Firefox Considers Enabling Private DNS Lookups by Default

Recent versions of the Mozilla Firefox web browser quietly introduced a privacy feature that many users may not have noticed. Firefox now supports something called a Trusted Recursive Resolver, which is essentially Mozilla's name for DNS-over-HTTPS (DoH). Despite being built into the browser, the feature remains switched off by default. That could change, because developers inside the Mozilla community have started discussing whether to turn it on for all users automatically.

To understand why this matters, it helps to know what the Domain Name System (DNS) does. DNS is often compared to a phone book for the internet. When you type a website name like example.com, your device asks a DNS server, also called a resolver, to translate that human-friendly name into a numeric IP address that computers use to connect. Traditionally, those DNS queries travel over the network in plain text, meaning anyone on the network path, such as an internet service provider, a Wi-Fi hotspot operator, or a malicious actor, can see which sites you are visiting and potentially alter the response. DNS-over-HTTPS changes this by sending DNS queries inside an encrypted HTTPS connection, the same secure protocol used for online banking and shopping. This hides the queries from network observers and makes it harder to block or tamper with them.

Firefox currently gives users the option to enable DoH manually, but it is not the default. The discussions in the Mozilla developer community are significant because changing the default would automatically route the DNS traffic of a huge number of everyday users through a DoH resolver, potentially one operated by a third party rather than the user's internet provider. This would be a major shift in how browsing privacy is delivered. Instead of requiring each person to find and configure an encrypted DNS service, the browser would handle it automatically for everyone.

However, DoH is not without controversy. An important concern is that it moves control plane, or signalling, messages to a different part of the network stack. In practical terms, DNS queries, which were once sent over a dedicated channel often managed by network administrators, become encrypted web traffic that is much harder for local networks to inspect. This can undermine DNS-based content filtering, parental controls, and enterprise security monitoring that rely on seeing or redirecting DNS requests. For example, a school or business that blocks access to certain categories of websites through its own DNS server would find that a browser using DoH directly may bypass those restrictions unless the browser is configured to respect them. Some network operators also worry about the centralizing effect if a small number of DoH resolver providers become dominant, because they would then see the browsing patterns of millions of users.

For individual users, the privacy benefit is real. Your internet provider or the owner of a public Wi-Fi network would no longer be able to easily log every domain name your browser looks up. That reduces one form of online tracking and profiling. But users should think carefully about which DoH resolver they trust. Any resolver, encrypted or not, can see the websites you visit. So the choice of a resolver with a clear, audited no-logs policy becomes important. For readers who want to take advantage of encrypted DNS without simply accepting whatever the browser picks, a service like AEU DNS offers private, encrypted DNS resolution with a no-logs commitment, giving you both the confidentiality of DoH and a provider you can choose deliberately.

Businesses and IT teams should follow this development closely. If Mozilla eventually enables DoH by default, it could change how DNS traffic flows on corporate networks and affect existing security tools. Teams may need to configure Firefox through group policy or use a DoH-capable resolver inside the organization to maintain visibility. Website owners should also be aware that more users may reach their sites through encrypted DNS, which is unlikely to change their own operations but reinforces the importance of supporting HTTPS everywhere.

For now, the feature remains off by default in Firefox, but the fact that it is being debated publicly means users have time to learn what DoH is, test it manually, and decide what configuration best matches their privacy and security needs. Encrypted DNS is one piece of a larger movement toward making the web more private by default, and staying informed is the first step.