https://support.mozilla.org/en-US/kb/firefox-dns-over-https Firefox allows users (via settings) and organizations (*via enterprise policies and a canary domain lookup*) to disable DoH when it interferes with a preferred policy. If you run your own DNS server you can configure the canary hostname lookup to fail to prevent Firefox from using DoH: Put this in named.conf (I use views, so I put this in the 'internal' view):         response-policy { zone "rpz"; };         include "/etc/named/rpz.zones"; /etc/named/rpz.zones:         zone "rpz"      {                 type                    master;                 file                    "masters/rpz";                 notify                  no;                 allow-transfer          { "localhost_net"; };                 masterfile-format       text;         }; /var/named/masters/rpz (I think I created the 'masters' directory, you may not have it. If so, just remove the 'masters/' prefix on the file line (above) and from this file's name: $TTL 86400      ; 1 day @                        IN SOA ns1.example.com. bill.example.com. (                                 2018051701 ; serial                                 7200       ; refresh (2 hours)                                 900        ; retry (15 minutes)                                 86400      ; expire (1 day)                                 120        ; minimum (2 minutes)                                 )                         NS      ns1.example.com. use-application-dns.net                         CNAME . This will return a NSDOMAIN for the lookup of use-application-dns.net which will stop DoH. The rpz SOA is also a good place to translate external host names to internal ones. imap.example.com.                         CNAME   imap.lan.example.com. With this, the an internal lookup won't fail even if the internet is down. Bill On 11/27/2019 4:43 PM, Robert Moskowitz wrote:

On Wed, 2019-11-27 at 15:17 -0800, Kevin Fenzi wrote: Great to hear that Fedora is shielding us from these half-baked ideas (or contracts?). Last time it was unsolicited browser extension, now it is DoH to CloudFlare servers. What will be next? I recommend the following thread: https://twitter.com/paulvixie/status/1198013742493028353 Many users are used to Firefox now. But was there some discussion about providing some more privacy-focused browser? Regards, -- Jakub Jelen Senior Software Engineer Security Technologies Red Hat, Inc.

On 11/28/19 8:36 PM, Jakub Jelen wrote: But then have you ever been in the privacy debates at the IETF?  I have and lost a couple on very stubborn privacy proponents that just don't want to see some tech come to reality because of some vague privacy risk when there are so many worst things (e.g. IDEAS BOF from a few years back). I am having one right now with Unmanned Aircraft RemoteID (see the TM-RID BOF from IETF106).  FAA 'owns' all navigable airspace, like maybe 1" above your lawn and roof up to the top of the mesosphere. The craft has to be positively identifiable.  No matter what YOU want.  Now who the operator is is another matter.  Mrs. Bitty can't be allowed to harass the kids down the block for flying a UA in the park behind her home.  But an authorized safety official needs to know who to contact to get that UA out of an emergency situation.  A tough set of public/privacy issues.  Those of us working on this for some time understand this.  Grandstanding does not help.  Nor do things like DoH 'help'. And btw, this is pretty much the case for ALL Civil Aircraft Administrations (CAA) around the world.