Using Firefox DNS‑over‑HTTPS: Setup, Testing, and When to Turn It Off

Why DNS‑over‑HTTPS matters in Firefox

When you type a URL, Firefox first resolves the hostname to an IP address. By default this lookup uses plain UDP DNS, which anyone on the network can see. Enabling DNS‑over‑HTTPS (DoH) wraps that query in an encrypted HTTPS request to a resolver such as Cloudflare 1.1.1.1, hiding the domain names from eavesdroppers.

Enabling and customizing DoH

Open about:preferences#privacy and toggle Enable DNS over HTTPS. The dropdown lets you pick Cloudflare, NextDNS, or a custom URI.

For finer control you can use about:config:

• network.trr.mode – 0 =off, 1 =automatic (default), 2 =DoH only, 3 =DoH then fallback.
• network.trr.uri – the HTTPS endpoint, e.g. https://cloudflare-dns.com/dns-query.

Verifying that DoH is working

From a terminal you can send the same GET request Firefox uses:

curl -v 'https://cloudflare-dns.com/dns-query?name=example.com&type=A'

Look for a JSON payload containing the Answer section. If you see it, the resolver is reachable and Firefox would get the same encrypted response.

Inside Firefox, open the Developer Tools → Network tab, filter for dns-query, reload a page, and you should see a request to the DoH URI with status 200 and a JSON response.

When DoH can cause problems and what to do

In networks that rely on split‑horizon DNS (e.g., corporate intranets or captive‑portal Wi‑Fi), sending all queries to an external DoH resolver bypasses local name servers. This can prevent:

• Resolution of internal hostnames.
• Display of captive‑portal login pages.

To keep browsing working you have two practical options:

1. Switch network.trr.mode back to 0 (off) or 1 (automatic) so Firefox falls back to plain UDP when the DoH endpoint fails.
2. Use a private DoH resolver that mirrors your internal zones (some enterprises run their own DoH endpoint).

You can test the impact quickly: after changing network.trr.mode to 2 (DoH‑only), try to reach an internal site like intranet.example.com. If it fails, revert the mode.

Trade‑offs and how to check the result

Performance measurements show DoH adds roughly 10‑30 ms per query compared with plain UDP. For most users this latency is acceptable given the privacy gain. To verify that the extra latency is not hurting your experience:

• Use about:networking#dns (or the network.dns.disablePrefetch pref) to view recent query timings.
• Compare page‑load times with DoH enabled vs. disabled using the Firefox Profiler or a simple stop‑watch test on a repeatable page.

If you notice a consistent slowdown that interferes with work, switch to automatic mode (network.trr.mode = 1) which lets Firefox fall back to UDP when the DoH resolver is slow.

Actionable checklist

1. Open about:preferences#privacy and confirm DoH is enabled or disabled as you need.
2. Run the curl command above to ensure the DoH endpoint is reachable.
3. Check the Network tab for dns-query requests to confirm Firefox is using the encrypted path.
4. If you are on a split‑horizon or captive‑portal network, set network.trr.mode to 1 (automatic) or 0 (off) and test internal name resolution.
5. Monitor latency via the DNS timing view in about:networking and adjust the mode if the added delay is problematic.