Waterfox Ultra Protection for DNS

Waterfox Ultra Protection sends DNS lookups through Oblivious HTTP. The Waterfox relay receives the connection from your device but cannot read the encapsulated DNS question. The DNS endpoint receives the question through the relay instead of directly from your IP address.

Ultra Protection is enabled by default for new Waterfox profiles. The shipped configuration uses https://dooh.waterfox.com/ as the relay and Cloudflare’s Oblivious HTTP DNS endpoint as the provider.

These instructions apply to Waterfox on desktop.

Open the Waterfox DNS settings

1. Open the Waterfox menu and select Settings.
2. Select Privacy and security.
3. Find DNS over HTTPS and select Advanced settings.

Use Ultra Protection

In Advanced settings, select Ultra Protection. Waterfox shows the active OHTTP relay and DNS endpoint below the option, and the status message identifies the relay and provider currently in use.

The Fallback behavior menu has two choices:

• Allow fallback to system DNS if secure DNS fails lets browsing continue through the operating system’s resolver when Ultra Protection cannot complete a lookup. This is the Waterfox default.
• Never fall back to system DNS keeps every lookup on the secure path. If the relay or provider is unavailable, affected websites may not load.

The relay and endpoint rows are informational. They show the effective addresses but are not editable fields in Settings.

Selecting another DNS mode leaves Ultra Protection. Selecting Ultra Protection again clears a custom standard DNS over HTTPS provider URL and restores Waterfox’s shipped OHTTP transport and fallback mode. If you need to preserve a custom provider address, record it before switching.

Manage DNS exceptions

Select Manage Exceptions to make specified domains use the system resolver instead of secure DNS. This can help with local network names, captive portals, parental controls or services supplied by a VPN.

Use exceptions narrowly. A lookup sent through system DNS does not receive Ultra Protection’s relay separation.

What Ultra Protection does not hide

Ultra Protection protects DNS lookups, not all browsing activity. A website still receives your connection, and a network observer may infer destinations from IP addresses or other traffic information. Waterfox history, bookmarks, downloads and account activity are separate from DNS protection.

Allowing fallback improves reliability but means some lookups can use system DNS during a failure. Disabling fallback provides stricter DNS handling at the cost of sites failing when the secure path is unavailable.