DNS over HTTPS (DoH) is a protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. It is more secure than traditional DNS and helps protect user privacy.
You can learn more about Firewalla DNS Services here: DNS Services Introduction.
How does DoH work?
When you type a web address or domain name into your address bar, your browser sends a request over the Internet to look up the IP address for that website. Traditionally, this request is sent to servers over a plain text connection. This connection is not encrypted, making it easy for third parties to see what website you’re about to access.
DNS over HTTPS (DoH) works differently. It sends the domain name you typed to a DoH-compatible DNS server using an encrypted HTTPS connection instead of a plain text one. This prevents third parties from seeing what websites you are trying to access.
If DNS over HTTPS is enabled on Firewalla, your device will use the DoH server even if it has its own DNS server configured.
- DoH can be slower than traditional DNS queries due to the encryption.
- DoH will encrypt your DNS entries. If you have network security devices beyond Firewalla, they will not be able to see your DNS requests.
- If your router maps a domain name to a local IP address, you won't be able to resolve the domain name when DoH is on.
- DoH only encrypts the DNS query. The destination IP address in packet headers can still expose which servers you are talking to.
- Remember, DoH will only hide your queries from ISPs, not DoH providers.
- Some DoH services are not as stable as normal DNS servers. If you encounter problems while DoH is on, please try to change your DoH provider or turn DoH off and test again.
How do I enable DoH?
Tap on the "More" button on your Firewalla's main page, or go to "Settings" and tap on "Features". Tap on the "DNS Service" feature. DoH is disabled by default.
To enable DoH, toggle it on. You can select which devices to apply DoH to, and which server (Cloudflare, Google, Quad9, OpenDNS) will handle the DoH queries.
How do I check that DoH is working?
To test DoH, set your DoH settings to Cloudflare only (turn other servers off), then visit https://22.214.171.124/help. You should see something like this:
If you see something different, please check the following:
- Double-check that only Cloudflare is enabled– the test above is made by Cloudflare and only works if you are using the Cloudflare server. You can turn on other servers after the test.
- Be sure the device you're running the test on is being monitored by Firewalla and that you have included it in the DoH "Apply To" list.
- Double-check that DNS Booster is on (if you don't know what DNS Booster is, please disregard it).
How to use Custom DoH Servers
You can also add customized DoH endpoints if you want to use a provider other than the defaults provided in the app. For example, in addition to simple, unfiltered DoH service, Cloudflare offers DoH with Filters for Malware and another for Malware and Pornography. You can add them by tapping "Servers", then tapping "Add Server." Give your new server a name, enter in the endpoint URL or stamp, then tap Save.
The same approach will work with OpenDNS' FamilyShield, using the following URL:
Dependencies with other features
While you can't run two different DNS services at the same time on one device, you can enable different DNS services at the same time on different devices. For example, you can run DoH for your laptop while running Unbound for your tablet.
DNS Booster must be turned on for any of Firewalla's DNS services to work.
- Unbound is a validating, recursive, caching DNS resolver that is installed locally on your box. Unbound prevents a single public DNS server from having all your DNS records, which helps increase your online privacy and security.
- Family Protect in 3rd-Party mode uses DNS services to filter out offensive content, which is incompatible with DoH. To be able to use Family Protect and DoH concurrently, you must use Family Protect Native, which blocks content directly from your Firewalla box. You can turn on Family Protect Native by tapping "Family" on your box's main page, then tapping on Family Protect. It should be in Native by default, but you can switch between 3rd-Party and Native by tapping "Mode".