Firefox Secure DNS Explained: What DNS Over HTTPS Actually Protects

When you enter a website name, your computer first needs a way to find the network address associated with that name.

That lookup uses the Domain Name System, or DNS.

Firefox supports DNS over HTTPS, usually shortened to DoH, which sends supported DNS requests through an encrypted HTTPS connection rather than traditional unencrypted DNS.

Mozilla says this makes it harder for third parties along the network path to see those DNS lookups.

Where Firefox keeps the setting

In Firefox, open Settings > Privacy & Security and scroll to DNS over HTTPS.

Mozilla currently provides several protection levels, including Default Protection, Increased Protection, Max Protection, Custom and Off.

These settings are not identical.

Default Protection is designed to adapt to network conditions and can fall back to the operating system's normal DNS resolver when necessary.

More restrictive modes can keep secure DNS active more aggressively and, at the highest level, display a warning when Firefox cannot reach its secure resolver.

Why Firefox might not use secure DNS

There are legitimate situations where encrypted browser DNS can conflict with a network's design.

Mozilla says Firefox considers things such as parental controls, enterprise policies and DNS-based filtering. Default Protection can disable DoH under some of these conditions.

That is important because switching to the strongest setting without understanding the network can interfere with local filtering or other network behavior.

Secure DNS is not a VPN

DoH encrypts DNS lookups. It should not be described as making all browser traffic invisible or anonymous.

Websites can still receive network information necessary for your connection, and DNS privacy is only one part of online privacy.

For most ordinary Firefox users, the built-in default behavior provides a sensible starting point. Change the protection level when you understand why you need the different behavior rather than assuming the setting with the strongest-sounding name must always be better.

Sources and Further Reading

Mozilla Support: Firefox DNS over HTTPS and protection levels — https://support.mozilla.org/en-US/kb/firefox-dns-over-https