Mozilla an agreement with a third DNS provider for DNS over HTTPS (DoH) for Firefox. In addition to the previously offered CloudFlare DNS servers ("https://1.1.1.1/dns-query") and (), the Comcast service (https://doh.xfinity.com/dns-query) will also be included in the settings. You can activate DoH and choose the network connection settings.
Recall that in Firefox 77, an experimental check for DNS over HTTPS was enabled, where 10 test requests were sent by each client, and the DoH provider was automatically selected. This check had to be disabled in the release , as it turned into a sort of DDoS attack on the NextDNS service, which couldn't handle the load.
The DoH providers offered in Firefox are selected based on for trustworthy DNS resolvers, according to which a DNS operator may use the obtained data for resolution purposes only to ensure service operation, must not retain logs for longer than 24 hours, cannot share data with third parties, and must disclose methods of data processing. The service must also commit not to censor, filter, interfere with, or block DNS traffic, except in situations provided for by law.
Among the related DNS-over-HTTPS events, it is also worth noting by Apple to implement support for DNS-over-HTTPS and DNS-over-TLS in future releases of iOS 14 and macOS 11, as well as support for WebExtension format extensions in Safari.
Remember that DoH can be valuable for preventing leaks of requested hostnames through DNS servers operated by providers, combating MITM attacks and DNS traffic interception (for example, when connecting to public Wi-Fi), resisting DNS-level blocks (DoH cannot replace VPNs in circumventing blocks implemented at the DPI level), or for facilitating operation when direct access to DNS servers is not possible (for example, when working through a proxy). In a normal situation, DNS queries are sent directly to the DNS servers specified in the system's configuration, but with DoH, the request to resolve the host's IP address is encapsulated in HTTPS traffic and sent to an HTTP server where the resolver processes the requests via Web API. The existing DNSSEC standard uses encryption solely for client and server authentication, but does not protect traffic from interception and does not guarantee the confidentiality of requests.
Source: opennet.ru
