I found the option to enable DNS over HTTPS for Firefox on the desktop but I can't find it on the Android version of the browser. Is it supported? How do I enable it?
I try to complete Dale answer
Open Firefox and type:
network.trr.*and set the following values:
network.trr.bootstrapAddressand set value as one ip from this page (mine value is currently
now open a new tab to this page used to verify if everything is working. You should have all green except
sni. To make all green you should
switch tab and go back to config page
change filter with:
go back to previous tab and refresh. You should have all green.
Although I have not been able to prove it's really changing the routing of DNS queries, I have changed the settings on Firefox for Android:
2 (fail-over enabled) or
3 (fail-over not enabled) and
18.104.22.168 (Cloudflare) or
22.214.171.124 (Google) or 126.96.36.199 (Quad9). This came from this Mozilla page (not specific to Android Firefox). So you type
about:config in the address bar, then search for and change the
But as mentioned by Irfan, you can have all your DNS go to cloudflare by using their 188.8.131.52 app, or if you're on the Android Pie, you can go to
Settings > Network & Internet > Private DNS and select
Automatic (I'm sure that's GOT to be Google's 184.108.40.206) or
Private DNS provider hostname with
1dot1dot1dot1.cloudflare-dns.com, for instance (credit to this page on TechRepublic).
Things have changed since the time most of the answers were written so here's an updated version:
- The previous TRR (Trusted recursive resolver ) only encrypted the SNI(server name indication) which proved to be insufficient in masking your DNS queries. It has been shown that DNS queries , especially the SNI can still be leaked. So a new draft has been proposed which suggest to encrypt the entire 'Client Hello' message. This new draft (initially called draft 8) has been now referred to as ECH (encrypted client Hello). And it still under development, no browser have yet released it for production. This upgraded version would require all DNS servers to implement it for it to work properly. And as of date not many (I think none) have it working. Meanwhile firefox had removed Encrypt SNI since version 85. It would replaced by ECH in near future.
Though one can still enable DoH (DNS over HTTPS) or TRR(Trusted Recursive Resolver ) as Mozilla calls it.
From the firefox nightly version, go to
network.trr.mode to 2 or 3 depending on whether you want to fail the request if TRR fails to resolve the address or use a fallback default (your ISP) as your resolver.
firefox has cloudflare's 220.127.116.11 set as the default TRR so you don't have to change anything else.
In the absence of Encrypted SNI, it won't be as secure but still be able to access some DNS blocked sites because most of the ISP's still don't have the means to find out. Some ISP that have advanced DPI( deep packet inspection) means would be able to detect it though