Improving DNS Privacy in Firefox

This doesn't solve the problem. Those resolvers are also unencrypted.

I don't see how this improves privacy. Yes, my local ISP, whose DNS I'm using, knows the domains I'm connecting with. They most likely can also access this info in cleartext in other ways, if they care enough. For instance through SNI.

Beyond my ISP, it's doubtful that unencrypted nature of DNS has any impact on my privacy due to heavy caching and the fact that my requests are merged together with requests from many other users.

With DNS over HTTP a single third-party overseas now gets access to this list of domains I'm connecting with. It all just seems like a thinly veiled attempt at more centralization of internet services. Yes, my residential ISP and my coffee shop, library, etc. don't have these "very strong privacy agreements". But I think it's less likely they will all combine their logs to track my behavior than a single centralized entity.

You can't condone it because you'd prefer "DNS over TLS" or a you have a notion that DNS shouldn't have other headers before it because it's a core protocol and should reimplement the functionality it needs frome TLS?

In the case of the former I agree, the browser should be doing this over TLS as HTTP isn't giving any additional protocol functionality. In the case of the latter the purpose of protocol encapsulation isn't that the most important comes first it's that you can abstract service layers instead of remaking them for each new thing.

I used this at some point on my Fedora laptop. I had issues on some hotel APs where it didn't allow me to see the 'login page' of the AP.

What's the way to circumvent this problem? I'm frequently on public wifi's, so I need to access AP login pages without issue.

No, no no and no.

It does not improve privacy, it just puts all your DNS history in the hands of one provider. Not only that it adds latency for no real gain. HTTP is a terrible protocol for anything time sensitive. (its a fairly bad protocol for anything fast or efficient full stop.)

The better way to do this is encourage/provide DNSsec (so we know that a provider is who they say they are) and then encrypt dns queries between servers.

Firstly that stops everything being centralised by default, (kinda, DNSSec has a chain of trust, so thats centralised) DNS is a massively scalable fault tolerant, distributed key value store. Far faster and more reliable than toys like Etcd and the like.

secondly you don't then loose geolocation/provider steering for nearest/fastest node. (yes you can get meta data from IP, but that's not really that useful, that means the _service_ has to figure out how to route your request, not the upstream DNS.)

But it needs improvements to make its more anonymous, slapping a fast SSL like tunnel on a resolver combined with DNSsec seems like a much better way to do this and dns over HTTP.