diff --git a/netwerk/dns/DNSPacket.cpp b/netwerk/dns/DNSPacket.cpp
index 46a18a6c09f..2fd99eab098 100644
--- a/netwerk/dns/DNSPacket.cpp
+++ b/netwerk/dns/DNSPacket.cpp
@@ -67,7 +67,8 @@ nsresult DNSPacket::FillBuffer(
 // static
 nsresult DNSPacket::ParseSvcParam(unsigned int svcbIndex, uint16_t key,
                                   SvcFieldValue& field, uint16_t length,
-                                  const unsigned char* aBuffer) {
+                                  const unsigned char* aBuffer,
+                                  bool aAllowRFC1918) {
   switch (key) {
     case SvcParamKeyMandatory: {
       if (length % 2 != 0) {
@@ -134,7 +135,9 @@ nsresult DNSPacket::ParseSvcParam(unsigned int svcbIndex, uint16_t key,
         addr.inet.family = AF_INET;
         addr.inet.port = 0;
         addr.inet.ip = ntohl(get32bit(aBuffer, svcbIndex));
-        ipv4array.AppendElement(addr);
+        if (aAllowRFC1918 || !addr.IsIPAddrLocal()) {
+          ipv4array.AppendElement(addr);
+        }
         length -= 4;
         svcbIndex += 4;
       }
@@ -162,7 +165,9 @@ nsresult DNSPacket::ParseSvcParam(unsigned int svcbIndex, uint16_t key,
         for (int i = 0; i < 16; i++, svcbIndex++) {
           addr.inet6.ip.u8[i] = aBuffer[svcbIndex];
         }
-        ipv6array.AppendElement(addr);
+        if (aAllowRFC1918 || !addr.IsIPAddrLocal()) {
+          ipv6array.AppendElement(addr);
+        }
         length -= 16;
         // no need to increase svcbIndex - we did it in the for above.
       }
@@ -498,7 +503,8 @@ nsresult DNSPacket::ParseHTTPS(uint16_t aRDLen, struct SVCB& aParsed,
                                unsigned int aIndex,
                                const unsigned char* aBuffer,
                                unsigned int aBodySize,
-                               const nsACString& aOriginHost) {
+                               const nsACString& aOriginHost,
+                               bool aAllowRFC1918) {
   int32_t lastSvcParamKey = -1;
   nsresult rv = NS_OK;
   unsigned int svcbIndex = aIndex;
@@ -562,7 +568,7 @@ nsresult DNSPacket::ParseHTTPS(uint16_t aRDLen, struct SVCB& aParsed,
       return NS_ERROR_UNEXPECTED;
     }
 
-    rv = ParseSvcParam(svcbIndex, key, value, len, aBuffer);
+    rv = ParseSvcParam(svcbIndex, key, value, len, aBuffer, aAllowRFC1918);
     if (NS_FAILED(rv)) {
       return rv;
     }
@@ -574,8 +580,12 @@ nsresult DNSPacket::ParseHTTPS(uint16_t aRDLen, struct SVCB& aParsed,
       continue;
     }
 
-    if (value.mValue.is<SvcParamIpv4Hint>() ||
-        value.mValue.is<SvcParamIpv6Hint>()) {
+    if (value.mValue.is<SvcParamIpv4Hint>() &&
+        !value.mValue.as<SvcParamIpv4Hint>().mValue.IsEmpty()) {
+      aParsed.mHasIPHints = true;
+    }
+    if (value.mValue.is<SvcParamIpv6Hint>() &&
+        !value.mValue.as<SvcParamIpv6Hint>().mValue.IsEmpty()) {
       aParsed.mHasIPHints = true;
     }
     if (value.mValue.is<SvcParamEchConfig>()) {
@@ -847,7 +857,7 @@ nsresult DNSPacket::DecodeInternal(
           }
 
           rv = ParseHTTPS(RDLENGTH, parsed, index, aBuffer, mBodySize,
-                          mOriginHost ? *mOriginHost : qname);
+                          mOriginHost ? *mOriginHost : qname, aAllowRFC1918);
           if (NS_FAILED(rv)) {
             return rv;
           }
diff --git a/netwerk/dns/DNSPacket.h b/netwerk/dns/DNSPacket.h
index 16c44d1e8c8..0d0e404383f 100644
--- a/netwerk/dns/DNSPacket.h
+++ b/netwerk/dns/DNSPacket.h
@@ -74,7 +74,8 @@ class DNSPacket {
   static nsresult ParseHTTPS(uint16_t aRDLen, struct SVCB& aParsed,
                              unsigned int aIndex, const unsigned char* aBuffer,
                              unsigned int aBodySize,
-                             const nsACString& aOriginHost);
+                             const nsACString& aOriginHost,
+                             bool aAllowRFC1918 = true);
   void SetNativePacket(bool aNative) { mNativePacket = aNative; }
 
   static nsresult GetQname(nsACString& aQname, unsigned int& aIndex,
@@ -85,7 +86,8 @@ class DNSPacket {
   nsresult PassQName(unsigned int& index, const unsigned char* aBuffer);
   static nsresult ParseSvcParam(unsigned int svcbIndex, uint16_t key,
                                 SvcFieldValue& field, uint16_t length,
-                                const unsigned char* aBuffer);
+                                const unsigned char* aBuffer,
+                                bool aAllowRFC1918 = true);
   nsresult DecodeInternal(
       nsCString& aHost, enum TrrType aType, nsCString& aCname,
       bool aAllowRFC1918, DOHresp& aResp, TypeRecordResultType& aTypeResult,