HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox

jimp

Firefox has recently added a feature they call Trusted Recursive Resolver (TRR). It uses DNS over HTTPS to resolve DNS queries directly in the browser rather than using the native OS resolver. Though they have not currently enabled it by default, they would like to do so in the near future.

While this may offer some additional privacy benefits in certain situations, with regard to pfSense it means that your DNS policies like DNSSEC, host and domain overrides, caching, pfBlocker DNSBL, and so on will be ignored by clients using TRR.

Is this a good thing? Well, that depends. For some, sure. For others, no. There are technical reasons not to want this behavior, as mentioned above and in more detail below. There are also privacy benefits as well for many users. Mozilla has partnered with Cloudflare so that means TRR DNS queries are sent there and not to the intended server. Some people already use Cloudflare, or they don't care where the queries go, so that's a wash or a net gain. If you do not trust Cloudflare or do not want to put all your eggs in the Cloudflare basket, that's not so good.

In particular this could potentially interfere with things like Captive Portal, but TRR does have a built-in fallback if TRR fails to resolve a host. It may add some additional time to Captive Portal initial requests but how much remains to be seen. I haven't tested this yet, but I don't expect it to be a significant factor.

Another potential source of trouble is mixing this with a proxy, depending on whether or not you splice/bump/MITM SSL. I don't have a setup handy to try this, but it could easily go either way. May be fine, may break. Even if the DNS over HTTPS queries work through the proxy, the fact that it's using a different DNS server than the proxy could cause failures.

So what can be done about it? That remains to be seen as well. This is a user preference in Firefox but it not currently exposed as a user option outside of about:config. From about:config a user can set network.trr.mode to 5 to completely disable TRR. This may also be possible on larger managed deployments on a wider scale, but that depends on the OS and network infrastructure.

For BYOD/Guest networks there isn't much that can be done by a network admin. Mozilla is not using 1.1.1.1 for this, it is using https://cloudflare-dns.com/dns-query and the DNS query for that must be bootstrapped using the native OS resolver. So if queries for that domain fail it may cause TRR to fail and fall back to your configured DNS server. This could potentially be accomplished with DNS host overrides.

For those interested in testing the behavior, in Firefox, open about:config and set network.trr.mode to 2 which will prefer TRR but fall back to regular DNS. The current values are:

0: Off by default
1: Firefox will choose based on which is faster
2: TRR preferred, fall back to DNS on failure
3: TRR only, no DNS fallback
5: TRR completely disabled

Canary Domain

You can use the canary domain to nudge clients so they do not use DoH when they are attempting to do so automatically.

In the DNS Resolver advanced settings, add the following configuration:

server:
local-zone: "use-application-dns.net" always_nxdomain

johnpoz

Yeah I am not a fan of this at all.. If they want to allow the users to enable this - sure ok.. But it should never be on out of the box without user interaction to enable it if you ask me.

I already have network.trr.mode set to 5... I see no use of this at all

chpalmer

@johnpoz said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

network.trr.mode

Default seems to be 0 for everyone I know.. Is 5 better?

jimp

0 may turn into 2 based on what Mozilla wants to do, since 0=default, 5=explicitly disabled.

chpalmer

Thanks 5 it is!

yon 0

@chpalmer said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

默认似乎都是0 .. 5更好吗？

i am using u simpledns server :)

my ISP blocked the Cloudflare , so i want to have to change to close

johnpoz

Huh?? yon your post is gibberish.. what server you want to use has zero to do with what TRR is..

yon 0

@johnpoz
I mean, I can only use my own DNS or VPN.If a website is blocked, TRR may not solve this problem.

johnpoz

TRR is more problems than anything ti could possible solve.. Especially if they turn it on without explicit users acknowledgment.. Problem is even the user agrees to some pop up, vast majority of them not even going to understand what they are agree too.. Typical users - and then wondering why their local resolving of xyz.com broke.

This should require users actually having to do something to enable it, like edit about:config entry and on purpose turn it on.

And you sure and hell could use cloudflare through your vpn... So you still could use trr if you wanted to, even if your isp blocks where its going. I still don't why anyone would want to use this.. Sorry I don't want to send all my dns queries to 1 provider.. I don't want to use you for dns - I will do it myself thank you very much.

johnpoz

Got question about ios version of firefox.. How can you ensure this is never used? about:config is not available in ios version of firefox.

jimp

That's a tough one to answer.

