How do I enable DNS over HTTPS on Firefox for Android?

Question

I found the option to enable DNS over HTTPS for Firefox on the desktop but I can't find it on the Android version of the browser. Is it supported? How do I enable it?

Answer 1

I try to complete Dale answer

• Open Firefox and type: about:config

• filter with: network.trr.* and set the following values:

  network.trr.mode value 3

  network.trr.bootstrapAddress and set value as one ip from this page (mine value is currently 104.16.249.249)

• now open a new tab to this page used to verify if everything is working. You should have all green except sni. To make all green you should

• switch tab and go back to config page

• change filter with: network.security.* and set:

  network.security.esni.enabled value true

• go back to previous tab and refresh. You should have all green.

credits/references:

• Dale answer

• Mozilla Wiki Page

• u/SKITTLE_LA Reddit answer

Answer 2

Although I have not been able to prove it's really changing the routing of DNS queries, I have changed the settings on Firefox for Android: network.trr.mode to 2 (fail-over enabled) or 3 (fail-over not enabled) and network.trr.uri to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) or 9.9.9.9 (Quad9). This came from this Mozilla page (not specific to Android Firefox). So you type about:config in the address bar, then search for and change the network.trr* settings.

But as mentioned by Irfan, you can have all your DNS go to cloudflare by using their 1.1.1.1 app, or if you're on the Android Pie, you can go to Settings > Network & Internet > Private DNS and select Automatic (I'm sure that's GOT to be Google's 9.9.9.9) or Private DNS provider hostname with 1dot1dot1dot1.cloudflare-dns.com, for instance (credit to this page on TechRepublic).

Answer 3

Things have changed since the time most of the answers were written so here's an updated version:

• The previous TRR (Trusted recursive resolver ) only encrypted the SNI(server name indication) which proved to be insufficient in masking your DNS queries. It has been shown that DNS queries , especially the SNI can still be leaked. So a new draft has been proposed which suggest to encrypt the entire 'Client Hello' message. This new draft (initially called draft 8) has been now referred to as ECH (encrypted client Hello). And it still under development, no browser have yet released it for production. This upgraded version would require all DNS servers to implement it for it to work properly. And as of date not many (I think none) have it working. Meanwhile firefox had removed Encrypt SNI since version 85. It would replaced by ECH in near future.

Though one can still enable DoH (DNS over HTTPS) or TRR(Trusted Recursive Resolver ) as Mozilla calls it.

From the firefox nightly version, go to about:config

then turn network.trr.mode to 2 or 3 depending on whether you want to fail the request if TRR fails to resolve the address or use a fallback default (your ISP) as your resolver.

firefox has cloudflare's 1.1.1.1 set as the default TRR so you don't have to change anything else.

In the absence of Encrypted SNI, it won't be as secure but still be able to access some DNS blocked sites because most of the ISP's still don't have the means to find out. Some ISP that have advanced DPI( deep packet inspection) means would be able to detect it though