DNSOverHTTPS

Configure DNS over HTTPS.

DNS over HTTPS (DoH) sends DNS lookups over an encrypted HTTPS connection to a trusted resolver instead of sending them in plain text to a local resolver. This makes it harder for the network to see or modify lookups, but they no longer go through your DNS infrastructure unless you use a ProviderURL.

Compatibility

Firefox	Firefox ESR	Firefox Enterprise
Available since 63	Available since 68	Available since 149

ExcludedDomains added in 75/68.7, Fallback added in 124.

CCK2 Equivalent: N/A
OMA-URI: DNSOverHTTPS
Preferences Affected: network.trr.mode, network.trr.uri, network.trr.excluded-domains

Examples

{
  "policies": {
    "DNSOverHTTPS": {
      "Enabled": true,
      "ProviderURL": "https://dns.example.com/dns-query",
      "Locked": true,
      "ExcludedDomains": [
        "example.com"
      ],
      "Fallback": true
    }
  }
}

JSON schema

{
  "type": "object",
  "properties": {
    "Enabled": {
      "type": "boolean"
    },
    "ProviderURL": {
      "type": "string",
      "anyOf": [
        {
          "format": "uri"
        },
        {
          "maxLength": 0
        }
      ]
    },
    "ExcludedDomains": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "Fallback": {
      "type": "boolean"
    },
    "Locked": {
      "type": "boolean"
    }
  }
}

Values

Enabled determines whether DNS over HTTPS is enabled.
ProviderURL is a URL to a DOH provider. If it is not set, Firefox uses its own default provider.
Locked prevents the user from changing DNS over HTTPS preferences.
ExcludedDomains excludes domains from DNS over HTTPS, so they are resolved by the system resolver instead. Use this for internal hostnames that only your own DNS servers can resolve.
Fallback determines whether or not Firefox will use your default DNS resolver if there is a problem with the secure DNS provider.

Enabled and Fallback together set the network.trr.mode preference:

`Enabled`	`Fallback`	`network.trr.mode`	Behavior
`true`	`true` (default)	2	Firefox tries DNS over HTTPS first and falls back to the system resolver.
`true`	`false`	3	Firefox only uses DNS over HTTPS, and a failed lookup is an error.
`false`	not applicable	5	DNS over HTTPS is off.

Windows (GPO)

Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Fallback = 0x1 | 0x0

macOS

<dict>
  <key>DNSOverHTTPS</key>
  <dict>
    <key>Enabled</key>
    <true/> | <false/>
    <key>ProviderURL</key>
    <string>URL_TO_ALTERNATE_PROVIDER</string>
    <key>Locked</key>
    <true/> | <false/>
    <key>ExcludedDomains</key>
    <array>
      <string>example.com</string>
    </array>
    <key>Fallback</key>
    <true/> | <false/>
  </dict>
</dict>