I have added the following line to my /etc/hosts file on Ubuntu:   www.tondering.dk www.xzutsfsdet.com is an IP address on my LAN.

www.tondering.dk is a server that exists on the internet.

www.xzutsfsdet.com is a server that does not exist on the internet.

If I use lynx or Chrome to access www.tondering.dk or www.xzutsfsdet.com, both of these requests are sent to, as I would expect.

But if I use Firefox, www.xzutsfsdet.com is sent to, but www.tondering.dk is sent to the external server (as if the /etc/hosts entry did not exist).

So it seems to me that Firefox only uses /etc/hosts if an external lookup fails, whereas other programs use /etc/hosts before performing an external lookup.

Is there any way to make Firefox behave as the other programs?

My operating system is Ubuntu 20.04 LTS, and my Firefox is version 78.0.2.

  • 2
    Do you have DNS-over-HTTPS enabled in Firefox?
    – muru
    Jul 29 '20 at 9:57
  • @muru Yes I do. I tried disabling it, and that appears to solve the problem! But I don't understand why using HTTPS would prevent the system from looking in /etc/hosts first.
    – oz1cz
    Jul 29 '20 at 10:06
  • 2
    That's the thing, isn't it? Firefox isn't using the system when it uses DNS-over-HTTPS. That's pretty much the whole point, I think: to bypass the system and local network configuration/restrictions in favour of a reliable DNS provider.
    – muru
    Jul 29 '20 at 10:14
  • Thank you, @muru. If you rewrite you comment as an answer, I will acknowledge it as the answer to my question.
    – oz1cz
    Jul 29 '20 at 10:23
  • Traditionally DNS queries are sent unencrypted over port 53 over the internet which can expose private information like what sites you visit and when. It also makes DNS queries subject to MITM attacks and blocking from unscrupulous ISPs and oppressive governments. DoH in the browser solves these issues and instead sends DNS traffic encrypted over port 443 (with all the other SSL traffic)
    – Nmath
    Jul 29 '20 at 10:28

Firefox has started enabling DNS-over-HTTPS for users:

DNS-over-HTTPS (DoH) [...] sends the domain name you typed to a DoH-compatible DNS server using an encrypted HTTPS connection instead of a plain text one. This prevents third-parties from seeing what websites you are trying to access.

This is a good thing, IMHO, but can cause things relying on local DNS configuration to break, such as intranet DNS and site blocking using /etc/hosts and so on. This is noted in the Firefox page:


  • Some individuals and organizations rely on DNS to block malware, enable parental controls, or filter your browser’s access to websites. When enabled, DoH bypasses your local DNS resolver and defeats these special policies. When enabling DoH by default for users, Firefox allows users (via settings) and organizations (via enterprise policies and a canary domain lookup) to disable DoH when it interferes with a preferred policy.

You can either disable it entirely:

Manually Enabling and disabling DNS-over-HTTPS

You can enable or disable DoH in your Firefox connection settings:

  • Click the menu button Fx57Menu and select Preferences.

  • In the General panel, scroll down to Network Settings and click the Settings… button.

  • In the dialog box that opens, scroll down to Enable DNS over HTTPS.

    On: Select the Enable DNS over HTTPS checkbox. Select a provider or set up a custom provider.

    Off: Deselect the Enable DNS over HTTPS checkbox.

    toggle doh

  • Click OK to save your changes and close the window.

Or exclude specific domains (and their subdomains):

Excluding specific domains

You can configure exceptions so that Firefox uses your OS resolver instead of DOH:

  • Type about:config in the address bar and press Return.

  • A warning page may appear. Click Accept the Risk and Continue to continue to the about:config page.

  • Search for network.trr.excluded-domains.

  • Click the Edit button next to the preference.

  • Add domains, separated by commas, to the list and click on the checkmark to save the change.

    Note: Do not remove any domains from the list.

About subdomains: Firefox will check all the domains you've listed in network.trr.excluded-domains and their subdomains. For instance, if you enter example.com, Firefox will also exclude www.example.com.

I would recommend using this option instead of disabling DoH altogether.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.