Security/DNS Over HTTPS - Revision history

Janbrasna: Update source location to toolkit

2026-08-13T09:39:21Z

Update source location to toolkit

← Older revision		Revision as of 09:39, 13 August 2026
Line 1:		Line 1:
	This article describes the various mechanics of Firefox's DNS over HTTPS (DoH) frontend. See [[Trusted Recursive Resolver]] for details on TRR implementation in necko.		This article describes the various mechanics of Firefox's DNS over HTTPS (DoH) frontend. See [[Trusted Recursive Resolver]] for details on TRR implementation in necko.

	'''Implementation:''' https://searchfox.org/~~mozilla~~-~~central~~/source/~~browser~~/components/doh		'''Implementation:''' https://searchfox.org/firefox-main/source/toolkit/components/doh

	== Flow Diagram ==		== Flow Diagram ==
Line 43:		Line 43:

	See also:		See also:
	# https://searchfox.org/~~mozilla~~-~~central~~/source/~~browser~~/components/doh/TRRPerformance.~~jsm~~		# https://searchfox.org/firefox-main/source/toolkit/components/doh/TRRPerformance.sys.mjs

	==== Dry-Run Mechanism ====		==== Dry-Run Mechanism ====

Valentin.gosu: Minor change clarifying that doh.test must include an A or AAAA record in the response.

2024-08-19T16:37:41Z

Minor change clarifying that doh.test must include an A or AAAA record in the response.

← Older revision		Revision as of 16:37, 19 August 2024
Line 60:		Line 60:
	* A DoH endpoint discovered in this manner takes precedence over the automatically chosen default provider (see Default Provider Selection above).		* A DoH endpoint discovered in this manner takes precedence over the automatically chosen default provider (see Default Provider Selection above).
	* A provider (endpoint + expected CNAME for discovery) must be explicitly supported for this mechanism to work.		* A provider (endpoint + expected CNAME for discovery) must be explicitly supported for this mechanism to work.
			* The CNAME record must point to a domain that has an A or AAAA record, otherwise getaddrinfo will return NXDOMAIN.
	* Currently, Comcast (US) and Shaw (CA) are our only supported providers.		* Currently, Comcast (US) and Shaw (CA) are our only supported providers.
	* This feature is controlled by the pref `doh-rollout.provider-steering.enabled`.		* This feature is controlled by the pref `doh-rollout.provider-steering.enabled`.

Valentin.gosu: /* Provider Steering */ Update supported steering providers.

2023-12-06T09:36:43Z

Provider Steering: Update supported steering providers.

← Older revision		Revision as of 09:36, 6 December 2023
Line 60:		Line 60:
	* A DoH endpoint discovered in this manner takes precedence over the automatically chosen default provider (see Default Provider Selection above).		* A DoH endpoint discovered in this manner takes precedence over the automatically chosen default provider (see Default Provider Selection above).
	* A provider (endpoint + expected CNAME for discovery) must be explicitly supported for this mechanism to work.		* A provider (endpoint + expected CNAME for discovery) must be explicitly supported for this mechanism to work.
	* Currently, Comcast ~~is the~~ only supported ~~provider~~.		* Currently, Comcast (US) and Shaw (CA) are our only supported providers.
	* This feature is controlled by the pref `doh-rollout.provider-steering.enabled`.		* This feature is controlled by the pref `doh-rollout.provider-steering.enabled`.

Kershaw Chang: /* Opt-out Infobar */

2022-04-26T11:43:15Z

Opt-out Infobar

← Older revision		Revision as of 11:43, 26 April 2022
Line 68:		Line 68:
	# https://datatracker.ietf.org/doc/draft-rescorla-doh-cdisco/		# https://datatracker.ietf.org/doc/draft-rescorla-doh-cdisco/

	== Opt-out ~~Doorhanger~~ ==		== Opt-out Infobar ==

	[[File:~~DoH CFR~~.png\|frameless\|DoH ~~CFR message~~ screenshot]]		[[File:DoH_Infobar.png\|frameless\|DoH Infobar screenshot]]
	* When the client is first enrolled in the rollout, we show ~~a doorhanger~~ popup to let the user know that DoH is available.		* When the client is first enrolled in the rollout, we show an infobar popup to let the user know that DoH is available.
	* This ~~doorhanger~~ offers an option to opt-out, which results in permanently disabling heuristics and other mechanisms.		* This infobar offers an option to opt-out, which results in permanently disabling heuristics and other mechanisms.
	* The ~~doorhanger~~ is shown only if the rollout is "successful" - i.e. the user did not already have custom DoH preferences or active enterprise policy.		* The infobar is shown only if the rollout is "successful" - i.e. the user did not already have custom DoH preferences or active enterprise policy.
	* The ~~doorhanger~~ is implemented as a CFR message, gated behind the relevant prefs.		* The infobar is implemented as a CFR message, gated behind the relevant prefs.

