--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -824,16 +824,18 @@ function gKeywordURIFixup({ target: brow
   // We get called irrespective of whether we did a keyword search, or
   // whether the original input would be vaguely interpretable as a URL,
   // so figure that out first.
   let alternativeURI = deserializeURI(fixupInfo.fixedURI);
   if (!fixupInfo.keywordProviderName || !alternativeURI || !alternativeURI.host) {
     return;
   }
 
+  let contentPrincipal = browser.contentPrincipal;
+
   // At this point we're still only just about to load this URI.
   // When the async DNS lookup comes back, we may be in any of these states:
   // 1) still on the previous URI, waiting for the preferredURI (keyword
   //    search) to respond;
   // 2) at the keyword search URI (preferredURI)
   // 3) at some other page because the user stopped navigation.
   // We keep track of the currentURI to detect case (1) in the DNS lookup
   // callback.
@@ -926,17 +928,18 @@ function gKeywordURIFixup({ target: brow
     let notification =
       notificationBox.appendNotification(message, "keyword-uri-fixup", null,
                                          notificationBox.PRIORITY_INFO_HIGH,
                                          buttons);
     notification.persistence = 1;
   };
 
   try {
-    gDNSService.asyncResolve(hostName, 0, onLookupComplete, Services.tm.mainThread);
+    gDNSService.asyncResolve(hostName, 0, onLookupComplete, Services.tm.mainThread,
+                             contentPrincipal.originAttributes);
   } catch (ex) {
     // Do nothing if the URL is invalid (we don't want to show a notification in that case).
     if (ex.result != Cr.NS_ERROR_UNKNOWN_HOST) {
       // ... otherwise, report:
       Cu.reportError(ex);
     }
   }
 }

--- a/dom/base/nsContentSink.cpp
+++ b/dom/base/nsContentSink.cpp
@@ -889,17 +889,18 @@ nsContentSink::PrefetchDNS(const nsAStri
     if (NS_SUCCEEDED(rv) && !isLocalResource) {
       nsAutoCString host;
       uri->GetHost(host);
       CopyUTF8toUTF16(host, hostname);
     }
   }
 
   if (!hostname.IsEmpty() && nsHTMLDNSPrefetch::IsAllowed(mDocument)) {
-    nsHTMLDNSPrefetch::PrefetchLow(hostname);
+    nsHTMLDNSPrefetch::PrefetchLow(hostname,
+                                   mDocument->NodePrincipal()->OriginAttributesRef());
   }
 }
 
 void
 nsContentSink::Preconnect(const nsAString& aHref, const nsAString& aCrossOrigin)
 {
   // construct URI using document charset
   const nsACString& charset = mDocument->GetDocumentCharacterSet();

--- a/dom/html/nsHTMLDNSPrefetch.cpp
+++ b/dom/html/nsHTMLDNSPrefetch.cpp
@@ -124,113 +124,131 @@ nsHTMLDNSPrefetch::PrefetchMedium(Link *
 
 nsresult
 nsHTMLDNSPrefetch::PrefetchHigh(Link *aElement)
 {
   return Prefetch(aElement, 0);
 }
 
 nsresult
-nsHTMLDNSPrefetch::Prefetch(const nsAString &hostname, uint16_t flags)
+nsHTMLDNSPrefetch::Prefetch(const nsAString &hostname,
+                            const OriginAttributes &aOriginAttributes,
+                            uint16_t flags)
 {
   if (IsNeckoChild()) {
     // We need to check IsEmpty() because net_IsValidHostName()
     // considers empty strings to be valid hostnames
     if (!hostname.IsEmpty() &&
         net_IsValidHostName(NS_ConvertUTF16toUTF8(hostname))) {
       // during shutdown gNeckoChild might be null
       if (gNeckoChild) {
-        gNeckoChild->SendHTMLDNSPrefetch(nsAutoString(hostname), flags);
+        gNeckoChild->SendHTMLDNSPrefetch(nsString(hostname),
+                                         aOriginAttributes, flags);
       }
     }
     return NS_OK;
   }
 
