I am replying in this thread with Firefox 140.3.1 ESR. My queries are going to my router/firewall.

Verify that about:config network.trr.mode is set to 5.

If one has control over their local DNS they can also create a local record, example in Unbound DNS. Some applications will query this to see if DoH is permitted in the network.

    local-zone:     "use-application-dns.net." always_nxdomain

If that does not work create a startup script that will loop through all the common DoH providers and blackhole route them. Some may say that DoH could be on any CDN node but that is not the case. The DoH providers use static addresses and in some cases vanity IP addresses. [1] using this entire data-set is unnessecary as Firefox has only ever used Cloudflare and Google in the past.

    for OpenRes in $(grep -Ev ^# /usr/local/etc/_open_resolvers.txt);do /sbin/ip route add blackhole "${OpenRes}" 2>/dev/null;done

If using Unbound DNS enable logging of query responses to a tmpfs mount and ensure log rotation keeps the usage small and sends the compressed rotated files to the disk. Query logs can help verify requests are being processed by local DNS.

    log-queries: no
    log-replies: yes
    log-servfail: yes

[1] - https://github.com/dibdot/DoH-IP-blocklists

    tcpdump -p --dont-verify-checksums -i any -NNnntt -B32768 -c2000 -s0 proto 6 and 'tcp[13] == 2' and not host ${Your_Router_IP} &

    tcpdump -p --dont-verify-checksums -i any -NNnntt -B32768 -c4000 -s0 proto 17 and not host ${Your_Router_IP} and 'length <256' &