Does it matter if I’m pretty much always on a VPN connection? If yes, what is the default protection? I mean, what does it mean that Firefox decides when to use secure DNS? Also, why would I not want always “Max Protection”?

And to me, there are no benefots of not using it for the safety I want with my browsing. But I always use a VPN so this is not even a thing I think about.

The “Default protection” is probably there because Firefox relies on third-party DoH resolvers (like Cloudflare and NextDNS) and they don’t ever want to have the browser blamed for a third party service not working. AS an end user and if you want to have DoH enabled, you should definitely use Max p…

[image] win11.shading291: Does that really happen? If so, how/why? A couple I can think of: Some DNS queries are only resolvable by network / system resolvers (ex: .lan, .internal, .local etc). Your network may block access to DoH, in which case the client may decide to use network / system…

[image] ignoramous: That isn’t the case. What do you mean? I’m not private to Firefox decision making, so this is why I said “probably”, but there could well be other reasons.

To answer my own question “Also, why would I not want always “Max Protection”?“, the answer would be “to prevent DNS leak”.” More on the below topic: [image] Recommend against custom DNS in browsers while using a VPN toolboxSite Development Hello there. I am w…

The DNS is not technically part of the browser fingerprint. It is there by defaultin Mullvad Browser, because we can’t assume where and how users are going to use Mullvad Browser. If you use a trustworthy VPN (which potentially could be looking at all your traffic), then you should trust them not …

If you are almost always connected to a VPN, then why would you want to enable DNS over HTTPS? I don’t understand. Your VPN is supposed to provide you with private DNS. In my case, I have that option disabled. But be careful, DNS over HTTPS is not a “security measure.” You are only protecting your…

Meaning, I should put it as ‘default protection’ instead of ‘Max Protection’ if I use a VPN all the time, correct? Leaving Max Protection would risk DNS leak, right? Thanks a lot for your answers :slight_smile:

[image] ruihildt: The DNS is not technically part of the browser fingerprint. But it can be detected by websites and potentially used for fingerprinting

DNS over HTTPS

Questions

win11.shading291 October 14, 2025, 8:41pm 13

@ruihildt @ignoramous

The thread above confused me. From Proton’s site, it seems right.

We therefore strongly recommend against using DoH (and the similar DNS over TLS standard) with Proton VPN .

Meaning, I should probably remove my router config and just use the VPN at all times and install the VPN on other people’s computer in my home.

But on Mullvad Browser, it is setup as max protection by default. I don’t want to touch the setting, because of fingerprinting. So, I’m confused on what I should do.

Topic		Replies	Views
VPN VS DNS or one VPN use? Questions	5	765	April 26, 2025
Add turn off DoH for Mullvad Browser when using a VPN Site Development	1	614	September 24, 2024
Recommend against custom DNS in browsers while using a VPN Site Development	15	3195	September 27, 2025
Firefox 143 for Android to introduce DoH General article	7	968	September 27, 2025
DNS question Questions	1	210	September 1, 2024

DNS over HTTPS

Related topics