Comment by Someone1234 | Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Parent Full thread

Firefox allows you to use any resolver you wish. It just isn't a feature exposed in the UI, and instead you have to use about:config.

Specifically you'll need to set:

- network.trr.bootstrapAddress: To a secure DNS provider you trust (to get the HTTPS DNS resolver's IP/bootstrap DNS over HTTPS). e.g. 1.1.1.1

- network.trr.mode: To 2 (DNS-over-HTTPS is first choice, fallback to OS), 3 (DNS-over-HTTPS only otherwise fail, recommended)

- network.trr.uri to the URL of your DNS-over-HTTPS provider. e.g. https://cloudflare-dns.com/dns-query

If you set all three (and mode to 3), it is a completely bespoke, highly secure DNS solution. That's what I use at work for any personal browsing.

The problem isn't the lack of a configuration option, it's when the default is to ignore the one configured in the operating system.

Suppose I have all my devices configured to use my local DNS where I've added names for my other local devices or changed the ones for some names because local devices should use the RFC1918 addresses instead of the internet ones that are routed differently. Suddenly Firefox on every device is using Cloudflare even though nobody ever told it to, and now I have to go touch every device and fix it, including when they're BYOD and the owners want them to "just work" and resolve the names correctly without me having to touch them.

Then the same thing all over again when Chrome does it or any other application.

I would also add the following for Encrypted SNI:

  network.security.esni.enabled = true

Check by running all four tests i.e. Secure DNS, DNSSEC, TLS 1.3 & Encrypted SNI at https://www.cloudflare.com/ssl/encrypted-sni/

Reply on news.ycombinator.com