{"id":71411,"date":"2020-02-26T03:10:13","date_gmt":"2020-02-26T00:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha"},"modified":"2020-03-03T16:10:46","modified_gmt":"2020-03-03T13:10:46","slug":"dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","title":{"rendered":"DNS-over-HTTPS is enabled by default in Firefox for users in the US.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firefox Developers announced<\/a><\/noindex> on enabling DNS over HTTPS (DoH) by default for users in the USA. Encrypting DNS traffic is considered a crucial factor for user protection. Starting today, DoH is activated by default for all new installations performed by users in the USA. Existing users in the USA are expected to be switched to DoH over the next few weeks. In the European Union and other countries, activating DoH by default is not planned yet. not planned.<\/a><\/noindex>.<\/p>\n

After activating DoH, the user receives a warning that allows them to opt out of using centralized DoH DNS servers and revert to the traditional method of sending unencrypted requests to the provider's DNS server. Instead of a distributed infrastructure of DNS resolvers, DoH binds to a specific DoH service, which can be seen as a single point of failure. Currently, two DNS providers are offered \u2014 CloudFlare (by default) and NextDNS<\/a><\/noindex>. <\/p>\n

\"DNS-over-HTTPS<\/a><\/noindex><\/center><\/p>\n

Change the provider or disable DoH in<\/a><\/noindex> in the network connection settings. For example, one can specify an alternative DoH server 'https:\/\/dns.google\/dns-query' to access Google's servers, 'https:\/\/dns.quad9.net\/dns-query' \u2014 Quad9, and 'https:\/\/doh.opendns.com\/dns-query' \u2014 OpenDNS. In about:config, there is also a setting for network.trr.mode, through which the mode of DoH operation can be changed: value 0 completely disables DoH; 1 \u2014 DNS or DoH is used, depending on what is faster; 2 \u2014 DoH is used by default, with DNS as a fallback; 3 \u2014 only DoH is used; 4 \u2014 mirroring mode where both DoH and DNS are used in parallel. <\/p>\n

Remember that DoH can be valuable for preventing leaks of requested hostnames through DNS servers operated by providers, combating MITM attacks and DNS traffic interception (for example, when connecting to public Wi-Fi), resisting DNS-level blocks (DoH cannot replace VPNs in circumventing blocks implemented at the DPI level), or for facilitating operation when direct access to DNS servers is not possible (for example, when working through a proxy). In a normal situation, DNS queries are sent directly to the DNS servers specified in the system's configuration, but with DoH, the request to resolve the host's IP address is encapsulated in HTTPS traffic and sent to an HTTP server where the resolver processes the requests via Web API. The existing DNSSEC standard uses encryption solely for client and server authentication, but does not protect traffic from interception and does not guarantee the confidentiality of requests. <\/p>\n

Requirements have been formulated for the selection of DoH providers offered in Firefox. requirements.<\/a><\/noindex> for trustworthy DNS resolvers, according to which a DNS operator may use the obtained data for resolution purposes only to ensure service operation, must not retain logs for longer than 24 hours, cannot share data with third parties, and must disclose methods of data processing. The service must also commit not to censor, filter, interfere with, or block DNS traffic, except in situations provided for by law. <\/p>\n

DoH should be used with caution. For example, in the Russian Federation, the IP addresses 104.16.248.249 and 104.16.249.249, associated with the default DoH server mozilla.cloudflare-dns.com offered in Firefox, are blacklisted.<\/a><\/noindex> downward API support (simultaneously with this in the lists<\/a><\/noindex> locks<\/a><\/noindex> of Roskomnadzor<\/a><\/noindex> by court order from Stavropol dated 10.06.2013.<\/p>\n

The use of DoH can also lead to issues in areas such as parental control systems, access to internal namespaces in corporate systems, route selection in content delivery optimization systems, and the execution of court orders aimed at combating the distribution of illegal content and abuse of minors. To circumvent such problems, a verification system has been implemented and tested that automatically disables DoH under certain conditions. <\/p>\n

To determine corporate resolvers, checks on unusual top-level domains (TLDs) are performed, and intranet addresses are returned by the system resolver. To check for parental control, an attempt to resolve the name exampleadultsite.com is made, and if the result does not match the actual IP, it is assumed that adult content blocking is active at the DNS level. Additionally, the IP addresses of Google and YouTube are checked for substitution with restrict.youtube.com, forcesafesearch.google.com, and restrictmoderate.youtube.com. These checks allow attackers controlling the resolver or able to intercept traffic to simulate such behavior to disable DNS traffic encryption.<\/p>\n

Working through a single DoH service can potentially lead to traffic optimization issues in content delivery networks that perform load balancing using DNS (the CDN network's DNS server formulates a response based on the resolver's address and issues the nearest host for content retrieval). Sending a DNS query from a resolver closest to the user in such CDNs results in returning the address of the host nearest to the user, but when sending a DNS query from a centralized resolver, the address of the host closest to the DNS-over-HTTPS server will be issued. Practical testing has shown that using DNS-over-HTTP with CDNs practically did not lead to delays before content delivery begins (for fast connections, delays did not exceed 10 milliseconds, and even acceleration was observed on slow channels). The use of the EDNS Client Subnet extension was also considered to convey the client's location to the CDN resolver.<\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 DNS \u043f\u043e\u0432\u0435\u0440\u0445 HTTPS (DoH, DNS over HTTPS) \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410. \u0428\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u0435 DNS-\u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u0430\u0436\u043d\u044b\u0439 \u0444\u0430\u043a\u0442\u043e\u0440 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0433\u043e \u0434\u043d\u044f \u0432\u043e \u0432\u0441\u0435\u0445 \u043d\u043e\u0432\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430\u0445, \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438\u0437 \u0421\u0428\u0410, DoH \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043d\u0430 DoH \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71412,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71411","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DNS-over-HTTPS is enabled by default in Firefox for users in the US | ProHoster","description":"Firefox developers have announced that it is enabled by default.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DNS-over-HTTPS \u0432\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432 Firefox \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0421\u0428\u0410 | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 Firefox \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/dns-over-https-vklyuchyon-po-umolchaniyu-v-firefox-dlya-polzovatelej-iz-ssha","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-26T00:10:13+00:00","article:modified_time":"2020-03-03T13:10:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71411","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:02:24","updated":"2022-10-03 11:24:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/71411","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=71411"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/71411\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/71412"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=71411"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=71411"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=71411"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}