Configure Firefox for Secure DNSaaS

📋 Overview

Firefox includes built-in support for DNS-over-HTTPS (DoH) with custom providers. This guide will help you configure Firefox to use our secure DNSaaS service with token-based authentication.

Service	Endpoint	Authentication
Primary DNS	`https://dns1.oss.co.za/xxxxx/dns-query`	Token in URL path
Protocol	DNS-over-HTTPS (DoH) • Port 443 • TLS 1.3
Firefox Version	Version 90+ (all recent versions)

💡 Firefox vs Other Browsers Firefox uses a different DoH endpoint format than Brave. Firefox requires the full URL including /dns-query and supports the {?dns} template variable.

🦊 Method 1: Firefox Settings ✅ Recommended

1 Open Firefox Settings

Click the Firefox menu (three horizontal lines in the top-right corner) → select Settings.

Alternatively, type about:preferences in the address bar and press Enter.

2 Navigate to Privacy & Security

In the left sidebar, click Privacy & Security.

Scroll down to the DNS over HTTPS section.

3 Enable DNS over HTTPS

Check the box for "Enable DNS over HTTPS".

Select "Custom" from the provider dropdown.

💡 Important Select "Custom" - this allows you to enter your token-gated endpoint.

4 Enter the Custom DoH Endpoint

Enter the following URL (replace token_testclient123 with your token):

✅ WORKING FORMAT - Firefox
https://dns1.oss.co.za/testclient123/dns-query

✅ Firefox Format

The token is in the URL path: /token_testclient123
Firefox requires the /dns-query suffix
No ?dsn or {?dns} needed
This format has been tested and verified with Firefox

5 Save and Verify

Click "OK" or "Apply" to save the settings.

✅ Success Indicator Firefox will now use your secure DNS for all DNS lookups. You can verify by visiting about:networking#dns.

⚙️ Method 2: about:config (Advanced)

If the Settings UI doesn't work, you can configure DoH using Firefox's advanced configuration.

1 Open about:config

Type about:config in the address bar and press Enter.

Click "Accept the Risk and Continue" if prompted.

2 Enable DoH

Search for network.trr.mode and set it to 2 (Custom DoH).

📌 TRR Mode Values

0 - Off (Disabled)
1 - Use native DNS first, fallback to DoH
2 - Use DoH first, fallback to native DNS
3 - Use DoH only (no fallback)
5 - Use DoH first, native DNS fallback (with additional settings)

3 Set the DoH Endpoint

Search for network.trr.uri and set it to:

# Replace token_testclient123 with YOUR token
https://dns1.oss.co.za/testclient123/dns-query

4 Optional: Disable Native DNS Fallback

Set network.trr.fallback-option to false to prevent fallback to native DNS.

5 Restart Firefox

Restart Firefox for changes to take effect.

🧪 Test Your Configuration

Use these test sites to verify your Firefox configuration is working correctly.

Blocked Domains (Should NOT Load)

Test Domain	Expected Result	What You Should See
`http://zycdjz.com`	BLOCKED	"Server not found" or DNS_PROBE_POSSIBLE
`http://malware.testcategory.com`	BLOCKED	"Server not found" or DNS_PROBE_POSSIBLE
`http://phishing.testcategory.com`	BLOCKED	"Server not found" or DNS_PROBE_POSSIBLE
`http://adult.filterdns.net`	BLOCKED	"Server not found" or DNS_PROBE_POSSIBLE

Clean Domains (Should Load Normally)

Test Domain	Expected Result	What You Should See
`https://example.com`	LOAD	Normal page loads
`https://google.com`	LOAD	Normal page loads

DNS Leak Test

Test Domain	Expected Result	What You Should See
`https://dnsleaktest.com`	Your DNS Server	Should show `dns1.oss.co.za` or `102.220.218.218`

🔍 Firefox vs Brave: Endpoint Formats

Different browsers require different endpoint formats:

Browser	Endpoint Format	Example	Status
🦊 Firefox	`/dns-query` suffix	`https://dns1.oss.co.za/xxxxx/dns-query`	✅ Working
🦁 Brave	`?dsn` parameter	`https://dns1.oss.co.za/xxxxx?dsn`	✅ Working

⚠️ Important

Firefox requires /dns-query at the end of the URL
Brave requires ?dsn at the end of the URL
They are NOT interchangeable - use the correct format for each browser

🔧 Troubleshooting

❌ "Could not validate" or "Invalid provider"

Make sure you're using the correct format: https://dns1.oss.co.za/xxxxx/dns-query
Check that your token is valid and active
Verify network connectivity to dns1.oss.co.za
Try restarting Firefox

❌ Domains still loading when they should be blocked

Check that DoH is enabled: about:preferences#privacy → DNS over HTTPS
Clear the DNS cache: about:networking#dns → Clear DNS Cache
Verify the custom blocklist is loaded: /etc/powerdns/siteslist.rpz
Check the token is correct and active

✅ Verify It's Working

Visit about:networking#dns and check for DoH queries
Visit http://adult.filterdns.net - should show "Server not found"
Visit https://dnsleaktest.com - should show dns1.oss.co.za
Use the browser developer tools (F12) → Network tab to see DNS lookups

🧪 Verification Methods

Method 1: Check Settings

Go to about:preferences#privacy and scroll to DNS over HTTPS.

It should show "Custom" with your URL.

Method 2: about:networking

# Open this URL in Firefox
about:networking#dns

# Look for DNS-over-HTTPS entries in the log

Method 3: about:config Check

# Check these settings in about:config
network.trr.mode = 2
network.trr.uri = https://dns1.oss.co.za/testclient123/dns-query

↩️ How to Roll Back

To revert to your previous DNS settings:

Method 1: Settings UI

Go to about:preferences#privacy → DNS over HTTPS

Uncheck "Enable DNS over HTTPS"

Method 2: about:config

Go to about:config

Set network.trr.mode to 0

Clear network.trr.uri

Step 3: Clear DNS Cache

Visit about:networking#dns and click "Clear DNS Cache"

🎯 Summary

🦊 Firefox supports DoH natively in Settings
✅ Working URL: https://dns1.oss.co.za/xxxxx/dns-query
🔒 All DNS queries are encrypted via DoH (port 443) with TLS 1.3
⚡ Firefox requires the /dns-query suffix
🔄 Easily toggle on/off as needed

🚀 Quick Reference:


                Settings → Privacy & Security → DNS over HTTPS → Custom

                https://dns1.oss.co.za/testclient123/dns-query

🦊 Firefox vs 🦁 Brave:


                Firefox: https://dns1.oss.co.za/xxxxx/dns-query

                Brave:   https://dns1.oss.co.za/xxxxx?dsn