Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

Why is DNS-over-HTTPs not being disabled when I have the canary domain set to return status NXDOMAIN?

  • 7 replies
  • 1 has this problem
  • 1 view
  • Last reply by trolley

more options

I'm trying to disable DNS-over-HTTPs on my home network so my Pi Hole acts as my DNS server for Firefox while at home. I've configured it to treat the canary domain use-application-dns.net as if it doesn't exist. If I try to open that site in a different browser it says the server can't be found, and if I do a DNS lookup for it it confirms that my system gets NXDOMAIN for that domain name:

$ host -t ns use-application-dns.net

Host use-application-dns.net not found: 3(NXDOMAIN)

However Firefox continues to use DNS-over-HTTPs. Is there somewhere to find a log that shows when Firefox looks up that hostname to see if it's actually performing the check?

Environment:

Firefox 73.0 64-bit

macOS 10.15.3

I'm trying to disable DNS-over-HTTPs on my home network so my Pi Hole acts as my DNS server for Firefox while at home. I've configured it to treat the canary domain use-application-dns.net as if it doesn't exist. If I try to open that site in a different browser it says the server can't be found, and if I do a DNS lookup for it it confirms that my system gets NXDOMAIN for that domain name: $ host -t ns use-application-dns.net Host use-application-dns.net not found: 3(NXDOMAIN) However Firefox continues to use DNS-over-HTTPs. Is there somewhere to find a log that shows when Firefox looks up that hostname to see if it's actually performing the check? Environment: Firefox 73.0 64-bit macOS 10.15.3

Modified by trolley

Chosen solution

I found the answer, and it confirms the Reddit post. From Configuring Networks to Disable DNS over HTTPS :

If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored.

I had manually turned the feature on since I am not in the US, so my canary domain was ignored.

Read this answer in context 👍 0

All Replies (7)

more options

Hi trolley, it sounds as though you have done what the support article describes:

Canary domain - use-application-dns.net

The internal page about:networking has a DNS section that shows the results of requests Firefox has made, and whether they were resolved via DoH (TRR = true). They aren't time-stamped, but you can see the remaining time before the cached entry expires.

There's also a DNS Lookup tool, for what it's worth.


What is your setting here:

(1) In a new tab, type or paste about:config in the address bar and press Enter/Return. Click the button accepting the risk.

(2) In the search box above the list, type or paste TRR and pause while the list is filtered

(3) What is the value of the network.trr.mode preference?

more options

Thank you for your response @jscher2000.

To answer your questions:

All entries in the TTR column are true.

network.trr.mode is: 2 - First. Use TRR first, and only if the name resolve fails use the native resolver as a fallback.

more options

I found an interesting post on Reddit that says this won't actually disable DOH, but I can't find reference to this claim anywhere on the Mozilla site:

Creating this DNS record does not disable DoH functionality.

It merely prevents the functionality from being automatically turned on by Firefox.

Even with this DNS record in place, users are still able to manually enable the feature and enter a custom ip-based DoH resolver.

To completely disable DoH in Firefox, please download the Firefox enterprise ADMX files and use these to configure DoH as OFF and enable the option to prevent users from changing setting.

more options

Hmm, I think that check has not been implemented yet. According to the main support article:

Networks can signal to Firefox that there are special features such as these in place that would be disabled if DoH were used for domain name resolution. Checking for this signaling will be implemented in Firefox when DoH is enabled by default for users. This will first happen for users in the United States in the Fall of 2019. If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored.

Ref. Configuring Networks to Disable DNS over HTTPS


When I search in the source code, the canary domain only appears in an add-on called "DoH Roll-Out" (name may differ depending on locale) as one of the checks performed in the heuristics.js file. The extension appears to be waiting for a preference to be set before running; the code in background.js seems to require this:

doh-rollout.enabled => true

https://dxr.mozilla.org/mozilla-release/source/browser/extensions/doh-rollout

I don't know whether that has reached you; it hasn't been set on mine.

What this suggests, though, is that in the short run, the canary domain isn't useful for overriding DoH manually turned on by the user, but only DoH turned on by Firefox itself.

There's probably some wiki documents spelling out the fuller plan. Somewhere!

more options

Oh, you found that, too.

more options

Chosen Solution

I found the answer, and it confirms the Reddit post. From Configuring Networks to Disable DNS over HTTPS :

If a user has chosen to manually enable DoH, the signal from the network will be ignored and the user’s preference will be honored.

I had manually turned the feature on since I am not in the US, so my canary domain was ignored.

more options

jscher2000 said

Oh, you found that, too.

I did, but thanks very much for your assistance.