So, the internal domain names leak to Mozilla unless I disable this totally?

Not to Mozilla, but to whichever DoH service Firefox is configured to use, by default or by the user. Mozilla isn't running a DoH service.

What is the default?

Cloudflare 1.1.1.1 is the default.

So, when the user types in internal.mydomain.com, it gets sent to Cloudflare then they query my public domain server which doesn't have the entry so it falls back to checking the DNS the system has listed. Is Firefox going to cache the IP like the OS does?

The behaviour depends on a few preferences:

* network.trr.mode can be set to 0 (disabled), 1 (race native vs TRR), 2 (TRR first, OS DNS as fallback), 3 (TRR only), 4 (run native and TRR in parallel but use native results, save TRR timings for telemetry), or 5 (off by choice)

* network.trr.uri configures which DoH endpoint is queried

Firefox does maintain a DNS cache, even if you use the native DNS resolver. You can view the cache at about:networking#dns.

So, I really need to set 5 because 0 will probably later become default consent to use DNS-over-HTTPS.

To be fair, can anyone really expect otherwise?

If you insist on using a third party resolver for name resolution they will have knowledge of your queries no matter what the protocol. Doing it over tcp and http is not any better, or worse, than doing it over udp. This is something you have to opt in to.

> This is something you have to opt in to.

Does it come turned off by default?

DNS-over-HTTPS in Firefox? Yes, it does, at the moment. See https://searchfox.org/mozilla-central/rev/dd7e27f4a805e4115d... -- 0 means it's off.

5 is "off by choice"

Yes, the difference is that 0 is the default value right now, so if you set it in about:config all Gecko remembers is "it's the default" and stores nothing in user.js; if the default then changes the value changes.

5 is not the default, so if you set it it will get stored in user.js and then even if the default changes the value will remain 5.

Do they bother resolving internal domain names such as example.lan? Otherwise that would be stupid and leaky.

Also intranet.mycompany.com. There's not a chance that a resolver would know, which domains are internal and which are not.

With Windows and AD “internal” names are FQDN, which resolves fine with the DNS server provided with the DHCP settings.

Of course DoH will break this and leak. Enterprises everywhere will hate this and ban Firefox.