Configure DNS over HTTPS protection levels in Waterfox

When you type a web address, your browser has to look up the IP address behind it. By default that lookup travels in plain text to whichever DNS server your network hands you, where it can be read or modified. DNS over HTTPS (DoH) encrypts the lookup and sends it to a resolver you choose.

Waterfox goes a step further than Firefox: new profiles start on Ultra Protection, which sends encrypted lookups through a relay so that no single party sees both who you are and what you looked up.

Open the DNS settings

1. Click the menu button, then select Settings.
2. Select Privacy and security.
3. Scroll to the DNS over HTTPS section.

Protection levels

Ultra Protection

The Waterfox default for new profiles. Lookups are encrypted and relayed using Oblivious HTTP, so the relay sees your IP address but not your query, and the resolver sees your query but not your IP address.

You can choose the fallback policy, and change the relay and resolver, from the same section. See Ultra Protection: DNS over Oblivious HTTP for the full detail.

Default protection

Enables secure DNS where it is available and falls back to your system resolver if there is a problem. It will use a local provider where one is detected, and switches off when a VPN, parental controls or an enterprise policy is active, or when the network signals that secure DNS should not be used.

Increased protection

Secure DNS stays on with the provider you pick. Waterfox only falls back to a backup if your chosen provider has a problem.

Max protection

Secure DNS is always used. If Waterfox cannot reach the resolver, or the resolver reports no address for the domain, you see a warning page rather than a silent fallback. The warning offers to add an exception for that domain so it can be resolved with your system DNS.

Off

Waterfox uses your system’s default DNS resolver, unencrypted.

Add sites to the exceptions list

Exceptions are resolved with your system DNS instead of the secure resolver. This is useful for internal hostnames that only your own network knows about.

1. Open Settings and select Privacy and security.
2. Scroll to DNS over HTTPS.
3. Select Manage Exceptions.
4. Add the hostname and select Save Changes.

What the status means

The status line under the DNS settings tells you whether secure lookups are actually happening.

• Active — Waterfox is sending DNS queries securely.
• Not active — Waterfox hit an error, or a network condition such as a VPN, parental controls or an enterprise policy told it not to use secure DNS.
• Off — the feature is disabled.

If you have secure DNS enabled but the status reads Not active, the usual causes are:

• Waterfox could not reach the provider, or the connection timed out.
• You are not connected to the internet.
• The provider is having problems.
• You are on Default protection and the network signaled that DoH should not be enabled.

Frequently asked questions

What is a local provider?

A resolver hosted inside your own network or by your ISP. Waterfox detects one using a set of heuristics that inspect the network configuration and DNS responses. Local providers are only used in Default protection, and only when every heuristic is satisfied.

Why would a network tell Waterfox not to use secure DNS?

Some organizations filter access to certain sites through their own DNS. If they run their own secure resolver, they will signal that the browser should not bypass it.

Does this hide my browsing from my ISP?

Only the DNS lookup. The destination server’s IP address, and the hostname in the TLS handshake unless Encrypted Client Hello is in use, are still visible on the network. See What Ultra Protection does not hide.

Related articles

• Ultra Protection: DNS over Oblivious HTTP
• Connection settings in Waterfox
• HTTPS-Only Mode

---