   if (!(sInitialized && sDNSService && sPrefetches && sDNSListener))
     return NS_ERROR_NOT_AVAILABLE;
 
   nsCOMPtr<nsICancelable> tmpOutstanding;
-  return sDNSService->AsyncResolve(NS_ConvertUTF16toUTF8(hostname),
-                                   flags | nsIDNSService::RESOLVE_SPECULATE,
-                                   sDNSListener, nullptr, 
-                                   getter_AddRefs(tmpOutstanding));
+  return sDNSService->AsyncResolveNative(NS_ConvertUTF16toUTF8(hostname),
+                                         flags | nsIDNSService::RESOLVE_SPECULATE,
+                                         sDNSListener, nullptr, aOriginAttributes,
+                                         getter_AddRefs(tmpOutstanding));
 }
 
 nsresult
-nsHTMLDNSPrefetch::PrefetchLow(const nsAString &hostname)
+nsHTMLDNSPrefetch::PrefetchLow(const nsAString &hostname,
+                               const OriginAttributes &aOriginAttributes)
 {
-  return Prefetch(hostname, nsIDNSService::RESOLVE_PRIORITY_LOW);
+  return Prefetch(hostname, aOriginAttributes, nsIDNSService::RESOLVE_PRIORITY_LOW);
 }
 
 nsresult
-nsHTMLDNSPrefetch::PrefetchMedium(const nsAString &hostname)
+nsHTMLDNSPrefetch::PrefetchMedium(const nsAString &hostname,
+                                  const OriginAttributes &aOriginAttributes)
 {
-  return Prefetch(hostname, nsIDNSService::RESOLVE_PRIORITY_MEDIUM);
+  return Prefetch(hostname, aOriginAttributes, nsIDNSService::RESOLVE_PRIORITY_MEDIUM);
 }
 
 nsresult
-nsHTMLDNSPrefetch::PrefetchHigh(const nsAString &hostname)
+nsHTMLDNSPrefetch::PrefetchHigh(const nsAString &hostname,
+                                const OriginAttributes &aOriginAttributes)
 {
-  return Prefetch(hostname, 0);
+  return Prefetch(hostname, aOriginAttributes, 0);
 }
 
 nsresult
 nsHTMLDNSPrefetch::CancelPrefetch(Link *aElement,
                                   uint16_t flags,
                                   nsresult aReason)
 {
   if (!(sInitialized && sPrefetches && sDNSService && sDNSListener))
     return NS_ERROR_NOT_AVAILABLE;
 
   nsAutoString hostname;
   aElement->GetHostname(hostname);
-  return CancelPrefetch(hostname, flags, aReason);
+
+  Element* element = aElement->GetElement();
+  NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
+
+  return CancelPrefetch(hostname,
+                        element->NodePrincipal()
+                               ->OriginAttributesRef(),
+                        flags, aReason);
 }
 
 nsresult
 nsHTMLDNSPrefetch::CancelPrefetch(const nsAString &hostname,
+                                  const OriginAttributes &aOriginAttributes,
                                   uint16_t flags,
                                   nsresult aReason)
 {
   // Forward this request to Necko Parent if we're a child process
   if (IsNeckoChild()) {
     // We need to check IsEmpty() because net_IsValidHostName()
     // considers empty strings to be valid hostnames
     if (!hostname.IsEmpty() &&
         net_IsValidHostName(NS_ConvertUTF16toUTF8(hostname))) {
       // during shutdown gNeckoChild might be null
       if (gNeckoChild) {
-        gNeckoChild->SendCancelHTMLDNSPrefetch(nsString(hostname), flags,
+        gNeckoChild->SendCancelHTMLDNSPrefetch(nsString(hostname),
+                                               aOriginAttributes,
+                                               flags,
                                                aReason);
       }
     }
     return NS_OK;
   }
 
   if (!(sInitialized && sDNSService && sPrefetches && sDNSListener))
     return NS_ERROR_NOT_AVAILABLE;
 
