If you control the workstation, you could just set your DNS server by a policy. See: https://github.com/mozilla/policy-templates/blob/master/READ...
Of course that could be easily bypassed, but such a restriction could be easily bypassed by determined employees regardless of whether Firefox natively supports DoH or not.
Local intranet sites will still continue to work without any changes because by default it will fall back to the native resolver if DoH can't resolve the domain. So there should be no breakage by default besides for content blocking use cases.
In Mozilla DNS over HTTPS (DoH) and Trusted Recursive Resolver (TRR) Comment Periodmozilla
policy-templates
Python2018–2026
mozilla / policy-templates
policy-templates
Policy Templates for Firefox
32Distinct people
32Mentions
1Explicit recommenders
1.3KGitHub stars
What to know before exploring
What it is
Policy Templates for Firefox
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
They very well could do this for a company that requires really strict privacy and security, but unfortunately in its current state Firefox doesn't have nearly the corporate…
4oo4 used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 3:38:16 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year32 dated mentions
Observed mentions: 2018-06-21 03:24:05 UTC to 2026-10-13 18:49:05 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 8 | 1 | 7 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Firefox Policy Templates
NoteThese policies are in active development and may contain changes that do not work with current versions of Firefox.
Use the officially released versions if you are deploying changes.
This repository contains policy templates to support deploying and managing Firefox as an enterprise browser.
Firefox policies allow administrators to centrally manage browser behavior, enforce security requirements, configure features, or disable certain functionality.
Policies are commonly used in enterprise or managed environments such as businesses, schools, and public-sector organizations.
Policy documentation
WarningDocumentation for policy behavior and syntax is moving to Firefox Admin Docs.
The new docs repository is public and open to contributions, so if you want to make improvements, feel free to contribute at https://github.com/mozilla/enterprise-admin-reference.
See the GitHub Discussion for more information.
Read the full README on GitHubWhat Hacker News says
7 sourcesI configured Firefox to use my local DoH server instead. That way I don't have to fight against DoH, I get the (few) benefits of ESNI and can still choose what my upstream servers will be. Your solution is also good and it is what we configured at work (through group policies). You or someone else reading may find this[1] and this[2] useful.
[1] https://github.com/mozilla/policy-templates#dnsoverhttps
[2] https://cloud.google.com/docs/chrome-enterprise/policies/?po...
In Unbound DNS BlacklistYou could also user a policy.json for Firefox to permanently disable it. I don't see Firefox dropping this option as it is important for enterprise users.
https://github.com/mozilla/policy-templates
In 1.1.1.1 for FamiliesYou can also exclude specific domains but at this point they have to be written in about:config.
https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...
It looks like Firefox Policies can be used to enable, disable, or specify the DoH provider but cannot yet specify excluded domains.
https://github.com/mozilla/policy-templates
In Mozilla’s DNS over HTTPsYou may find it noteworthy that Mozilla provides ways to configure this behavior as you please: https://github.com/mozilla/policy-templates#dnsoverhttps
In Mozilla’s DNS over HTTPsIf you want to control this via Group Policy, or system-wide, you can use the following policy:
https://github.com/mozilla/policy-templates#dnsoverhttps
In Mozilla’s DNS over HTTPsIf they do that, Mozilla will probably immediately update the check or remove it all together.
I don't understand why systems administrators don't just use their existing policy management to disable DoH if it really causes an issue. There's a group policy specifically for DNS over HTTPS [1]
The only reason I can think of is that they can't because of BYOD or Firefox being part of the company's dark IT. The DNS workaround doesn't help much in those cases because the underlying problem is a lack of oversight, not an issue with Firefox.
[1] https://github.com/mozilla/policy-templates/blob/master/READ...
In Mozilla’s DNS over HTTPs