Modern Network Protocols

What’s Next for Firefox and the Web?

TU Dresden · 2026  ·  Max Inden · Mozilla

Max Inden

  • Software developer at Mozilla, on Firefox’s networking stack.
  • Focus: HTTP/3 and QUIC.
  • Previously: libp2p (peer-to-peer), Prometheus & Kubernetes.
  • Interested in networking, distributed systems, type theory.
  • max-inden.de · mail@max-inden.de · @mxinden

HTTP: the thin waist of the Internet

HTTP is already the thin waist of the Internet:

  • Consistent
  • Extensible
  • Strong security model
  • Hard to censor

And we don’t expect that to change. Only doubling down more: DoH, WebTransport, MASQUE.

www
mail
video
chat
HTTP
TCP + TLS
QUIC
IPv4
IPv6

DNS over HTTPS (DoH)

Run DNS queries through an encrypted HTTP connection to the resolver.

  • Privacy
  • Integrity
  • Censorship resistance

Low overhead with QUIC 0-RTT.

DNS query
HTTP/1.1
HTTP/2
HTTP/3
TLS 1.2+
TLS 1.2+
QUIC · TLS 1.3
TCP
TCP
UDP
IPv4 / IPv6

DNS lookup time: DoH vs OS resolver

DNS lookup time, ms, US + Canada. P75 (solid), P95 (dashed). Past 12 months. Source: performance.mozilla.org/networking.

DoH adoption

Global DNS resolution method. Source: performance.mozilla.org/networking.

HTTPS has won

Global request scheme. Source: performance.mozilla.org/networking.

Encrypted Client Hello (ECH)

  • By default the TLS handshake sends the Server Name Indication (SNI) in clear text, e.g. wikipedia.org.
  • A major attack vector for censors today.
  • ECH encrypts parts of the TLS Client Hello, including the SNI.
  • Public key fetched via the DNS HTTPS record. Especially relevant behind CDNs.
  • Adoption still low. On TCP, Firefox attempts ECH ~0.3% of the time, and it nearly always succeeds.

QUIC and HTTP/3

  • General-purpose transport on top of UDP
  • Encrypted (meta)data
  • 1-RTT connection setup, 0-RTT on resumption
  • Reliable and unreliable delivery, no head-of-line blocking
  • Easy to evolve, often in user space
HTTP semantics
HTTP/1.1
HTTP/2
HTTP/3
TLS/SSL (optional)
TLS 1.2+
QUIC · TLS 1.3
TCP
TCP
UDP
IPv4 / IPv6

HTTP/3 adoption

HTTP/3 share, past 12 months: Firefox desktop responses (performance.mozilla.org/networking) vs Cloudflare’s share of requests, worldwide (Cloudflare Radar).

QUIC handshake: fewer round trips

TCP + TLS 1.3  2-RTT

QUIC  1-RTT

QUIC resumption  0-RTT

Messages before the first HTTP response, by transport setup.

How does a browser learn a site speaks HTTP/3?

HTTP/3 has to be discovered. Two mechanisms:

Alt-Svc header  RFC 7838

  • An HTTP response header: Alt-Svc: h3=":443".
  • Learned after a full HTTP/1.1 or HTTP/2 connection.
  • So the very first connection is never HTTP/3.

HTTPS DNS record  RFC 9460

  • An HTTPS record carrying alpn="h3".
  • Learned during DNS resolution, before connecting.
  • Also carries IP hints and the ECH key.

The wasted round trip

Alt-Svc only

HTTP/3 only on the second connection.

HTTPS record

HTTP/3 on the first connection.

Save a round trip

  • Many sites send Alt-Svc: h3 but publish no HTTPS record.
  • Every first visit then wastes a round trip: connect over HTTP/2, read the header, upgrade to HTTP/3 only next time.
  • Publish an HTTPS record with alpn="h3" and the client goes straight to QUIC on connection #1.
  • Bonus: the HTTPS record is the only way to deliver ECH.

savearoundtrip.com: check your domain.

Time to request start, by protocol

Time to request start, ms, P75, by HTTP version. Firefox desktop; includes DNS lookup and connection setup. Source: performance.mozilla.org/networking.

