Firefox Developers on enabling DNS over HTTPS (DoH) by default for users in the USA. Encrypting DNS traffic is considered a crucial factor for user protection. Starting today, DoH is activated by default for all new installations performed by users in the USA. Existing users in the USA are expected to be switched to DoH over the next few weeks. In the European Union and other countries, activating DoH by default is not planned yet. .
After DoH activation, the user receives a warning that allows them to opt out of using centralized DoH DNS servers and return to the traditional method of sending unencrypted requests to the provider's DNS server. Instead of a distributed infrastructure of DNS resolvers, DoH is tied to a specific DoH service, which can be seen as a single point of failure. Currently, work is offered through two DNS providers — CloudFlare (by default) and .
Change the provider or disable DoH in the network connection settings. For example, you can specify an alternative DoH server like "https://dns.google/dns-query" to connect to Google servers, "https://dns.quad9.net/dns-query" for Quad9, and "https://doh.opendns.com/dns-query" for OpenDNS. In about:config, there is also a setting for network.trr.mode, which allows you to change the DoH operation mode: value 0 completely disables DoH; 1 uses DNS or DoH depending on which is faster; 2 uses DoH by default, with DNS as a fallback; 3 uses only DoH; 4 is a mirroring mode where DoH and DNS are used simultaneously.
Remember that DoH can be valuable for preventing leaks of requested hostnames through DNS servers operated by providers, combating MITM attacks and DNS traffic interception (for example, when connecting to public Wi-Fi), resisting DNS-level blocks (DoH cannot replace VPNs in circumventing blocks implemented at the DPI level), or for facilitating operation when direct access to DNS servers is not possible (for example, when working through a proxy). In a normal situation, DNS queries are sent directly to the DNS servers specified in the system's configuration, but with DoH, the request to resolve the host's IP address is encapsulated in HTTPS traffic and sent to an HTTP server where the resolver processes the requests via Web API. The existing DNSSEC standard uses encryption solely for client and server authentication, but does not protect traffic from interception and does not guarantee the confidentiality of requests.
Requirements have been formulated for the selection of DoH providers offered in Firefox. for trustworthy DNS resolvers, according to which a DNS operator may use the obtained data for resolution purposes only to ensure service operation, must not retain logs for longer than 24 hours, cannot share data with third parties, and must disclose methods of data processing. The service must also commit not to censor, filter, interfere with, or block DNS traffic, except in situations provided for by law.
DoH should be used with caution. For example, in the Russian Federation, the IP addresses 104.16.248.249 and 104.16.249.249, associated with the default DoH server mozilla.cloudflare-dns.com offered in Firefox, downward API support (simultaneously with this in by court order from Stavropol dated 10.06.2013.
The use of DoH can also lead to issues in areas such as parental control systems, access to internal namespaces in corporate systems, route selection in content delivery optimization systems, and the execution of court orders aimed at combating the distribution of illegal content and abuse of minors. To circumvent such problems, a verification system has been implemented and tested that automatically disables DoH under certain conditions.
To determine corporate resolvers, checks on unusual top-level domains (TLDs) are performed, and intranet addresses are returned by the system resolver. To check for parental control, an attempt to resolve the name exampleadultsite.com is made, and if the result does not match the actual IP, it is assumed that adult content blocking is active at the DNS level. Additionally, the IP addresses of Google and YouTube are checked for substitution with restrict.youtube.com, forcesafesearch.google.com, and restrictmoderate.youtube.com. These checks allow attackers controlling the resolver or able to intercept traffic to simulate such behavior to disable DNS traffic encryption.
Working through a single DoH service can potentially lead to traffic optimization issues in content delivery networks that perform load balancing using DNS (the CDN network's DNS server formulates a response based on the resolver's address and issues the nearest host for content retrieval). Sending a DNS query from a resolver closest to the user in such CDNs results in returning the address of the host nearest to the user, but when sending a DNS query from a centralized resolver, the address of the host closest to the DNS-over-HTTPS server will be issued. Practical testing has shown that using DNS-over-HTTP with CDNs practically did not lead to delays before content delivery begins (for fast connections, delays did not exceed 10 milliseconds, and even acceleration was observed on slow channels). The use of the EDNS Client Subnet extension was also considered to convey the client's location to the CDN resolver.
Source: opennet.ru
