1588647 - [trr] Add NextDNS to list of TRR providers

Status: RESOLVED FIXED

(Firefox :: Security, task, P1)

Description

[Wayne Thayer]

NextDNS has signed our TRR contract per bug 1582580, so we'd like to get them added to the list ASAP (by Nov 1 in Release, if possible) . Note: the list should default to CloudFlare.

The display name should be "NextDNS" and the TRR URL is https://trr.dns.nextdns.io/

Comment 1

[Wayne Thayer]

PI request: https://jira.mozilla.com/browse/PI-402

Comment 2

[Maxx Crawford [:mcrawford :maxx :maxxcrawford]]

Attachment: Bug 1588647 - [trr] Add NextDNS to list of TRR providers r?sfoster!,nhnt11

Added NextDNS as optional TRR provider, along with tests to confirm that selecting it from the DoH drop down behaves as expected

Comment 3

[Wayne Thayer]

Please don't land this in Nightly until Dec 17th

Comment 4

[Maxx Crawford [:mcrawford :maxx :maxxcrawford]]

Running a try push before requesting check-in.

https://treeherder.mozilla.org/#/jobs?repo=try&revision=4fde9c7a9f9ca0ea7aa65919401fe12ab0cd6b95

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/efc4b4d5834e
[trr] Add NextDNS to list of TRR providers r=valentin,sfoster

Comment 6

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/efc4b4d5834e

Comment 7

[Ryan VanderMeulen [:RyanVM]]

This is something we should call out in the Beta73 relnotes IMO. Please set the relnote-firefox? flag on the bug and fill out the form so we can get that process started.

Comment 8

[Maxx Crawford [:mcrawford :maxx :maxxcrawford]]

(In reply to Ryan VanderMeulen [:RyanVM] from comment #7)

This is something we should call out in the Beta73 relnotes IMO. Please set the relnote-firefox? flag on the bug and fill out the form so we can get that process started.

Done!

Release Note Request info:

• [Why is this notable]:
  • Adding a second TRR provider besides Cloudflare.
• [Affects Firefox for Android]:
  • No
• [Suggested wording]:
  • Adding NI from :wayne: to elaborate.
• [Links (documentation, blog post, etc)]:
  • https://blog.mozilla.org/blog/2019/12/17/firefox-announces-new-partner-in-delivering-private-and-secure-dns-services-to-users/

Comment 9

[Wayne Thayer]

[Why is this notable]:
    Adding a second TRR provider in addition to Cloudflare.
[Affects Firefox for Android]:
    No
[Suggested wording]:
    In addition to Cloudflare (which remains the default when DNS over HTTPS is enabled) and custom DNS over HTTPS provider options, users now have the option of selecting NextDNS as the Firefox DNS over HTTPS resolver via the Network Settings dialog in Preferences.
[Links (documentation, blog post, etc)]:
    https://blog.mozilla.org/blog/2019/12/17/firefox-announces-new-partner-in-delivering-private-and-secure-dns-services-to-users/

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Added to the Beta73 relnotes.

Comment 11

[Henrik Skupin [:whimboo][⌚️UTC+1]]

I have a question. On their website NextDNS calls out some more steps to configure its usage in Firefox. So just selecting NextDNS in the dropdown inside of the preferences doesn't seem to be enough:

https://my.nextdns.io/configuration/2a7ce5/setup

1. Open Preferences.
2. Scroll down to the Network Settings section and click on Settings.
3. Scroll down and check Enable DNS over HTTPS.
4. Select Custom, enter https://dns.nextdns.io/2a7ce5 and click OK.
5. Enter "about:config" in the address bar (and click on I Accept the risk! if asked).
6. Set network.trr.bootstrapAddress to 45.90.28.0.
7. Set network.trr.mode to 3.

What's wrong with our default settings?

Comment 12

[Valentin Gosu [:valentin] (he/him)]

(In reply to Henrik Skupin (:whimboo) [⌚️UTC+1] from comment #11)

I have a question. On their website NextDNS calls out some more steps to configure its usage in Firefox. So just selecting NextDNS in the dropdown inside of the preferences doesn't seem to be enough:

This is just speculation, but I assume it's because nextdns provides adblocking, and other personalized services (which is why they give a custom DoH path), and also they would rather you run it in mode3 so there's no fallback?

The default settings we have for nextDNS do work for resolving names, but I suspect it doesn't offer all the features they provide.

Comment 13

[Wayne Thayer]

NextDNS offers a generic, unfiltered DNS service at the URL embedded in Firefox. If you wish to customize the NextDNS service, you need to select "custom" and enter the unique URL provided to you by NextDNS as described on their website.

Comment 14

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Thanks for the explanation.

Btw. is that something we want to put into the release notes?

Comment 15

[Wayne Thayer]

NI to Ryan per comment 14 - suggest that we explain in the 73 release notes that selecting NextDNS as the DoH provider gives the user an unfiltered DNS service (no blocking of malware, adult content, etc.).

Comment 16

[krystian3w]

Henrik Skupin you cannot test property configuration on https://my.nextdns.io/configuration/2a7ce5/setup (2a7ce5) ttr version for all people should have other tester.