Firefox DoH Canary Checker
Check whether this browser can reach Firefox’s DNS-over-HTTPS opt-out signal.
use-application-dns.net — the signal Firefox checks to decide whether to disable its built-in DoH. This tool cannot confirm whether DoH is active right now, and it has no bearing on Chrome, Edge, Safari, or Brave, which do not use this mechanism.
What Is the Firefox DoH Canary Domain?
Firefox enables DNS-over-HTTPS (DoH) by default for most users in supported regions. Before it does, Firefox runs a set of checks called DoH heuristics to see whether enabling DoH would break something the user or network relies on. One of those checks is a lookup of a special hostname: use-application-dns.net. If that domain fails to resolve through the operating system’s normal DNS server, Firefox treats it as a signal that a network-level parental control or content filter is active, and it automatically disables its own DoH for that network session. For the full technical background, see our guide on why DNS-over-HTTPS breaks Pi-hole and parental controls.
Why This Only Applies to Firefox
Chrome, Edge, and Brave use a different DoH model entirely. Instead of checking a canary domain, Chromium-based browsers try to auto-upgrade the DNS provider already configured on the device to that same provider’s DoH service — and they fall back to plain DNS if that provider does not support DoH. Chromium’s own documentation states plainly that it has no plans to adopt a canary-domain approach, because its deployment model does not need one. Safari does not implement Firefox-style automatic DoH at all. That means a result from this tool describes Firefox’s behavior only, never a general statement about the browser.
What a Positive Result Actually Means
If this browser cannot reach the canary domain while a normal connectivity check succeeds, that pattern is consistent with the exact signal Firefox looks for to disable DoH automatically. It is not proof of Firefox’s internal decision — a webpage cannot see that decision directly, only whether the canary domain itself was reachable. A single blocked hostname could also come from a browser extension, a security product, or a host-specific firewall rule unrelated to DoH. Firefox’s own internal diagnostics page, about:networking#dns, is the only fully authoritative source for whether a specific lookup used DoH.
If You Manage Pi-hole or Router-Level Filtering
Pi-hole, pfSense, and several router firmwares support adding use-application-dns.net to a blocklist so it resolves to NXDOMAIN, which triggers Firefox’s opt-out. This tool is a fast way to confirm that configuration actually took effect on a given device and network, without digging through Firefox’s internal settings pages. Run it from the device you are troubleshooting, on the network in question, right after making the change.
Related Tools & Resources
Check what DNS records a domain is currently serving with our DNS Record Lookup, or see whether your traffic is escaping a VPN tunnel with our guide on what a DNS leak is. If you are troubleshooting a DNS error more broadly, start with DNS Server Not Responding or our full network troubleshooting guide. Visit the networking tools hub for the full collection.