Changes

* DoH is enabled on the network if all heuristics pass, and disabled otherwise.

* Main article: [[Security/DNS Over HTTPS/Heuristics]].

== Respecting User-choice ==

* The doorhanger is shown only if the rollout is "successful" - i.e. the user did not already have custom DoH preferences or active enterprise policy.

* The doorhanger is implemented as a CFR message, gated behind the relevant prefs.

== Telemetry ==

* A ''state'' event is sent when the DoHController's state changes, e.g. when DoH is enabled or disabled on the network, when a user-choice results in disabling heuristics, when a rollback is detected, etc.

* A ''heuristics'' event is sent whenever we run heuristics, containing the result of each heuristic as its payload, along with the trigger (e.g. startup, network change) and the provider steering status.

== Migrations ==