If you control the workstation, you could just set your DNS server by a policy. See: https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverht

If you control the workstation, you could just set your DNS server by a policy. See: https://github.com/mozilla/policy-templates/blob/master/README.md#dnsoverhttps https://github.com/mozilla/policy-templates/blob/master/READ... Of course that could be easily bypassed, but such a restriction could be easily bypassed by determined employees regardless of whether Firefox natively supports DoH or not. Local intranet sites will still continue to work without any changes because by default it will fall back to the native resolver if DoH can't resolve the domain. So there should be no breakage by default besides for content blocking use cases.