diff --git a/.vscode/cSpell.json b/.vscode/cSpell.json
index 2b459e7c..f76c2cc9 100644
--- a/.vscode/cSpell.json
+++ b/.vscode/cSpell.json
@@ -17,6 +17,7 @@
         "DKIM",
         "DMARC",
         "dnssec",
+        "endregion",
         "esversion",
         "favicons",
         "googlecode",
diff --git a/_locales/de/messages.json b/_locales/de/messages.json
index 910d0ff0..6d2de0ad 100644
--- a/_locales/de/messages.json
+++ b/_locales/de/messages.json
@@ -381,7 +381,7 @@
 	"options_policy.signRules.sdid.allowSubDomains": {
 		"message": "Erlaube auch Subdomains der SDIDs"
 	},
-	"options_error.policy.wrong_sdid.asWarning": {
+	"options_policy.signRules.error.wrong_sdid.asWarning": {
 		"message": "Behandel falsche SDID als Warnung anstatt als Fehler"
 	},
 	"options_viewSigners": {
diff --git a/_locales/en_US/messages.json b/_locales/en_US/messages.json
index 8173149f..073d1d62 100644
--- a/_locales/en_US/messages.json
+++ b/_locales/en_US/messages.json
@@ -381,7 +381,7 @@
 	"options_policy.signRules.sdid.allowSubDomains": {
 		"message": "Allow also subdomains of the SDIDs"
 	},
-	"options_error.policy.wrong_sdid.asWarning": {
+	"options_policy.signRules.error.wrong_sdid.asWarning": {
 		"message": "Treat wrong SDID as a warning instead of an error"
 	},
 	"options_viewSigners": {
diff --git a/_locales/fr/messages.json b/_locales/fr/messages.json
index 631ae112..258ed307 100644
--- a/_locales/fr/messages.json
+++ b/_locales/fr/messages.json
@@ -381,7 +381,7 @@
 	"options_policy.signRules.sdid.allowSubDomains": {
 		"message": "Autoriser également les sous domaines du SDID"
 	},
-	"options_error.policy.wrong_sdid.asWarning": {
+	"options_policy.signRules.error.wrong_sdid.asWarning": {
 		"message": "Traiter un mauvais SDID comme un avertissement au lieu d'une erreur"
 	},
 	"options_viewSigners": {
diff --git a/_locales/hu/messages.json b/_locales/hu/messages.json
index b92a0f1f..9430f164 100644
--- a/_locales/hu/messages.json
+++ b/_locales/hu/messages.json
@@ -381,7 +381,7 @@
 	"options_policy.signRules.sdid.allowSubDomains": {
 		"message": "SDID-altartományok engedélyezése"
 	},
-	"options_error.policy.wrong_sdid.asWarning": {
+	"options_policy.signRules.error.wrong_sdid.asWarning": {
 		"message": "A helytelen SDID-t figyelmeztetésként kezelje, nem hibaként"
 	},
 	"options_viewSigners": {
diff --git a/_locales/it/messages.json b/_locales/it/messages.json
index 4da2be0a..ab646cf8 100644
--- a/_locales/it/messages.json
+++ b/_locales/it/messages.json
@@ -381,7 +381,7 @@
 	"options_policy.signRules.sdid.allowSubDomains": {
 		"message": "Permetti anche i sotto-domini dei SDID"
 	},
-	"options_error.policy.wrong_sdid.asWarning": {
+	"options_policy.signRules.error.wrong_sdid.asWarning": {
 		"message": "Considera SDID errato come un avviso invece che come un errore"
 	},
 	"options_viewSigners": {
diff --git a/_locales/ja_JP/messages.json b/_locales/ja_JP/messages.json
index 93e4f950..b58671e2 100644
--- a/_locales/ja_JP/messages.json
+++ b/_locales/ja_JP/messages.json
@@ -381,7 +381,7 @@
 	"options_policy.signRules.sdid.allowSubDomains": {
 		"message": "SDID のサブドメインも許容"
 	},
-	"options_error.policy.wrong_sdid.asWarning": {
+	"options_policy.signRules.error.wrong_sdid.asWarning": {
 		"message": "正しくない SDID をエラーではなく警告として扱う"
 	},
 	"options_viewSigners": {
diff --git a/_locales/zh_CN/messages.json b/_locales/zh_CN/messages.json
index 03a32179..2ef1e8d1 100644
--- a/_locales/zh_CN/messages.json
+++ b/_locales/zh_CN/messages.json
@@ -381,7 +381,7 @@
 	"options_policy.signRules.sdid.allowSubDomains": {
 		"message": "也允许 SDID 项的子域"
 	},
-	"options_error.policy.wrong_sdid.asWarning": {
+	"options_policy.signRules.error.wrong_sdid.asWarning": {
 		"message": "将错误的 SDID 视作一个警告而不是错误"
 	},
 	"options_viewSigners": {
diff --git a/content/background.mjs.js b/content/background.mjs.js
index 1cdbbe15..e228fead 100644
--- a/content/background.mjs.js
+++ b/content/background.mjs.js
@@ -14,10 +14,22 @@
 import { DKIM_InternalError, DKIM_SigError } from "../modules/error.mjs.js";
 import AuthVerifier from "../modules/AuthVerifier.mjs.js";
 import Logging from "../modules/logging.mjs.js";
+import prefs from "../modules/preferences.mjs.js";
 import { setKeyFetchFunction } from "../modules/dkim/verifier.mjs.js";
 
