今天才发现firefox的几个秘密

那这个问题是否可以提交上去让他们修正一下或者给个选项的办法，我们自己开。

见：Security/Encrypted Client Hello - MozillaWiki

Dependency on DoH

Originally, Firefox required DoH to be enabled in order for ECH to function. Since Firefox 129, Firefox can fetch the necessary information via the OS DNS Resolver to enable ECH, allowing ECH to be used in more circumstances. Due a blocking bug with the MacOS DNS integration, MacOS still requires DoH to be enabled for ECH to be used, the work to fix this is tracked in 1882856.

For the vast majority of users, their native OS resolver will use unencrypted DNS to contact their local router which in turn passes their queries unencrypted on to their network provider. Fetching ECHConfigs via unencrypted DNS means that the sites the user visits are still leaked in plaintext to the network and so ECH delivers less value in this scenario. For this reason, we recommend the use of DoH (whether with a self-hosted or external DoH service) in order to benefit fully from the privacy protections of ECH.

这其实是有一个时间线的，早期主流浏览器把DOH和ECH强绑定，因为一个观点认为不使用加密dns的情况下，你保护了sni但dns还是泄露了，价值有限。当然后续是放开了（Chrome117+/Firefox129+）。

RFC 9849的表述是should，并不强制依赖DOH或者DNSSEC，但是推荐。推测是你的环境问题，这块地方不会突然改坏的。