Which conditions trigger Firefox to fall back to system DNS after a DoH certificate error?

Goal

Determine the exact circumstances under which Firefox, with DNS over HTTPS (DoH) enabled, silently reverts to the system resolver when encountering a certificate validation error during a DoH request.

Current Ambiguities

• Firefox defaults to the system DNS but may override this when DoH is active.
• A failed TLS handshake on a DoH query can be interpreted either as a security failure or as a transparent fallback, but the decision matrix is not fully documented.
• It is unclear whether Firefox caches or logs an invalid DoH certificate before falling back, and whether this differs between Nightly, Beta, and Release builds.
• System DNS usage may vary by operating system, adding another layer of uncertainty.

Unresolved Questions

1. When does Firefox treat a DoH TLS handshake failure as a security failure versus a transparent fallback to the system resolver?
2. Does Firefox cache or log the invalid DoH certificate during a fallback, and how is that information exposed to the user or developer?
3. How do the fallback heuristics differ across Firefox release channels, and what impact does that have on reproducibility of DoH-related issues?