Can't an ISP just respond with NXDOMAIN for use-application-dns.net and force Firefox to use their resolvers?