Advice Request Firefox playing silly buggers...

[porkpiehat]

ok, after Firefox updated, I loaded the Ensi page, and it is intermittently showing Secure DNS errors...
DOH is set in prefs, with Cloudflare option enabled.
can anyone shed any light on this.. thank you.

 

[silversurfer]

ok, after Firefox updated, I loaded the Ensi page, and it is intermittently showing Secure DNS errors...
DOH is set in prefs, with Cloudflare option enabled.
can anyone shed any light on this.. thank you.

What is your DNS service setup on your router ? do you have setup Cloudflare DNS on network settings of Windows 10 ?

Honestly, I don't know what is the reason, just can guess it's either Cloudflare or Mozilla/Firefox, if all related settings are properly enabled by user.

 

[porkpiehat]

router is fixed by ISP
network settings are set to 1.1.1.1
browser has DOH and Cloudflare set.

FF has only started messing around after it updated yesterday.
Edge is not playing up at all, when ENSI page is opened.

 

[silversurfer]

Just tried out on my Firefox 87.0, Cloudflare DoH chosen on settings of Firefox.
Here is the same "Secure DNS" at first shows error but after re-test works fine (green)

I cannot tell what was before on Firefox 86 as my DoH is set for Quad9.

 

[harlan4096]

I confirm that sometimes the test gives in Secure DNS different results, but finally I get also green (FF 87 + Cloudflare in FF + Cloudflare in AdGuard Desktop)...

 

[Kongo]

ok, after Firefox updated, I loaded the Ensi page, and it is intermittently showing Secure DNS errors...
DOH is set in prefs, with Cloudflare option enabled.
can anyone shed any light on this.. thank you.View attachment 256248View attachment 256249

Whats the value of "network.trr.mode" in your about:config settings? NextDNS for example requires to set it to the value "3". Not sure how it supposed to be with Cloudflare tho.

 

[porkpiehat]

"network.trr.mode" is 3

 

[Kongo]

"network.trr.mode" is 3

Try setting it to "0" as this is default. Cloudflare doesn't state anywhere to set it to "3" as far as I know.

Maybe this helps too:

 

[porkpiehat]

Try setting it to "0" as this is default. Cloudflare doesn't state anywhere to set it to "3" as far as I know.

'0' made no difference.

 

[Kongo]

'0' made no difference.

My bad, doesn't make sense at all what I just said. Setting it to 0 just disables DoH.
Only options that make sense are setting it to either 2 or 3.
Looks like it's an issue with Firefox tho...

 

[porkpiehat]

lol... so that's why I had to enable DOH again..

 

[Kongo]

lol... so that's why I had to enable DOH again..

Just use NextDNS within Firefox and use this testing site: https://test.nextdns.io/

All problems will be gone.

 

[blackice]

That test is also known to be partially broken for something like the last year as far as I know.

 

[Kongo]

That test is also known to be partially broken for something like the last year as far as I know.

Working fine on my side.

 

[blackice]

Working fine on my side.

I could be misremembering, but I seem to remember hearing that it was broken and didn't always provide accurate results especially if not using cloudflare (which in this case they were using 1.1.1.1). As I said, I could be mistaken.

 

[Kongo]

I could be misremembering, but I seem to remember hearing that it was broken and didn't always provide accurate results especially if not using cloudflare (which in this case they were using 1.1.1.1). As I said, I could be mistaken.

I'm confused now... Are you talking about the Cloudflare ESNI test or the NextDNS test? If you are talking about the Cloudflare test then yes, it won't detect other DNS providers as a secure DNS transport. When using for example NextDNS with correct settings the testing site will look like that:



So the "You may not be using secure DNS" message mostly indicates that you actually are using an encrypted DNS protocol from a different provider than Cloudflare.

 

[blackice]

I'm confused now... Are you talking about the Cloudflare ESNI test or the NextDNS test? If you are talking about the Cloudflare test then yes, it won't detect other DNS providers as a secure DNS transport. When using for example NextDNS with correct settings the testing site will look like that:

View attachment 256251

So the "You may not be using secure DNS" message mostly indicates that you actually are using an encrypted DNS protocol from a different provider than Cloudflare.

Yes the ESNI test. But I may also be confusing something else with this test. Clearly it’s too early for me to be posting

 

[The_King]

I can also confirm that something goes haywire when you enable the Cloudflare DoH option in FF 87.

Both of the following pages give random YES and NO results for DoH and Secure DNS test results

1.1.1.1 — One of the Internet’s Fastest, Privacy-First DNS Resolver

✌️✌️ Browse a faster, more private internet.

1.1.1.1

Cloudflare Browser Check

Secure DNS Transport using DoH (DNS over HTTPS) or DoT (DNS over TLS) and SNI with ECH

www.cloudflare.com

I tested this issue by using DNSCrypt and enabling Cloudflare resolvers only . Now it always gives the exact same result
on both pages. The Enable DNS over HTTPS option has to remain unticked in order for DNSCrypt settings to work correctly.

The advantage of using DNSCrypt is that your entire system including the FF browser is setup to use DNS over HTTPS.
I am sure the same result can be achieved with YogaDNS.

So it does look like there is indeed an issue with the current Clouflare DoH setting in FF 87.