Security/DNS Over HTTPS/Heuristics - Revision history

Janbrasna: Fix enterprise link

2026-08-14T07:08:19Z

Fix enterprise link

← Older revision		Revision as of 07:08, 14 August 2026
Line 37:		Line 37:

	See also:		See also:
	# https://support.mozilla.org/en-US/products/firefox-enterprise/~~policies-customization-enterprise/policies-overview-enterprise~~		* https://support.mozilla.org/en-US/products/firefox-enterprise/settings

	== Enterprise Roots ==		== Enterprise Roots ==
Line 44:		Line 44:

	See also:		See also:
	# https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox		* https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox

	== ZScaler Canary Domain ==		== ZScaler Canary Domain ==

Janbrasna: Update source location to toolkit

2026-08-13T09:32:24Z

Update source location to toolkit

← Older revision		Revision as of 09:32, 13 August 2026
Line 3:		Line 3:
	'''High-level overview:''' https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https		'''High-level overview:''' https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

	'''Implementation:''' https://searchfox.org/~~mozilla~~-~~central~~/source/~~browser~~/components/doh/DoHHeuristics.sys.mjs~~<br />~~		'''Implementation:''' https://searchfox.org/firefox-main/source/toolkit/components/doh/DoHHeuristics.sys.mjs
	[https://searchfox.org/~~mozilla~~-~~central~~/source/~~browser~~/components/doh/DoHController.sys.mjs DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.
			[https://searchfox.org/firefox-main/source/toolkit/components/doh/DoHController.sys.mjs DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.

	== Global Canary ==		== Global Canary ==

Valentin.gosu: Update links and mention VPN and proxy heuristics

2023-10-24T11:49:31Z

Update links and mention VPN and proxy heuristics

← Older revision		Revision as of 11:49, 24 October 2023
Line 3:		Line 3:
	'''High-level overview:''' https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https		'''High-level overview:''' https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

	'''Implementation:''' https://searchfox.org/mozilla-central/source/browser/components/doh/DoHHeuristics.~~jsm~~<br />		'''Implementation:''' https://searchfox.org/mozilla-central/source/browser/components/doh/DoHHeuristics.sys.mjs<br />
	[https://searchfox.org/mozilla-central/source/browser/components/doh/DoHController.~~jsm~~ DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.		[https://searchfox.org/mozilla-central/source/browser/components/doh/DoHController.sys.mjs DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.

	== Global Canary ==		== Global Canary ==
Line 48:		Line 48:

	Currently, ZScaler has not yet adopted the global canary, and is supported by a separate canary lookup heuristic that operates on `sitereview.zscaler.com`.		Currently, ZScaler has not yet adopted the global canary, and is supported by a separate canary lookup heuristic that operates on `sitereview.zscaler.com`.

			== VPN or Proxy ==

			If a VPN, proxy or [https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn593632(v=ws.11) NRPT] is detected on Windows, then Firefox will not automatically use DNS over HTTPS.

Nhnt11: add links for third-party roots section

2020-07-16T16:05:31Z

add links for third-party roots section

← Older revision		Revision as of 16:05, 16 July 2020
Line 26:		Line 26:

	We look at all certs in the cert database and check if any of them are not "built-in". If such certs are present, we disable DoH.		We look at all certs in the cert database and check if any of them are not "built-in". If such certs are present, we disable DoH.

			See also:
			# https://searchfox.org/mozilla-central/rev/1b95a0179507a4dc7d4b0c94c2df420dc1a72885/security/manager/ssl/nsIX509CertDB.idl#329
			# https://searchfox.org/mozilla-central/rev/1b95a0179507a4dc7d4b0c94c2df420dc1a72885/security/manager/ssl/nsIX509Cert.idl#47

	== Enterprise Policies ==		== Enterprise Policies ==

Nhnt11: clean intro more

2020-07-16T16:02:55Z

clean intro more

← Older revision		Revision as of 16:02, 16 July 2020
Line 3:		Line 3:
	'''High-level overview:''' https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https		'''High-level overview:''' https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

	'''Implementation:''' https://searchfox.org/mozilla-central/source/browser/components/doh/DoHHeuristics.jsm		'''Implementation:''' https://searchfox.org/mozilla-central/source/browser/components/doh/DoHHeuristics.jsm<br />
	[https://searchfox.org/mozilla-central/source/browser/components/doh/DoHController.jsm DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.		[https://searchfox.org/mozilla-central/source/browser/components/doh/DoHController.jsm DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.

Nhnt11: clean up intro

2020-07-16T16:02:28Z

clean up intro

← Older revision		Revision as of 16:02, 16 July 2020
Line 1:		Line 1:
	Firefox runs several heuristics on each network to determine whether it's OK to enable DoH on that network. ~~This page details each heuristic we use~~.		Firefox runs several heuristics on each network to determine whether it's OK to enable DoH on that network. Generally, the heuristics attempt to disable DoH in order to support parental controls and enterprise configurations.