   // Forward cancellation to DNS service
-  return sDNSService->CancelAsyncResolve(NS_ConvertUTF16toUTF8(hostname),
-                                         flags
-                                         | nsIDNSService::RESOLVE_SPECULATE,
-                                         sDNSListener, aReason);
+  return sDNSService->CancelAsyncResolveNative(NS_ConvertUTF16toUTF8(hostname),
+                                               flags
+                                               | nsIDNSService::RESOLVE_SPECULATE,
+                                               sDNSListener, aReason, aOriginAttributes);
 }
 
 nsresult
 nsHTMLDNSPrefetch::CancelPrefetchLow(Link *aElement, nsresult aReason)
 {
   return CancelPrefetch(aElement, nsIDNSService::RESOLVE_PRIORITY_LOW,
                         aReason);
 }
 
 nsresult
-nsHTMLDNSPrefetch::CancelPrefetchLow(const nsAString &hostname, nsresult aReason)
+nsHTMLDNSPrefetch::CancelPrefetchLow(const nsAString &hostname,
+                                     const OriginAttributes &aOriginAttributes,
+                                     nsresult aReason)
 {
-  return CancelPrefetch(hostname, nsIDNSService::RESOLVE_PRIORITY_LOW,
+  return CancelPrefetch(hostname, aOriginAttributes, nsIDNSService::RESOLVE_PRIORITY_LOW,
                         aReason);
 }
 
 
 /////////////////////////////////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_ISUPPORTS(nsHTMLDNSPrefetch::nsListener,
                   nsIDNSListener)
@@ -313,52 +331,58 @@ nsHTMLDNSPrefetch::nsDeferrals::SubmitQu
     nsCOMPtr<nsIContent> content = do_QueryReferent(mEntries[mTail].mElement);
     if (content) {
       nsCOMPtr<Link> link = do_QueryInterface(content);
       // Only prefetch here if request was deferred and deferral not cancelled
       if (link && link->HasDeferredDNSPrefetchRequest()) {
         nsCOMPtr<nsIURI> hrefURI(link ? link->GetURI() : nullptr);
         bool isLocalResource = false;
         nsresult rv = NS_OK;
+        Element* element = link->GetElement();
 
         hostName.Truncate();
         if (hrefURI) {
           hrefURI->GetAsciiHost(hostName);
           rv = NS_URIChainHasFlags(hrefURI,
                                    nsIProtocolHandler::URI_IS_LOCAL_RESOURCE,
                                    &isLocalResource);
         }
 
-        if (!hostName.IsEmpty() && NS_SUCCEEDED(rv) && !isLocalResource) {
+        if (!hostName.IsEmpty() && NS_SUCCEEDED(rv) && !isLocalResource &&
+            element) {
           if (IsNeckoChild()) {
             // during shutdown gNeckoChild might be null
             if (gNeckoChild) {
               gNeckoChild->SendHTMLDNSPrefetch(NS_ConvertUTF8toUTF16(hostName),
+                                               element->NodePrincipal()
+                                                      ->OriginAttributesRef(),
                                                mEntries[mTail].mFlags);
             }
           } else {
             nsCOMPtr<nsICancelable> tmpOutstanding;
 
-            rv = sDNSService->AsyncResolve(hostName,
-                                           mEntries[mTail].mFlags
-                                           | nsIDNSService::RESOLVE_SPECULATE,
-                                           sDNSListener, nullptr,
-                                           getter_AddRefs(tmpOutstanding));
+            rv = sDNSService->AsyncResolveNative(hostName,
+                                                 mEntries[mTail].mFlags
+                                                 | nsIDNSService::RESOLVE_SPECULATE,
+                                                 sDNSListener, nullptr,
+                                                 element->NodePrincipal()
+                                                        ->OriginAttributesRef(),
+                                                 getter_AddRefs(tmpOutstanding));
             // Tell link that deferred prefetch was requested
             if (NS_SUCCEEDED(rv))
               link->OnDNSPrefetchRequested();
           }
         }
       }
     }
-    
+
     mEntries[mTail].mElement = nullptr;
     mTail = (mTail + 1) & sMaxDeferredMask;
   }
-  
+
   if (mTimerArmed) {
     mTimerArmed = false;
     mTimer->Cancel();
   }
 }
 
 void
 nsHTMLDNSPrefetch::nsDeferrals::Activate()