	See also:		See also:

Nhnt11: Updated doorhanger screenshot

2021-03-23T18:21:12Z

Updated doorhanger screenshot

← Older revision		Revision as of 18:21, 23 March 2021
Line 70:		Line 70:
	== Opt-out Doorhanger ==		== Opt-out Doorhanger ==

	[[File:~~Cfr~~.png\|frameless\|DoH CFR message screenshot]]		[[File:DoH CFR.png\|frameless\|DoH CFR message screenshot]]

	* When the client is first enrolled in the rollout, we show a doorhanger popup to let the user know that DoH is available.		* When the client is first enrolled in the rollout, we show a doorhanger popup to let the user know that DoH is available.
	* This doorhanger offers an option to opt-out, which results in permanently disabling heuristics and other mechanisms.		* This doorhanger offers an option to opt-out, which results in permanently disabling heuristics and other mechanisms.

Nhnt11: Fix type "anction"->"action", fix list style

2021-03-23T18:18:21Z

Fix type "anction"->"action", fix list style

← Older revision		Revision as of 18:18, 23 March 2021
Line 80:		Line 80:
	# https://bugzilla.mozilla.org/show_bug.cgi?id=1643651		# https://bugzilla.mozilla.org/show_bug.cgi?id=1643651

	Want to see this in ~~anction~~ for yourself?		Want to see this in action for yourself?
	1. On a new profile, navigate to about:config		# On a new profile, navigate to about:config
	2. Set `doh-rollout.enabled` to true		# Set `doh-rollout.enabled` to true
	3. Close about:config		# Close about:config
	4. Load/reload any website		# Load/reload any website

	You'll need to do this in an environment that doesn't trip our heurisitics, i.e. no Canary and no enterprise config.		You'll need to do this in an environment that doesn't trip our heurisitics, i.e. no Canary and no enterprise config.

Nhnt11: Added instructions to trigger doorhanger

2021-03-23T18:17:25Z

Added instructions to trigger doorhanger

← Older revision		Revision as of 18:17, 23 March 2021
Line 79:		Line 79:
	See also:		See also:
	# https://bugzilla.mozilla.org/show_bug.cgi?id=1643651		# https://bugzilla.mozilla.org/show_bug.cgi?id=1643651

			Want to see this in anction for yourself?
			1. On a new profile, navigate to about:config
			2. Set `doh-rollout.enabled` to true
			3. Close about:config
			4. Load/reload any website

			You'll need to do this in an environment that doesn't trip our heurisitics, i.e. no Canary and no enterprise config.

	== Telemetry ==		== Telemetry ==

Nhnt11: Add some pref details

2020-09-18T14:37:38Z

Add some pref details

← Older revision		Revision as of 14:37, 18 September 2020
Line 97:		Line 97:
	== Prefs ==		== Prefs ==

	* TODO: ~~list all involved~~ prefs ~~and semantics.~~		* doh-rollout.enabled - Turns on heuristics. Prerequisite for enabling sub-features.
			* doh-rollout.provider-steering.enabled - Turns on automatic provider steering.
			* doh-rollout.provider-steering.provider-list - Provider data for automatic steering (name, CNAME for discovery, and DoH endpoint)
			* doh-rollout.trr-selection.enabled - Turns on automatic performance-based default-TRR selection. Dry-run by default.
			* doh-rollout.trr-selection.commit-result - Commits and persists TRR selection dry-run result.

			TODO: other state prefs

Stpeter: text tweak: enabled => available

2020-07-17T19:34:44Z

text tweak: enabled => available

← Older revision		Revision as of 19:34, 17 July 2020
Line 72:		Line 72:
	[[File:Cfr.png\|frameless\|DoH CFR message screenshot]]		[[File:Cfr.png\|frameless\|DoH CFR message screenshot]]

	* When the client is first enrolled in the rollout, we show a doorhanger popup to let the user know that DoH is ~~enabled~~.		* When the client is first enrolled in the rollout, we show a doorhanger popup to let the user know that DoH is available.
	* This doorhanger offers an option to opt-out, which results in permanently disabling heuristics and other mechanisms.		* This doorhanger offers an option to opt-out, which results in permanently disabling heuristics and other mechanisms.
	* The doorhanger is shown only if the rollout is "successful" - i.e. the user did not already have custom DoH preferences or active enterprise policy.		* The doorhanger is shown only if the rollout is "successful" - i.e. the user did not already have custom DoH preferences or active enterprise policy.

Nhnt11: add cname-discovery-steering spec link

2020-07-16T21:08:46Z

add cname-discovery-steering spec link

← Older revision		Revision as of 21:08, 16 July 2020
Line 64:		Line 64:

	[[File:DoH provider steering flow.png\|700px\|frameless\|DoH Provider Steering Flow]]		[[File:DoH provider steering flow.png\|700px\|frameless\|DoH Provider Steering Flow]]

			See also:
			# https://datatracker.ietf.org/doc/draft-rescorla-doh-cdisco/

	== Opt-out Doorhanger ==		== Opt-out Doorhanger ==