1840741 - Secure DNS not working on macOS

Status: RESOLVED FIXED

(Core :: Networking: DNS, defect)

Description

[techsupp.7zh35]

Steps to reproduce:

I have long had Cloudflare as my DNS servers in macOS System Settings/Network/WiFi/Details/DNS.

Since Firefox 114, in Firefox Privacy & Security/Enable Secure DNS, it shows:

Status: Not active (NS_ERROR_NET_TIMEOUT_EXTERNAL)
Provider: Cloudflare

with both Default Protection and Increased Protection.

And Max Protection results in Firefox being unable to go to any website.

Additionally, https://1.1.1.1/help

takes a very long time to report and finally says:

---

Debug Information

Connected to 1.1.1.1 No
Using DNS over HTTPS (DoH) No
Using DNS over TLS (DoT) No
Using DNS over WARP No
AS Name Checking...
AS Number Checking...

Connectivity to Resolver IP Addresses

1.1.1.1 Yes
1.0.0.1 Yes
2606:4700:4700::1111 Yes
2606:4700:4700::1001 Yes

---

Removing Cloudflare from macOS settings and reverting to the default ISP DNS servers does not change the report from https://1.1.1.1/help

---

In Safari, on the other hand, with Cloudflare 1.1.1.1 in the Mac DNS settings, https://1.1.1.1/help reports:

---

Connected to 1.1.1.1 Yes
Using DNS over HTTPS (DoH) No
Using DNS over TLS (DoT) Yes
Using DNS over WARP No
AS Name Cloudflare

---

Thanks

Actual results:

see above

Expected results:

Firefox should be using Cloudflare and it should be encrypted

Comment 1

[BugBot [:suhaib / :marco]]

The Bugbug bot thinks this bug should belong to the 'Core::Networking: DNS' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 2

[techsupp.7zh35]

MORE

Switching my internet connection to my iPhone hotspot (rather than home WiFi) causes, within Firefox, https:/1.1.1.1/help to report:

Connected to 1.1.1.1 Yes
Using DNS over HTTPS (DoH) No
Using DNS over TLS (DoT) Yes
Using DNS over WARP No
AS Name Cloudflare

So it's just Firefox, not Safari, and it's just on the home network (Cox), not on the mobile hotspot network.

iPhone Safari on the home network also gets a good report from https://1.1.1.1 help

https://dnscheck.tools in Firefox on the home network reports that my DNS resolvers are Cloudflare

Comment 3

[Kershaw Chang [:kershaw]]

Hi reporter,

Please take a look at this link.
I assume DoH is disabled because of the canary domain.
What's the output of dig use-application-dns.net on your home network?

Comment 4

[techsupp.7zh35]

Seems not to be that, kershaw.

dig use-application-dns.net

;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32488
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;use-application-dns.net. IN A

;; ANSWER SECTION:
use-application-dns.net. 475 IN A 44.236.72.93
use-application-dns.net. 475 IN A 44.236.48.31
use-application-dns.net. 475 IN A 44.235.246.155

;; Query time: 15 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Sat Jul 08 11:28:57 PDT 2023
;; MSG SIZE rcvd: 100

Comment 5

[Kershaw Chang [:kershaw]]

Could you try to record a http log?
Please set the DoH mode to max protection and navigate to any website. Then, you can stop logging and send the log file to [e-mail].

Comment 6

[techsupp.7zh35]

As I mentioned above, when Firefox is set to max protection, it will not go to any website. But I can attempt to follow the direction at that link to do that.

Comment 7

[techsupp.7zh35]

This resolved itself following one of your updates after I filed my report.

Comment 8

[Sunil Mayya]

Closing the bug based on the above comment.