SEC_ERROR_UNKNOWN_ISSUER error appears when Firefox uses enterprise proxy and DNS-over-HTTPS

Goal

Determine whether Firefox should treat DNS-over-HTTPS canary and enterprise policy signals as authoritative per‑network or per‑profile in split‑DNS or captive‑portal environments.

Constraints and uncertainty

Firefox currently applies these signals per‑profile, which can cause intermittent NXDOMAIN failures for internal‑only domains when the same profile roams across networks with different split‑horizon DNS settings. A per‑network approach might resolve those failures but could introduce inconsistency for users who expect stable TRR behavior across locations.

Open questions:

• Should Firefox prioritize the network‑level canary response over the stored per‑profile TRR mode when a change is detected?
• How can Firefox safely update its TRR behavior per‑network without compromising privacy or causing flapping?
• Which signals (DHCP, router advertisements, captive‑portal detection) should trigger a per‑network reevaluation of DoH usage?