https://support.mozilla.org/en-US/kb/firefox-dns-over-https
Firefox allows users (via settings) and organizations (via enterprise policies and a canary domain lookup)
to disable DoH when it interferes with a preferred policy.

If you run your own DNS server you can configure the canary hostname lookup to fail
to prevent Firefox from using DoH:
Put this in named.conf (I use views, so I put this in the 'internal' view):
        response-policy { zone "rpz"; };
        include "/etc/named/rpz.zones";

/etc/named/rpz.zones:
        zone "rpz"      {
                type                    master;
                file                    "masters/rpz";
                notify                  no;
                allow-transfer          { "localhost_net"; };
                masterfile-format       text;
        };

/var/named/masters/rpz (I think I created the 'masters' directory, you may not have it.
If so, just remove the 'masters/' prefix on the file line (above) and from this file's name:
$TTL 86400      ; 1 day
@                        IN SOA ns1.example.com. bill.example.com. (
                                2018051701 ; serial
                                7200       ; refresh (2 hours)
                                900        ; retry (15 minutes)
                                86400      ; expire (1 day)
                                120        ; minimum (2 minutes)
                                )
                        NS      ns1.example.com.
use-application-dns.net                         CNAME   .

This will return a NSDOMAIN for the lookup of use-application-dns.net which will
stop DoH.

The rpz SOA is also a good place to translate external host names to internal ones.
imap.example.com.                         CNAME   imap.lan.example.com.
With this, the an internal lookup won't fail even if the internet is down.

Bill

In the upcoming Fedora 32, is Firefox defaulting to DNS over HTTPS (RFC 8484)?

BTW, I am currently on F30 and will skip to F32 when it ships.

If you want a high-level discuss on DNS over TLS or over HTTPS see:

https://spectrum.ieee.org/tech-talk/telecom/security/the-fight-over-encrypted-dns-boils-over

One thing this article misses is if your company DNS server has an internal view for internal resources, defaulting to some outside DNS server breaks this.  Or at least makes directing things the right way is hard.

So what is happening with Firefox in F32?

Thanks
_______________________________________________
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org