TLSv1: should DHE be enabled?

Question

I want my web server to be as compatible as possible with old clients, even clients without TLSv1.2 and ECDHE support. What ciphers should be supported for legacy clients, and in what order should they be preferred?

ssl-config.mozilla.org places the ciphers in such order: ECDHE, DHE, non-DHE.

But according to testssl.sh results, neither Google nor Cloudflare support DHE-ciphers, e.g. Cloudflare offers the following for TLSv1:

 xc014   ECDHE-RSA-AES256-SHA              ECDH 256   AES         256      TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA                 
 x35     AES256-SHA                        RSA        AES         256      TLS_RSA_WITH_AES_256_CBC_SHA                       
 xc013   ECDHE-RSA-AES128-SHA              ECDH 256   AES         128      TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA                 
 x2f     AES128-SHA                        RSA        AES         128      TLS_RSA_WITH_AES_128_CBC_SHA                       
 x0a     DES-CBC3-SHA                      RSA        3DES        168      TLS_RSA_WITH_3DES_EDE_CBC_SHA   

Any reason why?

I wonder if TLS_DHE_RSA_WITH_AES_128_CBC_SHA is, under some circumstances, less secure than TLS_RSA_WITH_AES_128_CBC_SHA.

Answer 1

It looks like dbheater attack is the reason why DHE ciphers are disabled on most popular sites.

There are some discussions about how serious this threat is:
https://github.com/mozilla/ssl-config-generator/issues/162
https://github.com/openssl/openssl/issues/17374

If I'm not mistaken, the only downside of disabling DHE ciphers is the loss of FS for some legacy clients. These clients may have many other vulnerabilities and should be updated if security is a concern.
So disabling DHE seems fine to me, even if the dbheater threat isn't that serious.