Understanding network.trr.mode Values in Firefox

This article provides a complete breakdown of the numerical values associated with the network.trr.mode preference in the Mozilla Firefox web browser. By modifying these numbers in the browser's advanced configuration page, users can precisely control how Firefox handles DNS over HTTPS (DoH) through its Trusted Recursive Resolver (TRR), ranging from standard unencrypted lookups to strict, encrypted-only DNS resolution.

To view or change these settings, type about:config into the Firefox address bar, accept the risk warning, and search for network.trr.mode. The integer value assigned to this preference dictates the browser's DNS behavior as follows:

Mode 0: Off (Default State)

When set to 0, Firefox disables the Trusted Recursive Resolver and relies on the operating system’s default DNS resolver. This is the baseline default state in regions where Mozilla has not automatically rolled out DNS over HTTPS. Because this mode represents a passive default rather than an explicit user choice, Firefox may automatically change this setting in the future if DoH is rolled out to your region.

Mode 1: Race (Deprecated)

Setting the value to 1 previously instructed Firefox to send DNS queries to both the native operating system resolver and the DoH resolver simultaneously, using whichever response arrived first. Mozilla has deprecated this mode, and it no longer functions in modern versions of Firefox.

Mode 2: TRR First (Fallback Enabled)

When set to 2, Firefox prioritizes privacy by sending DNS requests to the Trusted Recursive Resolver over an encrypted HTTPS connection first. However, if the DoH server fails to respond, takes too long, or cannot resolve the domain, Firefox will fall back to the operating system's default, unencrypted DNS resolver to ensure the webpage still loads. In the standard Firefox privacy settings menu, this mode corresponds to the "Increased Protection" option.

Mode 3: TRR Only (Strict Mode)

A value of 3 forces Firefox to use the Trusted Recursive Resolver exclusively. The browser will only perform encrypted DNS lookups via the configured DoH provider. If the DoH lookup fails for any reason, Firefox will not fall back to the operating system's DNS, and the website will fail to load. This prevents any accidental data leaks to local network resolvers. In the standard Firefox privacy settings menu, this mode corresponds to the "Max Protection" option.

Mode 4: Shadow (Deprecated)

Setting the value to 4 was previously used by Mozilla for telemetry and testing. In this mode, Firefox ran TRR queries in the background to measure performance and reliability, but strictly used the operating system's native DNS responses for actual web navigation. Like Mode 1, this mode is obsolete and no longer active.

Mode 5: Off by Choice

When set to 5, the Trusted Recursive Resolver is completely disabled, and Firefox exclusively uses the operating system's standard DNS. While functionally identical to Mode 0, Mode 5 flags that the user has intentionally opted out of DNS over HTTPS. Setting this to 5 prevents Firefox from ever automatically enabling or modifying your DoH settings during future browser updates. In the standard Firefox privacy settings menu, this corresponds to the "Off" option.