// 3. what is their privacy policy? can Mozilla get assurances of this? //

4 providers have contractually agreed to abide by Mozilla’s Trusted Recursive Resolver (TRR) program's policy requirements, so far.

https://wiki.mozilla.org/Security/DOH-resolver-policy#Confor...

CIRA Canadian Shield

Cloudflare

NextDNS

Comcast

I think you need to use the specific DoH URL in the above link to get the contract benefits, but maybe I'm wrong

Cloudflare's DNS violates this: https://wiki.mozilla.org/Security/DOH-resolver-policy#Blocki...

I had a user of my email server complain about not being able to receive emails from "cock.li". Turns out that this happened because I was using dnscrypt-proxy with cloudflare's dns (as it is the default in my distro) and thus the DKIM check was failing because it was not able to resolve the domain as it is being filtered by cloudflare. I changed to NextDNS after that.

I guess it's because the contract is valid only for Mozilla Firefox.

cock.li resolves perfectly fine on Firefox with Cloudflare DoH.

Are you sure? It does not for me. Although I am using my distro's release of Firefox. I will be trying it on my windows pc with the official FF release later.

Sure. Maybe your ISP is blocking the domain or something.

I can access it with my ISP, I can also access it with NextDNS (over DoH) and 8.8.8.8. My friends also reproduced my results from their machines.

Can you run dig @1.1.1.1 cock.li just in case?

That command runs fine. No errors.

Dig does not throw an error when it does not get a result, instead you get an output like this:

    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 49352
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 1232
    ; EDE: 0 (Other): (time limit exceeded)
    ;; QUESTION SECTION:
    ;cock.li.                       IN      A
    
    ;; Query time: 115 msec
    ;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)

In contrast with a successful run like

    ; (1 server found)
    ;; global options: +cmd
    ;; Got answer:
    ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21996
    ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
    
    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 512
    ;; QUESTION SECTION:
    ;cock.li.                       IN      A
    
    ;; ANSWER SECTION:
    cock.li.                300     IN      A       193.239.85.202
    
    ;; Query time: 159 msec
    ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)

Got NOERROR and got the IP of cock.li