# DNS over HTTPS coming to Firefox

**URL:** <https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127>\
**Category:** General\
**Created:** [June 5, 2018, 8:56pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127 "2018-06-05T20:56:01Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![robgill](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/robgill/32/3696_2.png) [@robgill](https://discourse.pi-hole.net/u/robgill)\
**Post date:** [June 5, 2018, 8:56pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/1 "2018-06-05T20:56:01Z")

</div>

There is an [upcoming feature](https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/) in Mozilla Firefox that will use DNS over HTTPS.

As it says in the linked post: **Firefox does not yet use DoH by default.** It has been available on an opt-in basis for some time now for users of nightly builds of Firefox, and at the moment it's running as a [shield test](https://bugzilla.mozilla.org/show_bug.cgi?id=1446404) for builds of Firefox. Assuming the tests all go well, it could well become the default in the future.

Once enabled Firefox will use the proposed DNS over HTTPS protocol, directed by default to a Cloudfare DNS server, but changeable by the user. It will stop using your system's DNS settings, except in cases where it can't get through to the DoH server fast enough.

**What this means for those using Firefox with Pi-hole:** If you're in the study, (or if it becomes the default in a future upgrade) then you might see ads or other content that you would expect to be blocked, and you'll see less traffic in your Pi-hole log. Depending upon the relative speed of the DoH and DNS servers, the relative proportion of lookup traffic handled via each protocol could vary greatly. It will be entirely possible for a particular domain name to be blocked at one time, but not at another, which when combined with browser caching could lead to some odd results with partially blocked content, with things changing somewhat randomly during page-refreshes.

At the moment it's something to be aware of if you run Firefox, and something to consider if your blocking starts to get a bit sketchy.

Personal rants/notes:

1. For me, unless/until there is a way to work with this sort of thing rather than around it, it will simply be another browser feature (similar to chrome's asynchronous dns) to switch off.
2. Yes, I'm aware that DNS over HTTPS isn't the only one with has its hand up (alongside DNS over TLS and DNSCRYPT) to be the new "default" standard for DNS. I've no interest in picking a side, but I would like it very much if there could be one clear winner soon please. Pretty please.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [June 5, 2018, 9:44pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/2 "2018-06-05T21:44:57Z")

</div>

Interesting that Firefox is doing this. In my opinion, running this on a browser is the wrong solution. That's only covering part of your internet traffic. On my home network I have 13 IOT devices, 2 PCs, 3 Macs, 3 iPhones, 2 iPads, 2 Pi's, Samsung tablet - all but one served with a single PiHole (the other serves my Mac and I use that one for experimenting). With a PiHole serving your entire network, you can run DoH with cloudflared (good instructions here [Redirecting...](https://docs.pi-hole.net/guides/dns-over-https/)) and get the same result. The added advantages are the caching of a single PiHole (sees all the requests from your network and more likely to have the answer in cache).

With Firefox running it's own DNS in parallel with a PiHole, you lose the ad-blocking functionality.

Why not just have Firefox get it's DNS service from your PiHole along with all the rest of your devices?

---

<div class="post-metadata">

**Author:** ![sp40140](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/b9bd4f/32.png) [@sp40140](https://discourse.pi-hole.net/u/sp40140)\
**Post date:** [June 5, 2018, 11:54pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/3 "2018-06-05T23:54:25Z")

</div>

If Firefox allows to change the DNS, I don't think it's big issue. We can just change it to Pi-Hole address. Or like Rob suggest turn the feature off.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [June 5, 2018, 11:58pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/4 "2018-06-05T23:58:31Z")

</div>

It would allow you to move it to another DNS over HTTPS server, but not to a DNS server like Pi-hole or Unbound that did not have an HTTPS front end designed for it. But from what I have heard and from my contacts it may not be an easy flag to disable. I raised a concern about Active Directory and other forced DNS locations that require a specific, non-HTTPS resolver and the response was to deploy the Firefox LTS and not use the mainline release.

---

<div class="post-metadata">

**Author:** ![sp40140](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/b9bd4f/32.png) [@sp40140](https://discourse.pi-hole.net/u/sp40140)\
**Post date:** [June 6, 2018, 2:12pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/5 "2018-06-06T14:12:14Z")

</div>

That sucks! I prefer Firefox.

---

<div class="post-metadata">

**Author:** ![R\_V](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/r_v/32/3156_2.png) [@R\_V](https://discourse.pi-hole.net/u/R_V)\
**Post date:** [September 19, 2018, 4:35am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/6 "2018-09-19T04:35:10Z")

</div>

> [@sp40140](#):
>
> That sucks! I prefer Firefox.

I agree and I've been hit with this. Do we know how to point it to pi-hole or turn it off?

---

<div class="post-metadata">

**Author:** ![R\_V](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/r_v/32/3156_2.png) [@R\_V](https://discourse.pi-hole.net/u/R_V)\
**Post date:** [September 19, 2018, 5:07am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/7 "2018-09-19T05:07:18Z")

</div>

actually I found where you can turn it off  
tools, options, general, network settings, settings, uncheck Enable DNS over HTTPS

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [September 19, 2018, 7:09am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/8 "2018-09-19T07:09:56Z")

</div>

If this is the same feature I mentioned [here](https://discourse.pi-hole.net/t/pihole-firefox-cloudflare/11649), the solution is:  
‘network.trr.mode=5’, using ‘about:config’

> [@R\_V](#):
>
> tools, options, general, network settings, settings, uncheck Enable DNS over HTTPS

@R_V could you please check if disabeling it, using the gui, has the same effect?

