That goes into the argument that DNS (domain name lookup) should be a system and network-level setting, not an App-based setting.
It's going to be particularly god-awful for devices that roam between networks where the "internal" DNS is visible and networks where it isn't. Ugh...
I had thought that internal networks these days would favor multicast resolution (LLMNR/mDNS), but that doesn't appear to be the case here. Admin work is not my wheelhouse, so I have no idea what standard practice is. What is the recommended setup for AD and name resolution configuration?
I don't like this one either, but often it is inherited from the past from other people and it is not going to change.
On the other hand, split-horizon DNS is going to stay with us, even if the AD domain is a subdomain of the public one. Records in the internal zone are not going to become public anytime soon.
On the other of the common problems: I assume there is no way to blackhole existing, public records, other than extension ala uBlock/Adblock?
* network.trr.mode can be set to 0 (disabled), 1 (race native vs TRR), 2 (TRR first, OS DNS as fallback), 3 (TRR only), 4 (run native and TRR in parallel but use native results, save TRR timings for telemetry), or 5 (off by choice)
* network.trr.uri configures which DoH endpoint is queried
Firefox does maintain a DNS cache, even if you use the native DNS resolver. You can view the cache at about:networking#dns.
If you insist on using a third party resolver for name resolution they will have knowledge of your queries no matter what the protocol. Doing it over tcp and http is not any better, or worse, than doing it over udp. This is something you have to opt in to.
Does it come turned off by default?
5 is not the default, so if you set it it will get stored in user.js and then even if the default changes the value will remain 5.
Of course DoH will break this and leak. Enterprises everywhere will hate this and ban Firefox.
That’s part of the plan. From now everything is cloud only, and everyone doing anything differently gets thrown under the bus, with less and less control left for the user.
We’re progressing backwards into the future.