Well, there's the use-application-dns.net canary domain (if it resolves to a response code other than NOERROR or to NOERROR but lacks both A and AAAA records),

Well, there's the use-application-dns.net canary domain (if it resolves to a response code other than NOERROR or to NOERROR but lacks both A and AAAA records), Firefox will fall back to using the OS DNS. Otherwise it's up to the application, just like with DNS it's always been the application's choice whether to use the OS-provided DNS or to use their own (eg via proxy or VPN). In short, you can't. But you never could stop an application from tunneling DNS over some other channel before, so that's nothing new.