DNSOverHTTPS

Configure DNS over HTTPS.

Compatibility: Firefox 63, Firefox ESR 68 (ExcludedDomains added in 75/68.7) (Fallback added in 124)
CCK2 Equivalent: N/A
Preferences Affected: network.trr.mode, network.trr.uri

Examples

{
  "policies": {
    "DNSOverHTTPS": {
      "Enabled": true,
      "ProviderURL": "https://dns.example.com/dns-query",
      "Locked": true,
      "ExcludedDomains": [
        "example.com"
      ],
      "Fallback": true
    }
  }
}

JSON schema

{
  "type": "object",
  "properties": {
    "Enabled": {
      "type": "boolean"
    },
    "ProviderURL": {
      "type": "string",
      "anyOf": [
        {
          "format": "uri"
        },
        {
          "maxLength": 0
        }
      ]
    },
    "ExcludedDomains": {
      "type": "array",
      "items": {
        "type": "string"
      }
    },
    "Fallback": {
      "type": "boolean"
    },
    "Locked": {
      "type": "boolean"
    }
  }
}

Values

Enabled determines whether DNS over HTTPS is enabled
ProviderURL is a URL to another provider.
Locked prevents the user from changing DNS over HTTPS preferences.
ExcludedDomains excludes domains from DNS over HTTPS.
Fallback determines whether or not Firefox will use your default DNS resolver if there is a problem with the secure DNS provider.

Windows (GPO)

Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ProviderURL = "URL_TO_ALTERNATE_PROVIDER"
Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Locked = 0x1 | 0x0
Software\Policies\Mozilla\Firefox\DNSOverHTTPS\ExcludedDomains\1 = "example.com"
Software\Policies\Mozilla\Firefox\DNSOverHTTPS\Fallback = 0x1 | 0x0

Windows (Intune)

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Enabled

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ProviderURL

Value (string):

<enabled/>
<data id="String" value="URL_TO_ALTERNATE_PROVIDER"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Locked

Value (string):

<enabled/> or <disabled/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_ExcludedDomains

Value (string):

<enabled/>
<data id="List" value="1&#xF000;example.com"/>

OMA-URI:

./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox~DNSOverHTTPS/DNSOverHTTPS_Fallback

Value (string):

<enabled/> or <disabled/>

macOS

<dict>
  <key>DNSOverHTTPS</key>
  <dict>
    <key>Enabled</key>
    <true/> | <false/>
    <key>ProviderURL</key>
    <string>URL_TO_ALTERNATE_PROVIDER</string>
    <key>Locked</key>
    <true/> | <false/>
    <key>ExcludedDomains</key>
    <array>
      <string>example.com</string>
    </array>
    <key>Fallback</key>
    <true/> | <false/>
  </dict>
</dict>