Why Firefox Partnered with Cloudflare and NextDNS for DoH
This article explores Mozilla's decision to partner with Cloudflare and NextDNS to implement DNS over HTTPS (DoH) by default in the Firefox browser for specific regions. It examines the privacy vulnerabilities of traditional DNS, how DoH solves these issues by encrypting user traffic, why Cloudflare and NextDNS met Mozilla's strict privacy standards, and the regional factors that influenced this targeted rollout strategy.
The Vulnerability of Traditional DNS
The Domain Name System (DNS) acts as the phonebook of the internet, translating human-friendly website names into the numerical IP addresses computers use to locate each other. Historically, these DNS lookups have been sent in plain text without any encryption.
Even if you visit a secure website using HTTPS, the initial DNS request remains visible. This allows Internet Service Providers (ISPs), malicious actors on public Wi-Fi, and government entities to see exactly which websites you are visiting. Unencrypted DNS is also vulnerable to spoofing and "man-in-the-middle" attacks, where a third party intercepts the request and redirects the user to a fraudulent website.
How DNS over HTTPS (DoH) Solves the Problem
Mozilla decided to implement DNS over HTTPS (DoH) by default to close this longstanding privacy loophole. DoH works by taking the plain-text DNS requests your browser makes and sending them through an encrypted HTTPS connection.
By disguising DNS queries as regular, encrypted web traffic, third parties on the network can no longer eavesdrop on your browsing history, block specific requests, or tamper with the results. It ensures that the journey to a website is just as secure as the website itself.
Why Mozilla Chose Cloudflare and NextDNS
Encrypting DNS traffic does not eliminate the need for trust; it simply shifts that trust from the user's local ISP to the DNS resolver handling the encrypted requests. To prevent these new DNS providers from abusing their position, Mozilla created the Trusted Recursive Resolver (TRR) program.
Mozilla partnered with Cloudflare and NextDNS because they were willing to sign strict contracts adhering to the TRR privacy policy. The requirements for this partnership included:
- Limited Data Retention: Providers are only allowed to retain anonymised DNS data for a maximum of 24 hours strictly for operational and debugging purposes.
- No Data Monetization: Providers are strictly forbidden from selling, licensing, or sharing user data with third parties to build advertising profiles or track users.
- Transparency and Auditing: Providers must clearly publish their privacy practices and submit to regular audits to prove they are deleting user data as promised.
- Speed and Reliability: Both Cloudflare and NextDNS possess the massive global server infrastructure required to resolve encrypted queries in milliseconds, ensuring Firefox users do not experience a slowdown in browsing speeds.
Why the Rollout Was Limited to Specific Regions
Mozilla initially launched default DoH only in the United States before slowly expanding to other regions like Canada, Russia, and Ukraine. They chose a regional rollout rather than a global one for three main reasons:
1. Varying ISP Privacy Laws
In 2017, the United States Congress repealed regulations that prevented ISPs from selling their customers' browsing histories to advertisers. This created an urgent need to protect American users from their own ISPs. In contrast, regions like the European Union already had strong legal frameworks, such as the GDPR, which legally barred ISPs from harvesting and selling DNS data without consent.
2. Pushback Over Centralization and Local Laws
In Europe, particularly in the UK and Germany, internet regulators and ISPs strongly opposed Mozilla's initial DoH plans. They argued that routing European web traffic through a handful of US-based companies (like Cloudflare) centralized internet infrastructure and undermined European digital sovereignty. Furthermore, British ISPs complained that DoH allowed users to bypass legally mandated country-wide blocks on illegal content and broke ISP-level parental controls.
3. Network Compatibility Testing
Enabling DoH globally all at once risked breaking millions of complex networks. A phased regional rollout allowed Mozilla to test the feature and build safeguard mechanisms. This gave Firefox engineers time to ensure that DoH would automatically turn itself off if it detected enterprise networks, school filters, or local parental controls configured on a home router.