	~~Generally, the heuristics attempt to disable DoH in order to~~ support ~~parental controls and enterprise configurations~~.		'''High-level overview:''' https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

	~~A high-level overview is also available here: https~~:~~//support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https~~		'''Implementation:''' https://searchfox.org/mozilla-central/source/browser/components/doh/DoHHeuristics.jsm

	~~Heuristics are implemented in [~~https://searchfox.org/mozilla-central/source/browser/components/doh/DoHHeuristics.jsm ~~DoHHeuristics.jsm]~~
	[https://searchfox.org/mozilla-central/source/browser/components/doh/DoHController.jsm DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.		[https://searchfox.org/mozilla-central/source/browser/components/doh/DoHController.jsm DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.

Nhnt11: add code links

2020-07-16T16:01:08Z

add code links

← Older revision		Revision as of 16:01, 16 July 2020
Line 4:		Line 4:

	A high-level overview is also available here: https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https		A high-level overview is also available here: https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

			Heuristics are implemented in [https://searchfox.org/mozilla-central/source/browser/components/doh/DoHHeuristics.jsm DoHHeuristics.jsm]
			[https://searchfox.org/mozilla-central/source/browser/components/doh/DoHController.jsm DoHController.jsm] is responsible for running them at startup and upon network changes, and taking action to disable or enable DoH based on the outcome.

	== Global Canary ==		== Global Canary ==

Nhnt11: use lists in markup

2020-07-16T15:49:11Z

use lists in markup

← Older revision		Revision as of 15:49, 16 July 2020
Line 14:		Line 14:

	See also:		See also:
	1. [https://searchfox.org/mozilla-central/source/toolkit/components/parentalcontrols/ Parental Controls Service component]		# [https://searchfox.org/mozilla-central/source/toolkit/components/parentalcontrols/ Parental Controls Service component]
	2. https://developer.apple.com/documentation/devicemanagement/parentalcontrolscontentfilter		# https://developer.apple.com/documentation/devicemanagement/parentalcontrolscontentfilter
	3. https://docs.microsoft.com/en-us/windows/win32/parcon/using-parental-controls-settings-apis		# https://docs.microsoft.com/en-us/windows/win32/parcon/using-parental-controls-settings-apis

	== Forced SafeSearch (DNS-based Parental Controls) ==		== Forced SafeSearch (DNS-based Parental Controls) ==
Line 31:		Line 31:

	See also:		See also:
	1. https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise		# https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise

	== Enterprise Roots ==		== Enterprise Roots ==
Line 38:		Line 38:

	See also:		See also:
	1. https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox		# https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox

	== ZScaler Canary Domain ==		== ZScaler Canary Domain ==

	Currently, ZScaler has not yet adopted the global canary, and is supported by a separate canary lookup heuristic that operates on `sitereview.zscaler.com`.		Currently, ZScaler has not yet adopted the global canary, and is supported by a separate canary lookup heuristic that operates on `sitereview.zscaler.com`.

Nhnt11: add doc for individual heuristics

2020-07-16T15:48:24Z

add doc for individual heuristics

New page

Firefox runs several heuristics on each network to determine whether it's OK to enable DoH on that network. This page details each heuristic we use.

Generally, the heuristics attempt to disable DoH in order to support parental controls and enterprise configurations.

A high-level overview is also available here: https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

== Global Canary ==

See https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet

== Parental Controls Service ==

[https://searchfox.org/mozilla-central/source/toolkit/components/parentalcontrols/nsIParentalControlsService.idl nsIParentalControlsService] provides an interface to check whether parental controls are enabled on the user account on the OS. If so, we disable DoH.

See also:
1. [https://searchfox.org/mozilla-central/source/toolkit/components/parentalcontrols/ Parental Controls Service component]
2. https://developer.apple.com/documentation/devicemanagement/parentalcontrolscontentfilter
3. https://docs.microsoft.com/en-us/windows/win32/parcon/using-parental-controls-settings-apis

== Forced SafeSearch (DNS-based Parental Controls) ==

As a way to detect DNS-based content filtering, we perform DNS lookups of filtered and unfiltered domains of popular content platforms. If any of the IPs returned for the filtered domains of a given platform are identical to any of the IPs returned for the unfiltered domains, we disable DoH. Currently, Google and YouTube are supported.

== Third-party Root Certificates ==

We look at all certs in the cert database and check if any of them are not "built-in". If such certs are present, we disable DoH.

== Enterprise Policies ==

If enterprise policies are active, we disable DoH unless it is explicitly enabled by the DNSOverHTTPS policy.

See also:
1. https://support.mozilla.org/en-US/products/firefox-enterprise/policies-customization-enterprise/policies-overview-enterprise

== Enterprise Roots ==

If enterprise root support has been enabled by setting the pref `security.enterprise_roots.enabled` to true, we disable DoH.

See also:
1. https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox

== ZScaler Canary Domain ==

Currently, ZScaler has not yet adopted the global canary, and is supported by a separate canary lookup heuristic that operates on `sitereview.zscaler.com`.