System DNS vs. Private DoH Resolver for Internal Hostname Privacy
0 reputation · 03 Sept 2023, 07:30 UTC
Firefox's DNS over HTTPS (DoH) feature can inadvertently send internal network queries to public resolvers, potentially exposing private hostnames. To prevent this leak, administrators must decide between relying on the local operating system's DNS configuration or deploying a dedicated internal DoH endpoint.
The first approach involves disabling DoH entirely via network.trr.mode = 0, which forces the browser to utilize the system's native resolver. The second approach maintains encrypted DNS by configuring network.trr.uri to point to a private internal resolver while setting network.trr.mode to 2.
The choice depends on whether the priority is reducing infrastructure complexity or maintaining end-to-end encryption for internal queries.
- Which configuration is more resilient against DNS leaks when the system DNS is itself configured to use a public upstream provider?
- What are the trade-offs regarding query latency and reliability when switching from system DNS to a private DoH endpoint?
firefox