User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3817.0 Safari/537.36

Steps to reproduce:

With network.security.esni.enabled set to true, I used Cloudflare's ESNI check service.

Actual results:

The service reports that Firefox did not encrypt the SNI.

Expected results:

Firefox should encrypt the SNI.

Try setting network.trr.mode to 2 or 3.

source:
https://blog.mozilla.org/security/2018/10/18/encrypted-sni-comes-to-firefox-nightly/
https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/

That does work. I would argue, though, that it should not be required. My computer is already set up to use DNS over TLS directly — why do I need to add an HTTP layer to DNS requests to be able to encrypt the SNI?

Valentin, can you please elaborate what is expected here?

(In reply to Max Harmony from comment #2)

That does work. I would argue, though, that it should not be required. My computer is already set up to use DNS over TLS directly — why do I need to add an HTTP layer to DNS requests to be able to encrypt the SNI?

See bug 1542754 comment 3
At the moment Firefox can only resolve TXT records using TRR (DoH), so that is required in order for ESNI to work.