In Tor Browser we keep a patch originally for bug 751465 as a defense-in-depth for DNS leaks like bug 1618271 or bug 1470411. The patch approach is similar to the one described in https://bugzilla.mozilla.org/show_bug.cgi?id=1618271#c2: we check if network.proxy.socks_remote_dns == true and in that case we only allow resolving IP literals.

However, for now I'd like to suggest a simpler solution which should work for Tor Browser and I assume should be easier to accept and land. Just disable DNS (only allow ip literals or cached entries) if network.dns.disabled = true. This should work for us, as we can just set network.dns.disabled = true. For Firefox, I guess protections for DNS proxy bypasses like the one discussed in https://bugzilla.mozilla.org/show_bug.cgi?id=1618271#c2 can be done later independently of this (when network.dns.disabled = false).

If network.dns.disabled=true, only resolve IP literals or cached
entries.

https://hg.mozilla.org/mozilla-central/rev/6bbed9a7eb4b

Adding a check that I had missed in 1636411, cached entries should not be
renewed if network.dns.disabled = true.

https://hg.mozilla.org/mozilla-central/rev/1bd7b8776812