For anyone else searching for the option:

> Firefox -> Preferences -> General -> Network Settings -> Enable DNS over HTTPS

This overrides my DNS server, right? I use dnsmasq to rewrite all local addresses to their local IPs when I'm on my LAN, but it looks like this will break that.

One option is to use the .local TLD for local domains, those will never be resolved via DoH.rDoH. ref https://wiki.mozilla.org/Trusted_Recursive_Resolver

.local is reserved for multicast DNS so it is a really bad idea to use it for private DNS

Thanks for pointing that out, I'll stop recommending this.

Unfortunately that isn't ideal because the domains do resolve from the outside. I want my laptop to resolve to my router away from home, but to the actual computer inside the NAT when I'm home.

Maybe I just need IPv6.

Likely. Instead of using DNS at all, it performs its own HTTPS request to get the DNS results; maybe FF reads the hosts file first, though.

That's unfortunate, but I guess I can't have it both ways... It would be nice if this feature were disabled per-network, at least.

Same here. Just toggled it on. Mozilla can wear this nomination as a badge of honor.

you should enable ESNI (encrypted SNI) on top of that next.

Instructions for others:

* Type about:config in the address bar and hit Enter.

* Accept the "This will void your warranty" warning.

* Type network.security.esni.enabled in the search box (you can also just type esni to filter to this setting).

* If it's set to false, double click it to set it to true.

* Confirm that it's working and that your DNS requests are secure, by visiting the Cloudflare test page. [1]

[1]: https://www.cloudflare.com/ssl/encrypted-sni/

Thank you Mozilla! I’m doing it as well now.

thanks to you & the ispa for the heads up