Firefox DoH is snake oil, plain and simple. It sends all the users DNS queries to Cloudflare, adding a new party which can surveil the user's traffic (and can be legally compelled to do so and not disclose this fact)-- providing a convenient choke point to save spies and hackers the trouble and exposure of extracting the data from tens of thousands of individual ISPs.

Simultaneously, it does not protect the user from monitoring by their ISP or parties situated there because the user's destination IPs remain unencrypted, as well as the hostnames via SNI (for cases of shared hosting, e.g. on cloudflare, where the IP alone wouldn't be enough).

At the moment you can disable this across your whole lan by blocking traffic to 104.16.248.249, 104.16.249.249, 2606:4700::6810:f8f9, and 2606:4700::6810:f9f9 and by DNS blackholing use-application-dns.net and cloudflare-dns.com.

iptables -t raw -A PREROUTING -d 104.16.248.249 -j DROP

iptables -t raw -A PREROUTING -d 104.16.249.249 -j DROP

ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f8f9 -j DROP

ip6tables -t raw -A PREROUTING -d 2606:4700::6810:f9f9 -j DROP

And if you're using bind:

zone "use-application-dns.net" { type master; file "/etc/bind/db.empty"; };

zone "cloudflare-dns.com" { type master; file "/etc/bind/db.empty"; };

Or unbound:

local-zone: "use-application-dns.net" static

local-zone: "cloudflare-dns.com" static

But there is no guarantee that these mitigations will continue to work.

[Edit: Aside, this comment and many/most(?) comments on this thread were moved from a more recent thread with a headline "Firefox turns on DoH as default for US users". The new title which omits the on-as-default, is kinda burying the lead.]

https://youtu.be/hUhisi2FBuw