--- a/dom/html/nsHTMLDNSPrefetch.h
+++ b/dom/html/nsHTMLDNSPrefetch.h
@@ -46,27 +46,35 @@ public:
   // complete, while the string versions submit the lookup to 
   // the DNS system immediately. The URI version is somewhat lighter
   // weight, but its request is also more likely to be dropped due to a 
   // full queue and it may only be used from the main thread.
 
   static nsresult PrefetchHigh(mozilla::dom::Link *aElement);
   static nsresult PrefetchMedium(mozilla::dom::Link *aElement);
   static nsresult PrefetchLow(mozilla::dom::Link *aElement);
-  static nsresult PrefetchHigh(const nsAString &host);
-  static nsresult PrefetchMedium(const nsAString &host);
-  static nsresult PrefetchLow(const nsAString &host);
-  static nsresult CancelPrefetchLow(const nsAString &host, nsresult aReason);
+  static nsresult PrefetchHigh(const nsAString &host,
+                               const mozilla::OriginAttributes &aOriginAttributes);
+  static nsresult PrefetchMedium(const nsAString &host,
+                                 const mozilla::OriginAttributes &aOriginAttributes);
+  static nsresult PrefetchLow(const nsAString &host,
+                              const mozilla::OriginAttributes &aOriginAttributes);
+  static nsresult CancelPrefetchLow(const nsAString &host,
+                                    const mozilla::OriginAttributes &aOriginAttributes,
+                                    nsresult aReason);
   static nsresult CancelPrefetchLow(mozilla::dom::Link *aElement,
                                     nsresult aReason);
 
 private:
-  static nsresult Prefetch(const nsAString &host, uint16_t flags);
+  static nsresult Prefetch(const nsAString &host,
+                           const mozilla::OriginAttributes &aOriginAttributes,
+                           uint16_t flags);
   static nsresult Prefetch(mozilla::dom::Link *aElement, uint16_t flags);
   static nsresult CancelPrefetch(const nsAString &hostname,
+                                 const mozilla::OriginAttributes &aOriginAttributes,
                                  uint16_t flags,
                                  nsresult aReason);
   static nsresult CancelPrefetch(mozilla::dom::Link *aElement,
                                  uint16_t flags,
                                  nsresult aReason);
   
 public:
   class nsListener final : public nsIDNSListener

--- a/dom/system/gonk/NetworkManager.js
+++ b/dom/system/gonk/NetworkManager.js
@@ -955,17 +955,18 @@ NetworkManager.prototype = {
           aResolve(retval);
         };
 
         debug('Calling gDNSService.asyncResolveExtended: ' + aNetId + ', ' + aHostname);
         gDNSService.asyncResolveExtended(aHostname,
                                          0,
                                          aNetId,
                                          onLookupComplete,
-                                         Services.tm.mainThread);
+                                         Services.tm.mainThread,
+                                         {});
       });
     };
 
     // TODO: |getNetId| will be implemented as a sync call in nsINetworkManager
     //       once Bug 1141903 is landed.
     return gNetworkService.getNetId(aNetworkInfo.name)
       .then(aNetId => hostResolveWrapper(aNetId));
   },

--- a/extensions/auth/nsAuthSSPI.cpp
+++ b/extensions/auth/nsAuthSSPI.cpp
@@ -114,19 +114,21 @@ MakeSN(const char *principal, nsCString 
     // However, we should have at least hit the OS resolver once prior to
     // reaching this code, so provided the OS resolver has this information
     // cached, we should not have to worry about blocking on this function call
     // for very long.  NOTE: because we ask for the canonical hostname, we
     // might end up requiring extra network activity in cases where the OS
     // resolver might not have enough information to satisfy the request from
     // its cache.  This is not an issue in versions of Windows up to WinXP.
     nsCOMPtr<nsIDNSRecord> record;
-    rv = dns->Resolve(Substring(buf, index + 1),
-                      nsIDNSService::RESOLVE_CANONICAL_NAME,
-                      getter_AddRefs(record));
+    mozilla::OriginAttributes attrs;
+    rv = dns->ResolveNative(Substring(buf, index + 1),
+                            nsIDNSService::RESOLVE_CANONICAL_NAME,
+                            attrs,
+                            getter_AddRefs(record));
     if (NS_FAILED(rv))
         return rv;
 
     nsAutoCString cname;
     rv = record->GetCanonicalName(cname);
     if (NS_SUCCEEDED(rv)) {
         result = StringHead(buf, index) + NS_LITERAL_CSTRING("/") + cname;
         LOG(("Using SPN of [%s]\n", result.get()));