---

<div class="post-metadata">

**Author:** ![sp40140](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/b9bd4f/32.png) [@sp40140](https://discourse.pi-hole.net/u/sp40140)\
**Post date:** [September 19, 2018, 9:27pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/9 "2018-09-19T21:27:26Z")

</div>

I am running Firefox V62 (64bit) and I don't see any issues yet. And don't see the flag mentioned in settings to disable it!  
What version do you have installed?

---

<div class="post-metadata">

**Author:** ![R\_V](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/r_v/32/3156_2.png) [@R\_V](https://discourse.pi-hole.net/u/R_V)\
**Post date:** [September 19, 2018, 9:41pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/10 "2018-09-19T21:41:31Z")

</div>

> [@jpgpi250](#):
>
> If this is the same feature I mentioned [here](https://discourse.pi-hole.net/t/pihole-firefox-cloudflare/11649), the solution is:  
> ‘network.trr.mode=5’, using ‘about:config’

I couldn't find network.trr.mode when I searched previously. I see it now and it is set to 0.  
so my unchecking "tools, options, general, network settings, settings, uncheck Enable DNS over HTTPS" may have added it.

I can confirm that unchecking tools, options, general, network settings, settings, uncheck Enable DNS over HTTPS works.

For the life of me I could not figure out what was going on. I was checking my host file, I was running ipconfig /flush and /all and couldn't find the problem. On a lark I tried ie and chrome. Both used the pi-hole. When I'd us Firefox nightly I was seeing very little activity on the pi-hole when watching the pihole -t output. The other browser showed a lot of activity. That's when I found this and other threads.

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [September 11, 2019, 9:55am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/11 "2019-09-11T09:55:02Z")

</div>

A post was merged into an existing topic: [[FYI] Google / Chrome: "Experimenting with same-provider DNS-over-HTTPS upgrade"](https://discourse.pi-hole.net/t/fyi-google-chrome-experimenting-with-same-provider-dns-over-https-upgrade/23422/2)

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [September 11, 2019, 10:27am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/12 "2019-09-11T10:27:46Z")

</div>

> [@Support for returning nxdomain for use-application-dns.net to disable Firefox DoH](https://discourse.pi-hole.net/t/support-for-returning-nxdomain-for-use-application-dns-net-to-disable-firefox-doh/23243):
>
> As can be seen in the documentation below, when Firefox starts rolling out DoH they will check the domain use-application-dns.net as a Canary domain to check whether to disable DoH. This would be really useful to have implemented as an option into Pi-Hole so we can have filtering still work in the future. [https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https](https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https)

---

<div class="post-metadata">

**Author:** ![Grady](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/73ab20/32.png) [@Grady](https://discourse.pi-hole.net/u/Grady)\
**Post date:** [February 25, 2020, 11:15pm UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/13 "2020-02-25T23:15:32Z")

</div>

Sorry to necro this thread, but this "feature" was officially released today and there is an option in the settings to add your own DNS entry. Should we just add our Pi-hole address into that?

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [February 26, 2020, 12:13am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/14 "2020-02-26T00:13:33Z")

</div>

No.  
Pi-hole doesnt do DoH.  
Only Do53:

```auto
pi@noads:~ $ sudo netstat -nltup | grep 'Proto\|pihole-FTL'
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN 18952/pihole-FTL
tcp 0 0 127.0.0.1:4711 0.0.0.0:* LISTEN 18952/pihole-FTL
tcp6 0 0 :::53 :::* LISTEN 18952/pihole-FTL
tcp6 0 0 ::1:4711 :::* LISTEN 18952/pihole-FTL
udp 0 0 0.0.0.0:53 0.0.0.0:* 18952/pihole-FTL
udp 0 0 0.0.0.0:67 0.0.0.0:* 18952/pihole-FTL
udp6 0 0 :::53 :::* 18952/pihole-FTL

```

- 4711 is the Pi-hole API and 67 is DHCP

Thanks for the pointer!

---

<div class="post-metadata">

**Author:** ![Grady](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/73ab20/32.png) [@Grady](https://discourse.pi-hole.net/u/Grady)\
**Post date:** [February 26, 2020, 12:15am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/15 "2020-02-26T00:15:34Z")

</div>

Ah, okay. So we should just turn this feature off like the rest of the thread said months ago?

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [February 26, 2020, 12:19am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/16 "2020-02-26T00:19:50Z")

</div>

> [@Grady](#):
>
> So we should just turn this feature off

It wasnt on in the first place for me ???

---

<div class="post-metadata">

**Author:** ![Grady](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/73ab20/32.png) [@Grady](https://discourse.pi-hole.net/u/Grady)\
**Post date:** [February 26, 2020, 12:21am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/17 "2020-02-26T00:21:31Z")

</div>

Right, it wasn't on for me either after the latest update but I was mostly asking if it's recommended to just keep it off since it doesn't work with Pi-hole anyway.

---

<div class="post-metadata">

**Author:** ![deHakkelaar](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dehakkelaar/32/674_2.png) [@deHakkelaar](https://discourse.pi-hole.net/u/deHakkelaar)\
**Post date:** [February 26, 2020, 12:22am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/18 "2020-02-26T00:22:06Z")

</div>

Logic says yes 😃

---

<div class="post-metadata">

**Author:** ![Grady](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/73ab20/32.png) [@Grady](https://discourse.pi-hole.net/u/Grady)\
**Post date:** [February 26, 2020, 12:23am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/19 "2020-02-26T00:23:06Z")

</div>

Haha, thank you!

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [February 26, 2020, 12:25am UTC](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127/20 "2020-02-26T00:25:55Z")

</div>

Firefox DoH opt-out mode is being rolled out for just the United States. We hate ourselves here.

[Next page](https://discourse.pi-hole.net/t/dns-over-https-coming-to-firefox/10127.md?page=2)