In Firefox and Chrome there is a feature in the way input search queries are processed in the address bar that leads to the leakage of information through the provider's DNS server. The essence of the problem is that if the search query consists of a single word, the browser first attempts to use DNS to determine whether a host with that name exists, assuming the user is trying to open a subdomain, and then redirects the query to the search engine. Thus, the owner of the DNS server specified in the user's settings receives information about single-word search queries, which is considered a violation of privacy.
The issue manifests when using both the provider's DNS server and 'DNS over HTTPS' (DoH) services, particularly when a DNS suffix is set in the settings (default is established when obtaining parameters via DHCP). Importantly, even when DoH is enabled, queries continue to be sent through the DNS server specified in the system.
It is essential to note that resolution attempts occur only when sending search queries consisting of a single word. When multiple words are used, DNS resolution does not take place.
The problem has been confirmed in Firefox and Chrome, and may also affect other browsers. Firefox developers have acknowledged the issue and provide a solution in the Firefox 79 release. In particular, to manage the behavior regarding search queries in about:config, "browser.urlbar.dnsResolveSingleWordsAfterSearch", when set to "0" blocks resolution, "1" (default) uses heuristic selective resolution, and "2" retains the old behavior. The heuristic checking whether DoH is enabled, having only a record for ‘localhost’ in /etc/hosts, and the absence of a subdomain for the current host.
Chrome developers aim to limit DNS leakage, but related to a similar problem remains unresolved since 2015. This problem does not manifest in the Tor Browser.
Source: opennet.ru
