From 466df890c4d69b5cde561066b100e72fae597211 Mon Sep 17 00:00:00 2001 From: Nexoniarz Date: Sat, 31 Oct 2026 12:19:13 +0100 Subject: [PATCH 1/2] Firefox: DNS-over-HTTPS through Quad9 network.trr.mode 2 with dns.quad9.net: DoH first, falling back to the system resolver (systemd-resolved over DNS-over-TLS), so lookups stay encrypted either way. Mode 5 had turned Firefox's DoH off entirely. Co-Authored-By: Claude Opus 5.5 --- configs/firefox/prefs.js | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/configs/firefox/prefs.js b/configs/firefox/prefs.js index 3712d22..bfa91fa 100644 --- a/configs/firefox/prefs.js +++ b/configs/firefox/prefs.js @@ -102,9 +102,13 @@ pref("browser.safebrowsing.downloads.remote.enabled", false); /*** NETWORK ***/ -// DNS: use the system resolver (systemd-resolved with DNS-over-TLS) and -// never let Firefox switch itself to its own DNS-over-HTTPS provider. -pref("network.trr.mode", 5); +// DNS-over-HTTPS through Quad9 (no logging, blocks known malware domains). +// Mode 2: Quad9 first; if it fails, the system resolver (systemd-resolved, +// itself DNS-over-TLS), so lookups are encrypted either way and pages don't +// break when Quad9 has a bad moment. Mode 3 would allow Quad9 only. +pref("network.trr.mode", 2); +pref("network.trr.uri", "https://dns.quad9.net/dns-query"); +pref("network.trr.custom_uri", "https://dns.quad9.net/dns-query"); // No preloading pages or DNS you didn't ask for. pref("network.dns.disablePrefetch", true); From 999b49800d1b115083c89cc8462b36592591667e Mon Sep 17 00:00:00 2001 From: Nexoniarz Date: Sat, 31 Oct 2026 12:20:41 +0100 Subject: [PATCH 2/2] Revert "Firefox: DNS-over-HTTPS through Quad9" Back to trr.mode 5: systemd-resolved already encrypts DNS (DNS-over-TLS to Cloudflare and Quad9), so Firefox doesn't need its own DoH. Co-Authored-By: Claude Opus 5.5 --- configs/firefox/prefs.js | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/configs/firefox/prefs.js b/configs/firefox/prefs.js index bfa91fa..3712d22 100644 --- a/configs/firefox/prefs.js +++ b/configs/firefox/prefs.js @@ -102,13 +102,9 @@ pref("browser.safebrowsing.downloads.remote.enabled", false); /*** NETWORK ***/ -// DNS-over-HTTPS through Quad9 (no logging, blocks known malware domains). -// Mode 2: Quad9 first; if it fails, the system resolver (systemd-resolved, -// itself DNS-over-TLS), so lookups are encrypted either way and pages don't -// break when Quad9 has a bad moment. Mode 3 would allow Quad9 only. -pref("network.trr.mode", 2); -pref("network.trr.uri", "https://dns.quad9.net/dns-query"); -pref("network.trr.custom_uri", "https://dns.quad9.net/dns-query"); +// DNS: use the system resolver (systemd-resolved with DNS-over-TLS) and +// never let Firefox switch itself to its own DNS-over-HTTPS provider. +pref("network.trr.mode", 5); // No preloading pages or DNS you didn't ask for. pref("network.dns.disablePrefetch", true);