--- a/media/mtransport/nriceresolver.cpp
+++ b/media/mtransport/nriceresolver.cpp
@@ -146,16 +146,17 @@ int NrIceResolver::resolve(nr_resolver_r
                            int (*cb)(void *cb_arg, nr_transport_addr *addr),
                            void *cb_arg,
                            void **handle) {
   int _status;
   MOZ_ASSERT(allocated_resolvers_ > 0);
   ASSERT_ON_THREAD(sts_thread_);
   RefPtr<PendingResolution> pr;
   uint32_t resolve_flags = 0;
+  OriginAttributes attrs;
 
   if (resource->transport_protocol != IPPROTO_UDP &&
       resource->transport_protocol != IPPROTO_TCP) {
     MOZ_MTLOG(ML_ERROR, "Only UDP and TCP are supported.");
     ABORT(R_NOT_FOUND);
   }
   pr = new PendingResolution(sts_thread_,
                              resource->port? resource->port : 3478,
@@ -170,19 +171,20 @@ int NrIceResolver::resolve(nr_resolver_r
       break;
     case AF_INET6:
       resolve_flags |= nsIDNSService::RESOLVE_DISABLE_IPV4;
       break;
     default:
       ABORT(R_BAD_ARGS);
   }
 
-  if (NS_FAILED(dns_->AsyncResolve(nsAutoCString(resource->domain_name),
-                                   resolve_flags, pr,
-                                   sts_thread_, getter_AddRefs(pr->request_)))) {
+  if (NS_FAILED(dns_->AsyncResolveNative(nsAutoCString(resource->domain_name),
+                                         resolve_flags, pr,
+                                         sts_thread_, attrs,
+                                         getter_AddRefs(pr->request_)))) {
     MOZ_MTLOG(ML_ERROR, "AsyncResolve failed.");
     ABORT(R_NOT_FOUND);
   }
   // Because the C API offers no "finished" method to release the handle we
   // return, we cannot return the request we got from AsyncResolve directly.
   //
   // Instead, we return an addref'ed reference to PendingResolution itself,
   // which in turn holds the request and coordinates between cancel and

--- a/netwerk/ipc/NeckoParent.cpp
+++ b/netwerk/ipc/NeckoParent.cpp
@@ -685,27 +685,27 @@ NeckoParent::RecvSpeculativeConnect(cons
   return IPC_OK();
 }
 
 mozilla::ipc::IPCResult
 NeckoParent::RecvHTMLDNSPrefetch(const nsString& hostname,
                                  const OriginAttributes& aOriginAttributes,
                                  const uint16_t& flags)
 {
-  nsHTMLDNSPrefetch::Prefetch(hostname, flags);
+  nsHTMLDNSPrefetch::Prefetch(hostname, aOriginAttributes, flags);
   return IPC_OK();
 }
 
 mozilla::ipc::IPCResult
 NeckoParent::RecvCancelHTMLDNSPrefetch(const nsString& hostname,
                                        const OriginAttributes& aOriginAttributes,
                                        const uint16_t& flags,
                                        const nsresult& reason)
 {
-  nsHTMLDNSPrefetch::CancelPrefetch(hostname, flags, reason);
+  nsHTMLDNSPrefetch::CancelPrefetch(hostname, aOriginAttributes, flags, reason);
   return IPC_OK();
 }
 
 PChannelDiverterParent*
 NeckoParent::AllocPChannelDiverterParent(const ChannelDiverterArgs& channel)
 {
   return new ChannelDiverterParent();
 }