Firefox to start rolling out dns-over-https this month

Firefox begins rolling out dns-over-https for US users. DNS queries are now redirected and encrypted in the browser via Cloudflare, so that it is no longer possible to find out which websites a specific user is requesting.

Mozilla says it will begin further rollout of the configuration later this month. The browser maker has been working on dns-over-https since 2017, and started a more extensive test among users last year. Those experiments were intended to see if users ran into problems, but according to Mozilla that seems to be not so bad. The company says only 4.3 percent of users turn on parental controls or safe search. These processes are based, among other things, on DNS requests. DNS over https would make that more difficult. Mozilla also saw a few problems with websites with non-public domain name additions.

The feature is now enabled by default, but users can opt-out of it. At the moment, the opposite is possible in Firefox. In corporate configurations, dns-over-https is off by default so that system administrators don’t run into problems. If problems arise for users, Firefox can also fall back to the default DNS settings of the operating system.

Firefox uses Cloudflare’s 1.1.1.1 DNS resolver for the service. The company has already collaborated with this in tests. However, the company says that may change as other suitable domain resolvers become available.

With dns-over-https, a dns query is encrypted with tls encryption. As a result, other parties such as providers can no longer monitor which web pages specific users request. There is also an alternative, dns-over-tls, but it is less popular. This is because a specific TLS port must be used that can be easily closed by, for example, a provider. Dns-over-https runs just like all tls traffic over port 443, which is therefore not so easy to block.

Although at first glance the decision seems good for the privacy of users, not everyone is happy with the decision. In England, where stricter internet rules apply, internet providers were not happy with the plan for a long time. Critics also point to the fact that Cloudflare is a US company and therefore governed by that country’s rules, and that dns-over-https may be slower than regular traffic.