How Can I NOT Have Firefox Resolve Addresses even though I Break DNS?

I'm trying to create a kiosk that can only access a handful of sites. I edited /etc/hosts so that it only contains those whitelisted sites and set my IPv4 DNS to manual, adding as the only DNS. In addition to this, I also set up a proxy server that is similarly configured so that it too can only find those sites. From both the Zorin OS command line and from the proxy server, DNS fails for any site but the whitelisted ones.

BUT in Firefox, it still finds other sites, abeit very slowly. I should add that I turned off the DNS privacy protection in Firefox as well as all other privacy protection controls, indeed, any setting that required a connection. I also have its connection settings configured to use the aforementioned proxy server.

So how in the wide, wide world of sports is Firefox managing to resolve addresses? :thinking:

In Firefox, > about:config
search: network.dnsCacheExpiration and set the value to 0 to disable DNS caching. Reboot or restart Firefox to test.

Are you using any proxy servers?