<div dir="ltr"><div>Indeed, the policy can be used to disable DoH and please keep in mind that DoH is not being deployed on ESR.<br></div><div><br></div><div>More details on the DoH roll-out:</div><div>- SUMO page <a href="https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https">https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https</a></div><div>- ESR will NOT be impacted</div><div>- We're targeting rapid release users on 69 with IP addresses located in the US.
We're NOT enabling DoH if any enterprise policy is detected, and if the
enterprise roots pref is enabled. However, the proper way is to set the DoH enterprise policy to disable it. Administrators can also add exceptions, if they like DoH but it can break specific sites (e.g. because of split-horizon) </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Sep 9, 2019 at 9:10 AM Philipp Madersbacher <<a href="mailto:philipp.madersbacher@gmail.com">philipp.madersbacher@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hello, If your main intent is to centrally manage/disable DoH in Firefox, you can easily do so through a GPO - the relevant links for this are:</div><div><a href="https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows" target="_blank">https://support.mozilla.org/en-US/kb/customizing-firefox-using-group-policy-windows</a></div><div><a href="https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps" target="_blank">https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps</a></div><div><br></div><div>No need to make the matter more complicated than it is ;-)</div><div><br></div><div>Best regards<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Am So., 8. Sept. 2019 um 22:28 Uhr schrieb Eddie Rowe <<a href="mailto:eddie.rowe@tdhca.state.tx.us" target="_blank">eddie.rowe@tdhca.state.tx.us</a>>:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_-8493053023189767239gmail-m_-6460672576408080140WordSection1">
<p class="MsoNormal">Given Mozilla’s decision to turn on DNS over HTTPS we have to secure Firefox to disable this type of nonsense or remove it from every PC in the next two weeks. Chrome is configured through an easy to manage GPO which leverages other really
smart people who have created a security baseline along with preconfigured GPOs, while Firefox does not seem to have this level of support.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Assuming a person is new to Firefox, exactly what are we supposed to modify to setup things securely? I see references to things going into Mozilla.cfg, policies.json, GPO, autoconfig.js…I probably missed a file too. I see people helpfully
answering a question and telling the person to go to <a href="https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment" target="_blank">
https://developer.mozilla.org/en-US/Firefox/Enterprise_deployment</a> for the answer to their question, but there are just more links there. I see people posting to not to bother with GPO because all the options are not there, but other say there are GPO settings
that are no elsewhere… I see references that one thing is set one place, another place overrides… I see one document say the autoconfig.js file goes into the folder where Firefox is installed, but the same document says it does into a subfolder… I see references
to setting preferences in the policies.json file, but I thought Mozilla.cfg was to be used for this? Finally I see mention that there are preferences that are set in the source code that are not exposed to about:config?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Surely there is a simple one page document that walks you through this so we can spend a LIMITED amount of time sorting this out???<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="https://www.zdnet.com/article/mozilla-to-gradually-enable-dns-over-https-for-firefox-us-users-later-this-month/" target="_blank">https://www.zdnet.com/article/mozilla-to-gradually-enable-dns-over-https-for-firefox-us-users-later-this-month/</a>
- Ready or not, here comes DNS over HTTPS to bypass all security you have using DNS to block dangerous sites.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<br>
</blockquote></div>
_______________________________________________<br>
Enterprise mailing list<br>
<a href="mailto:Enterprise@mozilla.org" target="_blank">Enterprise@mozilla.org</a><br>
<a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a><br>
<br>
To unsubscribe from this list, please visit <a href="https://mail.mozilla.org/listinfo/enterprise" rel="noreferrer" target="_blank">https://mail.mozilla.org/listinfo/enterprise</a> or send an email to <a href="mailto:enterprise-request@mozilla.org" target="_blank">enterprise-request@mozilla.org</a> with a subject of "unsubscribe"<br>
</blockquote></div>