Custom DNS-over-HTTPS in Firefox, Chrome, Edge and Brave

When browser-level DoH makes sense

Every major browser can send its own DNS queries over HTTPS to a resolver you choose, ignoring the operating system. That is useful on a machine you cannot reconfigure, such as a work laptop, or when you want only your browsing filtered. The trade-off is scope: other apps, the OS updater and games are not covered. For a whole device use the Windows, macOS or Android guide instead.

You will need your profile's DoH address from the Encrypted DNS card in the panel. It looks like https://dns.dnsdome.com/dns-query/<token>.

Firefox

Open Settings → Privacy & Security and scroll to DNS over HTTPS.
Choose Max Protection. This makes Firefox refuse to fall back to the system resolver, so nothing leaks past your filter.
Under Choose provider, pick Custom and paste your DoH address.
Reload a page. Type about:networking#dns in the address bar to see "TRR" set to true on recent lookups.

Firefox on Android has the same setting under Settings → Privacy and security → DNS over HTTPS.

Chrome

Open Settings → Privacy and security → Security.
Under Use secure DNS, choose With: Custom and paste your DoH address.
Restart the browser. Visit chrome://net-internals/#dns to confirm secure DNS is active.

Chrome on Android follows the system Private DNS setting and does not expose a custom DoH field. Set Private DNS instead.

Microsoft Edge

Open Settings → Privacy, search, and services and scroll to Security.
Turn on Use secure DNS to specify how to lookup the network address for websites, select Choose a service provider and paste your DoH address.

Brave

Open Settings → Privacy and security → Security.
Under Use secure DNS, choose With: Custom and paste your DoH address.

Caveats

Chromium browsers disable secure DNS automatically when they detect parental controls or an enterprise policy on the OS. A managed work machine may not let you set this.
Browser DoH only covers that browser. Ads inside apps, smart TV apps and the OS itself still use the system resolver.
Extensions that block ads work by URL and still help; dnsdome works by domain and covers what extensions cannot see. They do not conflict.

Is browser DoH enough for parental controls?

No. A child can switch browsers or change the setting. Use the router or the Android Private DNS setting, and lock the phone's settings, for something a teenager cannot walk around.

Does the DoH address expose my token in the browser history?

It is stored in the browser's settings, not in history, but it is still visible to anyone who can open Settings on that machine. If it leaks, click Generate new endpoints on the profile page and the old token stops working within a minute.