You use forwarding to some IPv4 addresses, probably the ISP’s DNS, and they reply SERVFAIL to queries for cdn.mozilla.net DS. Kresd won’t be able to forward with validation through such broken servers. Apparently they can’t handle these queries on CNAMEs (which are used often enough nowadays).