t:pref
i:/browser/app/profile/firefox.js
o:/browser/app/profile/firefox.js

+pref("network.trr.mode", 3); // Max Protection: only use DoH; do not fall back to native DNS
+pref("network.trr.max-fails", 5); // Reduce max fail attempts
+pref("network.trr.uri", "https://mozilla.cloudflare-dns.com/dns-query"); // Default resolver for DoH
+pref("network.trr.custom_uri", "https://mozilla.cloudflare-dns.com/dns-query"); // Custom URI for DoH
+pref("network.trr.bootstrapAddr", "1.1.1.1"); // Bootstrap address for Cloudflare's DoH
+pref("network.trr.disable-ECS", true); // Disable EDNS Client Subnet
+pref("network.trr.allow-rfc1918", false); // Block private addresses in TRR responses
+pref("network.trr.skip-AAAA-when-not-supported", true); // Skip IPv6 lookups when not supported
+pref("network.trr.clear-cache-on-pref-change", true); // Clear cache on preference changes
+pref("network.trr.wait-for-portal", false); // Do not wait for captive portal detection
+pref("network.trr.excluded-domains", ""); // No additional exclusions for DoH
+pref("network.trr.builtin-excluded-domains", "localhost,local"); // Default built-in exclusions
+pref("network.trr.ohttp.config_uri", "https://dooh.cloudflare-dns.com/.well-known/doohconfig"); // Oblivious HTTP configuration
+pref("network.trr.ohttp.uri", "https://dooh.cloudflare-dns.com/dns-query"); // Oblivious HTTP resolver URI
+pref("network.trr.use_ohttp", true); // Enable Oblivious HTTP for DNS
+pref("network.dns.echconfig.enabled", true); // Enable Encrypted Client Hello (ECH) for TLS
+pref("network.dns.http3_echconfig.enabled", true); // Enable ECH for HTTP/3
+pref("network.dns.echconfig.fallback_to_origin_when_all_failed", false); // Disable fallback to non-ECH