WebTransport: the next WebSocket?

  • A bidirectional, multiplexed transport for the Web, over HTTP/3.
  • Streams and unreliable datagrams.
  • No major consumer yet beyond upcoming Media over QUIC.
WebTransport
HTTP/1.1
HTTP/2
HTTP/3
TLS 1.2+
TLS 1.2+
QUIC · TLS 1.3
TCP
TCP
UDP
IPv4 / IPv6

MASQUE: proxying on top of HTTP

  • Proxy protocol on top of HTTP; leverages QUIC unreliable datagrams.
  • Inherits HTTP’s censorship resistance.
  • Proxy UDP, TCP, IP, … (even Ethernet).
  • The extreme case of HTTP as the thin waist.
MASQUE
HTTP/1.1
HTTP/2
HTTP/3
TLS 1.2+
TLS 1.2+
QUIC · TLS 1.3
TCP
TCP
UDP
IPv4 / IPv6

MASQUE: single and two hop

Single hop
client
proxy
sees client IP and destination
destination
Two hop  ·  e.g. Apple iCloud Private Relay
client
proxy 1
sees client IP
not destination
proxy 2
sees destination
not client IP
destination

No single party learns both who you are and where you are going.

Oblivious HTTP

  • Similar to MASQUE, but request-oriented, not connection-oriented.
  • So requests are unlinkable: the gateway cannot associate two requests as coming from the same user.
  • The trade-off is performance overhead: the extra relay hop plus per-request encryption cost latency (Oblivious DoH ~228 ms vs ~146 ms for plain DoH, Cloudflare).
  • Used for Telemetry and Oblivious DoH.
client
relay
sees client IP
not the request
gateway
sees the request
not client IP

Happy Eyeballs v3

A cardinality explosion of protocol combinations to choose from:

  • IPv4 / IPv6
  • TCP + TLS or QUIC
  • DNS A, AAAA or HTTPS records
  • HTTP alt-svc header
  • WebSocket or WebTransport

A set of heuristics to reduce connection-establishment latency while racing candidates.

HEv3 end-to-end connection latency, Firefox Nightly. Source: GLAM.

Congestion control: ECN and L4S

  • Firefox’s QUIC stack does Cubic today; no BBR planned near-term.
  • ECN marking and echoing shipped: 58% of network paths are ECN-capable (GLAM).
  • Already 1 in 5 congestion responses is triggered by an ECN CE mark, not packet loss (GLAM).
  • Modernizing slow start to exit before loss (HyStart++ / SEARCH), instead of overshooting the path (neqo#2858).
  • Ready for an L4S congestion controller on the server side. (Hello, Comcast users.)

What do we not see happening?

  • Old protocols (IPv4, DNS53, HTTP/1 & HTTP/2) going away.
  • IPv6 is ~30% of requests and flat across the last ~10 releases: still ~2 in 3 go over IPv4.
  • An anonymous colleague: “Hopefully no HTTP/4.”
IPv6 vs IPv4 share of HTTP transactions (per request), Firefox release, by month. GLAM.

What can you do for a healthy Internet?

  • If you use a browser: enable DoH (Firefox: Settings → Privacy & Security → DNS over HTTPS).
  • If you operate DNS infra: expose a DoH endpoint.
  • If you operate a website: serve it over HTTP/3, publish an HTTPS record, and add ECH.

The Internet of the (near) future

  1. Resolve the site over DNS over HTTPS; its HTTPS record returns IPv6, h3 and ECH.
  2. Connect with a 0-RTT QUIC handshake over IPv6, with ECH keeping the SNI private: no wasted round trip.
  3. Fetch the page over HTTP/3, on that same first connection.
  4. Stay responsive under load: ECN / L4S keep latency near idle even under load.
We’re hiring

Student worker on the networking team

Rust and/or C/C++.

The role goes live soon on   mozilla.org/careers

Until then, find me after the talk or email   minden@mozilla.com

Thank you

Questions?

Help us build a healthy Internet.

mail@max-inden.de · max-inden.de