title: Q: DNS over HTTPS (DOH) and corporate split DNS setups
body: <p>Since Mozilla and Google announced, that they intend to activate DNS over HTTPS in the default settings in the future and the IETF approved officially the draft (<a href="https://datatracker.ietf.org/wg/doh/about/" rel="nofollow noreferrer">https://datatracker.ietf.org/wg/doh/about/</a>), I tried to understand the impact on our corporate network. It is now possible for every application to bypass the internal DNS Server (assigned via DHCP) and directly connect to a public DNS service. There is no easy way for an administrator to prevent application and users doing this, since all traffic is routed through HTTPS.</p>
  
  <p>In most corporations that I know, there is a split DNS setup in place, allowing internal (intranet) and external (internet) name and IP resolution for the same domain name (e.g. <code>mail.mycorp.example</code>) with different resolve values. It also allows to add additional, intranet only, services like <code>wiki.intra.mycorp.example</code>, that would not be resolvable/accessible from the internet. Same goes for infrastructure names like <code>server01.eq.mycorp.example</code>.</p>
  
  <p>The problem I see is, that if the application itself is preferring DNS over HTTPS and is not correctly falling back to the system assigned DNS servers, internal only domains would not be accessible. </p>
  
  <p>I made an experiment with Firefox 61.0.1 (64-Bit) on Windows 10. I have set:</p>
  
  <ul>
  <li><code>network.trr.bootstrapAddress</code> = 1.1.1.1</li>
  <li><code>network.trr.uri</code> = <code>https://mozilla.cloudflare-dns.com/dns-query</code></li>
  <li><code>network.trr.mode</code> = 2</li>
  </ul>
  
  <p><code>network.trr.mode = 2</code> should prefer DNS over HTTPS, but fallback to system DNS if no value received, <code>mode = 1</code>, which I also tried, should make a race and use the first valid result that Firefox gets back.</p>
  
  <p>Unfortunately, after activating DNS over HTTPS in Firefox, all internal only websites did no longer work. All requests end in a timeout and fail therefor.</p>
  
  <p>What do I miss?
  Is there a better way to handle internal only DNS entries in future setups?</p>