12

I found the option to enable DNS over HTTPS for Firefox on the desktop but I can't find it on the Android version of the browser. Is it supported? How do I enable it?

0
8

I try to complete Dale answer

  • Open Firefox and type: about:config

  • filter with: network.trr.* and set the following values:

    network.trr.mode value 3

    network.trr.bootstrapAddress and set value as one ip from this page (mine value is currently 104.16.249.249)

  • now open a new tab to this page used to verify if everything is working. You should have all green except sni. To make all green you should

  • switch tab and go back to config page

  • change filter with: network.security.* and set:

    network.security.esni.enabled value true

  • go back to previous tab and refresh. You should have all green.

credits/references:

3
  • I needed this because my mobile data DNS is failing for some addresses. After setting network.trr.mode=3 and network.trr.bootstrapAddress=104.16.249.249 it works! Thanks!
    – krubo
    Jan 9 '20 at 0:34
  • 2
    This seems either outdated or wrong. Typing about:config in Firefox Android does nothing (the contents of the view does not change) Apr 26 '21 at 15:09
  • @RomualdBrunet you have to use firefox nightly version app for android to be able to access the config page
    – Zen
    Apr 29 '21 at 15:19
3

Although I have not been able to prove it's really changing the routing of DNS queries, I have changed the settings on Firefox for Android: network.trr.mode to 2 (fail-over enabled) or 3 (fail-over not enabled) and network.trr.uri to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google) or 9.9.9.9 (Quad9). This came from this Mozilla page (not specific to Android Firefox). So you type about:config in the address bar, then search for and change the network.trr* settings.

But as mentioned by Irfan, you can have all your DNS go to cloudflare by using their 1.1.1.1 app, or if you're on the Android Pie, you can go to Settings > Network & Internet > Private DNS and select Automatic (I'm sure that's GOT to be Google's 9.9.9.9) or Private DNS provider hostname with 1dot1dot1dot1.cloudflare-dns.com, for instance (credit to this page on TechRepublic).

2
  • 2
    You'd have to set the network.trr.mode to 3 to test if it's really working. Mode 2 uses regular DNS as a backup if DOH fails, so you won't really know if you're using DOH if you don't test it in mode 3 first.
    – John
    Aug 19 '19 at 16:53
  • For some reason using network.trr.mode to 3 fails to work when I'm on mobile data, but works fine when I'm on WiFi.
    – m-p-3
    Oct 14 '19 at 1:21
0

Things have changed since the time most of the answers were written so here's an updated version:

  • The previous TRR (Trusted recursive resolver ) only encrypted the SNI(server name indication) which proved to be insufficient in masking your DNS queries. It has been shown that DNS queries , especially the SNI can still be leaked. So a new draft has been proposed which suggest to encrypt the entire 'Client Hello' message. This new draft (initially called draft 8) has been now referred to as ECH (encrypted client Hello). And it still under development, no browser have yet released it for production. This upgraded version would require all DNS servers to implement it for it to work properly. And as of date not many (I think none) have it working. Meanwhile firefox had removed Encrypt SNI since version 85. It would replaced by ECH in near future.

Though one can still enable DoH (DNS over HTTPS) or TRR(Trusted Recursive Resolver ) as Mozilla calls it.

From the firefox nightly version, go to about:config

then turn network.trr.mode to 2 or 3 depending on whether you want to fail the request if TRR fails to resolve the address or use a fallback default (your ISP) as your resolver.

firefox has cloudflare's 1.1.1.1 set as the default TRR so you don't have to change anything else.

In the absence of Encrypted SNI, it won't be as secure but still be able to access some DNS blocked sites because most of the ISP's still don't have the means to find out. Some ISP that have advanced DPI( deep packet inspection) means would be able to detect it though

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.