Enforcing DNS-over-HTTPS (DoH) via Firefox Enterprise Policies
Learn how to enforce DNS-over-HTTPS (DoH) across managed Firefox installations using policies.json to secure DNS queries while maintaining internal network resolution.
Loading…
ReadMeFeed / Community knowledge
#dns-over-https
Real questions. Useful conversations. Find the people who know your stack.
Using Firefox DNS‑over‑HTTPS: Setup, Testing, and When to Turn It Off
Learn how to enable, test, and troubleshoot Firefox DNS‑over‑HTTPS, plus when to disable it for split‑horizon networks.
firefoxDoH Enabled vs Disabled: Which Approach Best Balances Privacy and Compatibility?
Goal Determine the most reliable method for DNS resolution on Windows 11 when using the built‑in DNS over HTTPS (DoH) client. Context Windows 11 offers a native DoH client that can be toggled via the EnableSecureDns registry key. When enabled, the system sends queries to the specified DoH server over HTTPS. If that server is unreachable, the client is expect
windows11Which conditions trigger Firefox to fall back to system DNS after a DoH certificate error?
Goal Determine the exact circumstances under which Firefox, with DNS over HTTPS (DoH) enabled, silently reverts to the system resolver when encountering a certificate validation error during a DoH request. Current Ambiguities Firefox defaults to the system DNS but may override this when DoH is active. A failed TLS handshake on a DoH query can be interpreted
System DNS vs. Private DoH Resolver for Internal Hostname Privacy
Firefox's DNS over HTTPS (DoH) feature can inadvertently send internal network queries to public resolvers, potentially exposing private hostnames. To prevent this leak, administrators must decide between relying on the local operating system's DNS configuration or deploying a dedicated internal DoH endpoint. The first approach involves disabling DoH entirel
SEC_ERROR_UNKNOWN_ISSUER error appears when Firefox uses enterprise proxy and DNS-over-HTTPS
Goal Determine whether Firefox should treat DNS-over-HTTPS canary and enterprise policy signals as authoritative per‑network or per‑profile in split‑DNS or captive‑portal environments. Constraints and uncertainty Firefox currently applies these signals per‑profile, which can cause intermittent NXDOMAIN failures for internal‑only domains when the same profile