What it means
Firefox's Default DNS over HTTPS setting can use encrypted DNS where available and fall back to the operating system's resolver when needed. It may also disable DoH under certain enterprise, parental-control, VPN or network signals. Max insists on secure DNS through the selected provider and shows an error when it cannot resolve. Increased is between them: it uses DoH consistently but can switch to a backup option for problems.
A real-world example
A school network uses internal domain names and content filtering. Default respects the network signal; Max may show resolution errors for internal resources, or conflict with policy. The browser setting alone does not explain every website failure.
What to do
Identify the network's requirements, select the appropriate level and test both public and needed internal sites. Confirm the active status rather than assuming a chosen label means every lookup used DoH.
The distinction that matters
Encrypted DNS hides queries from some local observers but moves trust to a resolver and does not conceal the site from every network signal. Max can reduce availability and should not be used to evade a managed network's rules. A browser may still expose destination information through traffic patterns, and a signed-in website can identify you regardless of the DNS mode. Inspect the actual resolver and privacy terms when choosing a custom provider.
Mozilla DoH protection levels
