
Thank you Mozilla! I’m doing it as well now.

function_seven 7y ago

Same here. Just toggled it on. Mozilla can wear this nomination as a badge of honor.

climb_stealth 7y ago

For anyone else searching for the option: > Firefox -> Preferences -> General -> Network Settings -> Enable DNS over HTTPS

StavrosK 7y ago
This overrides my DNS server, right? I use dnsmasq to rewrite all local addresses to their local IPs when I'm on my LAN, but it looks like this will break that.
- judge2020 7y ago
  Likely. Instead of using DNS at all, it performs its own HTTPS request to get the DNS results; maybe FF reads the hosts file first, though.
  - StavrosK 7y ago
    That's unfortunate, but I guess I can't have it both ways... It would be nice if this feature were disabled per-network, at least.
- deleted 7y ago
  [deleted]
- hcs 7y ago
  One option is to use the .local TLD for local domains, those will never be resolved via DoH.rDoH. ref https://wiki.mozilla.org/Trusted_Recursive_Resolver https://wiki.mozilla.org/Trusted_Recursive_Resolver
  - fanf2 7y ago
    .local is reserved for multicast DNS so it is a really bad idea to use it for private DNS
    - hcs 7y ago
      Thanks for pointing that out, I'll stop recommending this.
  - StavrosK 7y ago
    Unfortunately that isn't ideal because the domains do resolve from the outside. I want my laptop to resolve to my router away from home, but to the actual computer inside the NAT when I'm home. Maybe I just need IPv6.

ghoulfarmer 7y ago

you should enable ESNI (encrypted SNI) on top of that next.

wtmt 7y ago
Instructions for others: * Type about:config in the address bar and hit Enter. * Accept the "This will void your warranty" warning. * Type network.security.esni.enabled in the search box (you can also just type esni to filter to this setting). * If it's set to false, double click it to set it to true. * Confirm that it's working and that your DNS requests are secure, by visiting the Cloudflare test page. [1] [1]: https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/

inspector14 7y ago

thanks to you & the ispa for the heads up

jliptzin 7y ago

Thank you Mozilla! I’m doing it as well now.