:Use DoH in a browser

Introduction

In web applications, DNS resolution is handled by the runtime environment (WebView, CEF, or browser) and is transparent to the web layer. JavaScript can retrieve IP addresses through HTTPDNS, but web standards prevent direct IP connections with custom Host headers.

Embedded web containers (WebView, CEF, Electron) support local DNS bypass. In third-party browsers, configure DoH manually to prevent DNS hijacking and pollution.

The following sections cover Chrome, Firefox, and Edge.

Prerequisites

Complete the steps in Configure the DoH service.

Configure a DoH endpoint in Chrome

These steps use Chrome 131.0.6778.265 as an example.

1. Open Chrome. Go to Preferences > Privacy and security > Security. You can also enter chrome://settings/security in the address bar.

2. In the Advanced section, configure the DoH endpoint.

   1. Turn on Use secure DNS.

   2. Select a custom DNS provider.

   3. In the text box, enter the DoH endpoint.

   

3. Enter a URL in the address bar to verify the configuration.

   • If the domain name is on the accessible domain name list and the page loads, the configuration is successful.

   • If the domain name is not on the accessible domain name list or is blocked, the page fails to load, which confirms that DoH is working.

   Important

   Ensure that Chrome's DoH probe domain, google.com, is resolvable.

Configure a DoH endpoint in Firefox

These steps use Firefox 132.0.2 as an example.

1. Open Firefox. Go to Preferences > Privacy & Security. You can also enter about:preferences#privacy in the address bar.

2. In the DNS over HTTPS section, configure DoH.

   

3. Select Max Protection. From the drop-down menu, select Custom, and then enter the DoH endpoint.

4. Enter a URL in the address bar to verify the configuration.

   • If the domain name is on the accessible domain name list and the page loads, the configuration is successful.

   • If the domain name is not on the accessible domain name list or is blocked, the page fails to load, which confirms that DoH is working.

5. On success, Firefox displays the result in the DNS over HTTPS section.

Configure a DoH endpoint in Edge

These steps use Edge 132.0.2957.140 as an example.

1. Add the probe domain google.com to the accessible domain name list in the console. Skip this step if resolution for all domain names is enabled.

2. Open Edge. Go to Preferences > Privacy, search, and services. You can also enter edge://settings/privacy in the address bar.

3. In the Security section, configure the DoH endpoint.

   1. Turn on Use secure DNS to specify how to look up the network address for websites.

   2. Select Choose a service provider.

   3. In the text box below, enter the DoH endpoint.

4. Enter a URL in the address bar to verify the configuration.

   • If the domain name is on the accessible domain name list and the page loads, the configuration is successful.

   • If the domain name is not on the accessible domain name list or is blocked, the page fails to load, which confirms that DoH is working.

FAQ

Webpage fails to open

• Symptom

  

• Causes and solutions

  Cause	Solution
  The DoH service is not enabled.	Enable the DoH service. Configure the DoH service.
  An incorrect DoH endpoint address is used.	Get the correct DoH endpoint address from Configure the DoH service.
  The primary site domain name is not in the accessible domain name list.	Solution 1: Add the primary site domain name to the accessible domain name list. Accessible domain names. Solution 2: Enable resolution for all domain names. Use this option with caution.

Some elements on the webpage fail to render

• Symptom

  

• Causes and solutions

  Cause	Solution
  Related domain names are not in the accessible domain name list.	Solution 1: Add the related domain names to the accessible domain name list. Domain name management. Note A website may require multiple domain names to render fully. Add all required domain names. Solution 2: Enable resolution for all domain names. Evaluate this option carefully.