Understanding ODoH and How to Configure It in Firefox

This article provides a quick overview and a straightforward guide to Oblivious DNS over HTTPS (ODoH), a privacy protocol designed to enhance your online anonymity. First, it explains what ODoH is and how it improves upon standard encrypted DNS by separating your IP address from your browsing queries. Second, it provides a step-by-step walkthrough on how to configure and enable ODoH within the Mozilla Firefox web browser using its advanced configuration settings.

What is Oblivious DNS over HTTPS (ODoH)?

When you type a website name into your browser, the Domain Name System (DNS) translates that name into an IP address so your computer can load the site. Standard DNS requests are sent in plain text, allowing your Internet Service Provider (ISP) to see every website you visit.

DNS over HTTPS (DoH) was created to solve this by encrypting your DNS queries. However, DoH has a flaw: the DNS resolver (such as Cloudflare or Google) still sees both your IP address and the websites you are requesting. You are simply shifting trust from your ISP to the DNS provider.

Oblivious DNS over HTTPS (ODoH) solves this trust issue. Standardized by the Internet Engineering Task Force (IETF), ODoH adds a layer of public-key encryption and an intermediary proxy server between you and the DNS resolver. This ensures that no single entity knows both who you are and what websites you are visiting.

How ODoH Works

ODoH relies on three distinct components to protect your privacy:

  1. The Client (Your Browser): When you request a website, your browser encrypts the DNS query specifically for the Target resolver. It then sends this encrypted query to a Proxy.
  2. The Oblivious Proxy: The proxy receives the request from your browser. It sees your IP address, but because the query is encrypted, it cannot see what website you are trying to visit. The proxy simply forwards the encrypted query to the Target.
  3. The Oblivious Target (The Resolver): The Target decrypts your query and finds the IP address of the website you want to visit. However, because the request came from the Proxy, the Target only sees the Proxy's IP address, not yours. It encrypts the answer and sends it back through the Proxy to your browser.

By separating the network traffic, the Proxy knows who you are but not what you are asking for, and the Target knows what is being asked for, but not who is asking.

How to Configure ODoH in Firefox

Configuring ODoH natively in Firefox requires using the browser's advanced configuration page, as these settings are not visible in the standard settings menu.

Step 1: Open the Advanced Configuration Page

  1. Open the Firefox browser.
  2. Type about:config into the address bar and press Enter.
  3. Click the Accept the Risk and Continue button to proceed to the settings search page.

Step 2: Enable Firefox's Trusted Recursive Resolver (TRR)

Before ODoH can work, you must tell Firefox to use encrypted DNS instead of your operating system's default DNS.

  1. In the search bar at the top of the about:config page, type network.trr.mode.
  2. Click the Edit (pencil) icon next to the preference.
  3. Change the value to 2 (this uses encrypted DNS by default and falls back to standard DNS if it fails) or 3 (this forces encrypted DNS only, with no fallback).
  4. Click the Save (checkmark) icon.

Step 3: Enable ODoH

  1. In the about:config search bar, type network.trr.odoh.enabled.
  2. Double-click the preference or click the Toggle icon on the right to change its value from false to true.

Step 4: Configure the ODoH Target and Proxy

For ODoH to function, you must specify both the Target resolver and the intermediary Proxy you wish to use.

  1. Set the Target Host: Search for network.trr.odoh.target_host. Click the Edit icon and enter the URL of a public ODoH target (for example, https://odoh.cloudflare-dns.com). Save the change.
  2. Set the Target Path: Search for network.trr.odoh.target_path. Edit the value and set it to dns-query. Save the change.
  3. Set the Configs URI: Search for network.trr.odoh.configs_uri. Edit the value and enter the target's configuration URL (for example, https://odoh.cloudflare-dns.com/odohconfigs). Save the change.
  4. Set the Proxy URI: Search for network.trr.odoh.proxy_uri. Click the Edit icon and enter the URL of a trusted ODoH proxy server provided by a third party (never use the same provider for both the Target and the Proxy, as this defeats the purpose of ODoH). Save the change.

Step 5: Restart Firefox

Close and reopen the Firefox browser. Your DNS queries will now be routed through the Oblivious Proxy before reaching the Oblivious Target, ensuring your IP address and your browsing habits remain completely separated.