4 ms·

Firefox by default is configured with a fallback option, where if resolution would fail, it will fallback to the system-provided DNS servers. So your internal T

Firefox by default is configured with a fallback option, where if resolution would fail, it will fallback to the system-provided DNS servers. So your internal TLDs are safe. Additionally, if you've setup Firefox to be installed with Firefox for Enterprise, DoH is disabled by default and you've got nothing to worry about. DOH is able to be configured through GPO as well, allowing the use of a custom server.

alerighi 7y ago
And that is even more dangerous, it would mean that if for some reason an identical domain extists on the internet (or somebody registers it to do an attack) then all the hosts will connect to the malicious external domain and not the correct host in the internal network. Local hosts should be resolved FIRST. Also cloudfare this way gets the DNS names of your internal hosts, you are leaking information that otherwise would be private, and system administrator will probably not think about that! Also with that option is not really secure at all, if somebody wants to intercept your DNS requests he can simply block the IPs of Cloudfare DNS over HTTPS server and then read the DNS requests unencrypted.
- qmarchi 7y ago
  In all reality, your Enterprise should own the domain externally. What happens if one day a configuration flag is flipped and you're no longer resolving internally the domain? If you have a problem with Cloudflare, go setup your own, it's just BIND9 with some SSL certs.
- blackearl 7y ago
  You should only use a domain you own or something that isn't routable. You can't blame FF for that
  - rovr138 7y ago
    That was an issue with .dev and then google acquired the TLD.
    - qw3rty01 7y ago
      .dev isn't an rfc2606 reserved TLD, so it shouldn't have been used for internal domains in the first place
      - rovr138 7y ago
        Replying to the part about ‘something that isn’t routable’ Not because something is not routable means that there won’t be issues.

alerighi 7y ago

And that is even more dangerous, it would mean that if for some reason an identical domain extists on the internet (or somebody registers it to do an attack) then all the hosts will connect to the malicious external domain and not the correct host in the internal network. Local hosts should be resolved FIRST. Also cloudfare this way gets the DNS names of your internal hosts, you are leaking information that otherwise would be private, and system administrator will probably not think about that! Also with that option is not really secure at all, if somebody wants to intercept your DNS requests he can simply block the IPs of Cloudfare DNS over HTTPS server and then read the DNS requests unencrypted.

qmarchi 7y ago
In all reality, your Enterprise should own the domain externally. What happens if one day a configuration flag is flipped and you're no longer resolving internally the domain? If you have a problem with Cloudflare, go setup your own, it's just BIND9 with some SSL certs.
blackearl 7y ago
You should only use a domain you own or something that isn't routable. You can't blame FF for that
- rovr138 7y ago
  That was an issue with .dev and then google acquired the TLD.
  - qw3rty01 7y ago
    .dev isn't an rfc2606 reserved TLD, so it shouldn't have been used for internal domains in the first place
    - rovr138 7y ago
      Replying to the part about ‘something that isn’t routable’ Not because something is not routable means that there won’t be issues.