I did see a post on Reddit earlier this week from someone who claimed association with Mozilla that said they no longer plan on ever making this the default, only available as a GUI option. I'm not holding my breath waiting on that to be verified, but it is at least a bit of hope that we won't have to jump through hoops.

johnpoz

Thanks for the info - lets hope they don't try and enable this on the sly in the background ;) Doing such a thing for sure would force me to rethink my browser choice..

bcruze

this is why i use firefox ESR.

the version that would get this automagically would be the standard version of FF

johnpoz

So it looks like mozilla is on course for enabling this by default... UGGHHH!
https://blog.mozilla.org/futurereleases/2019/09/06/whats-next-in-making-dns-over-https-the-default/

And upon checking seems somehow somewhere in some past update my setting of network.trr.mode to 5 got reset to 0..

I am really curious once they start turning this on, if turning it off in the options will be enough.. I do not want this, stay away from my dns.. They should use what the OS uses, if you want to offer doh or dot - great, it should be OPT IN ONLY!!! Turning this on be default is BS plain and simple..

Seems they are using the canary domain use-application-dns.net so if your dns resolves NX their doh should not be used.

you can set that in unbound like this
local-zone: "use-application-dns.net" static

Which I have already done on my network.

I believe you can also set
security.enterprise_roots.enabled

To true, to stop it...

I will be keeping an eye on this.. Stay away from my dns mozilla...

Looks like pihole already has commit to disable it via the canary.. I would hope pfblocker will be doing something similar
https://github.com/pi-hole/pi-hole/pull/2915

I think I will reach out to bbcan177 and ask..

chpalmer

@johnpoz said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

And upon checking seems somehow somewhere in some past update my setting of network.trr.mode to 5 got reset to 0..

Just checked and so did mine. Back to Waterfox for me..

kiokoman

good, time to uninstall and change to another browser

Pippin

I'm on latest FF (Linux Mint 18.3), my setting 5 did not get changed.

tman222

I have a few Linux systems that use the ESR version of Firefox (60.x). On those systems the default setting is 0 and setting it to 5 appears to break DNS altogether. So I'm guessing 5 is not a supported option on the ESR version. Checking out a more recent version of Firefox on a couple Mac's did allow me to set the option to 5 and everything still works.

Some more info about disabling DoH from Mozilla:

https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https

Glad that Pi-hole is already had a PR on this.

@johnpoz - can you explain what "local-zone: "use-application-dns.net" static" does exactly and how in NXDOMAIN being returned? Thanks in advance.

johnpoz

So per their disable article you linked to, if that domain returns a NX vs actual IP then firefox is not suppose to use doh..

So if you set that in your options box.
server:
local-zone: "use-application-dns.net" static

When a query is done for that - it will return NX.

$ dig @192.168.9.253 use-application-dns.net

; <<>> DiG 9.14.4 <<>> @192.168.9.253 use-application-dns.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 23041
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;use-application-dns.net.       IN      A

;; Query time: 0 msec
;; SERVER: 192.168.9.253#53(192.168.9.253)
;; WHEN: Sun Sep 08 14:22:35 Central Daylight Time 2019
;; MSG SIZE  rcvd: 52

Notice the
status: NXDOMAIN

I have sent a PM to bbcan177, but haven't heard anything back yet... But yeah would be nice if pfsense works out something - say if pfblocker is being used, unbound will auto return the NX for that, or something..

Or maybe pfsense could put in a check box to have that return NX..

I really don't now what Mozilla is thinking here.. That is great you want to offer this for your clients - but it really should be OPT IN ONLY!!! Run a PR campaign to get your users to set it.. but making it default is WRONG..

I have set the network.trr to 5 again, will keep an eye on that, and have set
security.enterprise_roots.enabled
To true as well.. so will be watching that as well, when the next update comes out.. Running 69.0 currently of firefox.

tman222

@johnpoz said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

local-zone: "use-application-dns.net" static

Thanks @johnpoz - I appreciate the follow up an explanation. I was actually more curious what that configuration line did exactly and why you chose it specifically to solve this issue?

Is the idea just to create a local DNS Zone with this domain, but since no actual (local) records exist for it, it will simple return NXDOMAIN?

Thanks again!