diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 502ef3f71a..ab47fed8b7 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1885,6 +1885,16 @@ pref("network.dns.disablePrefetch", false);
 // rejected before being given to DNS. RFC 7686
 pref("network.dns.blockDotOnion", true);
 
+// This preference controls whether to block access to 0.0.0.0
+// to mitigate local access issues in *NIX network stacks.
+#if defined(XP_WIN)
+// Windows is not affected, so don't block it there.
+// XXX: any other OSes not having this issue?
+pref("network.dns.blockQuad0", false);
+#else
+pref("network.dns.blockQuad0", true);
+#endif
+
 // These domains are treated as localhost equivalent
 pref("network.dns.localDomains", "");
 
diff --git a/netwerk/dns/nsDNSService2.cpp b/netwerk/dns/nsDNSService2.cpp
index 29597b9b98..f236e3b097 100644
--- a/netwerk/dns/nsDNSService2.cpp
+++ b/netwerk/dns/nsDNSService2.cpp
@@ -48,6 +48,7 @@ static const char kPrefIPv4OnlyDomains[]     = "network.dns.ipv4OnlyDomains";
 static const char kPrefDisableIPv6[]         = "network.dns.disableIPv6";
 static const char kPrefDisablePrefetch[]     = "network.dns.disablePrefetch";
 static const char kPrefBlockDotOnion[]       = "network.dns.blockDotOnion";
+static const char kPrefBlockQuad0[]          = "network.dns.blockQuad0";
 static const char kPrefDnsLocalDomains[]     = "network.dns.localDomains";
 static const char kPrefDnsOfflineLocalhost[] = "network.dns.offline-localhost";
 static const char kPrefDnsNotifyResolution[] = "network.dns.notifyResolution";
@@ -537,6 +538,7 @@ nsDNSService::Init()
     bool     offlineLocalhost = true;
     bool     disablePrefetch  = false;
     bool     blockDotOnion    = true;
+    bool     blockQuad0       = false;
     int      proxyType        = nsIProtocolProxyService::PROXYCONFIG_DIRECT;
     bool     notifyResolution = false;
 
@@ -561,6 +563,7 @@ nsDNSService::Init()
         prefs->GetBoolPref(kPrefDnsOfflineLocalhost, &offlineLocalhost);
         prefs->GetBoolPref(kPrefDisablePrefetch, &disablePrefetch);
         prefs->GetBoolPref(kPrefBlockDotOnion, &blockDotOnion);
+        prefs->GetBoolPref(kPrefBlockQuad0, &blockQuad0);
 
         // If a manual proxy is in use, disable prefetch implicitly
         prefs->GetIntPref("network.proxy.type", &proxyType);
@@ -579,6 +582,7 @@ nsDNSService::Init()
             prefs->AddObserver(kPrefDnsOfflineLocalhost, this, false);
             prefs->AddObserver(kPrefDisablePrefetch, this, false);
             prefs->AddObserver(kPrefBlockDotOnion, this, false);
+            prefs->AddObserver(kPrefBlockQuad0, this, false);
             prefs->AddObserver(kPrefDnsNotifyResolution, this, false);
 
             // Monitor these to see if there is a change in proxy configuration
@@ -612,6 +616,7 @@ nsDNSService::Init()
         mOfflineLocalhost = offlineLocalhost;
         mDisableIPv6 = disableIPv6;
         mBlockDotOnion = blockDotOnion;
+        mBlockQuad0 = blockQuad0;
 
         // Disable prefetching either by explicit preference or if a manual proxy is configured 
         mDisablePrefetch = disablePrefetch || (proxyType == nsIProtocolProxyService::PROXYCONFIG_MANUAL);
@@ -697,6 +702,12 @@ nsDNSService::PreprocessHostname(bool              aLocalDomain,
         return NS_ERROR_UNKNOWN_HOST;
     }
 
+    // Enforce RFC 7686
+    if (mBlockQuad0 &&
+        aInput.EqualsASCII("0.0.0.0")) {
+        return NS_ERROR_UNKNOWN_HOST;
+    }
+
     if (aLocalDomain) {
         aACE.AssignLiteral("localhost");
         return NS_OK;
diff --git a/netwerk/dns/nsDNSService2.h b/netwerk/dns/nsDNSService2.h
index 9912099012..68c91b2316 100644
--- a/netwerk/dns/nsDNSService2.h
+++ b/netwerk/dns/nsDNSService2.h
@@ -62,6 +62,7 @@ private:
     bool                                      mDisableIPv6;
     bool                                      mDisablePrefetch;
     bool                                      mBlockDotOnion;
+    bool                                      mBlockQuad0;
     bool                                      mFirstTime;
     bool                                      mNotifyResolution;
     bool                                      mOfflineLocalhost;