-Logging.setLogLevel(Logging.Level.Debug);
 const log = Logging.getLogger("background");
+(async () => {
+	await prefs.init();
+	if (prefs.debug) {
+		/** @type {number|undefined} */
+		// @ts-ignore
+		let logLevel = Logging.Level[prefs["logging.console"]];
+		if (!logLevel) {
+			logLevel = Logging.Level.Debug;
+		}
+		Logging.setLogLevel(logLevel);
+	}
+})().catch(error => log.fatal("Setting debug log level failed with:", error));
 
 // eslint-disable-next-line valid-jsdoc
 /** @type {import("../modules/dkim/verifier.mjs.js").KeyFetchFunction} */
@@ -33,7 +45,6 @@ async function getKey(sdid, selector) {
 
 	const dnsRes = await browser.jsdns.txt(`${selector}._domainkey.${sdid}`);
 
-
 	if (dnsRes.bogus) {
 		throw new DKIM_InternalError(null, "DKIM_DNSERROR_DNSSEC_BOGUS");
 	}
@@ -45,8 +56,6 @@ async function getKey(sdid, selector) {
 	if (dnsRes.data === null || dnsRes.data[0] === "") {
 		throw new DKIM_SigError("DKIM_SIGERROR_NOKEY");
 	}
-	console.log("dd");
-
 
 	if (!dnsRes.data) {
 		throw new DKIM_SigError("DKIM_SIGERROR_NOKEY");
diff --git a/content/options.html b/content/options.html
index 33a0efa7..962fe15c 100644
--- a/content/options.html
+++ b/content/options.html
@@ -82,7 +82,7 @@
         <fieldset disabled="disabled">
           <div>
             <label class="proxyConfig" data-i18n="options_dns.proxy.type"></label>
-            <select class="proxyConfig" data-pref="dns.proxy.type">
+            <select class="proxyConfig" data-pref="dns.proxy.type" data-pref-type="string">
               <option value="socks">SOCKS v5</option>
               <option value="socks4">SOCKS v4</option>
             </select>
@@ -91,7 +91,7 @@
             <label data-i18n="options_dns.proxy.host"></label>
             <input type="text" data-pref="dns.proxy.host">
             <label data-i18n="options_dns.proxy.port"></label>
-            <input type="number" data-pref="dns.proxy.port" size="10" min="0" max="65535">
+            <input type="number" data-pref="dns.proxy.port" data-pref-type="string" size="10" min="0" max="65535">
           </div>
         </fieldset>
       </fieldset>
@@ -103,7 +103,7 @@
           <input type="text" data-pref="dns.libunbound.path">
         </div>
         <label class="checkbox" data-i18n="options_dns.libunbound.path.relToProfileDir">
-          <input type="checkbox" data-pref="dns.libunbound.path.relToProfileDire">
+          <input type="checkbox" data-pref="dns.libunbound.path.relToProfileDir">
         </label>
       </fieldset>
     </section>
@@ -135,8 +135,8 @@
         <label class="checkbox" data-i18n="options_policy.signRules.sdid.allowSubDomains">
           <input type="checkbox" data-pref="policy.signRules.sdid.allowSubDomains">
         </label>
-        <label class="checkbox" data-i18n="options_error.policy.wrong_sdid.asWarning">
-          <input type="checkbox" data-pref="error.policy.wrong_sdid.asWarning">
+        <label class="checkbox" data-i18n="options_policy.signRules.error.wrong_sdid.asWarning">
+          <input type="checkbox" data-pref="policy.signRules.error.wrong_sdid.asWarning">
         </label>
         <label class="checkbox" data-i18n="options_policy.DMARC.shouldBeSigned.enable">
           <input type="checkbox" data-pref="policy.DMARC.shouldBeSigned.enable">
diff --git a/content/options.mjs.js b/content/options.mjs.js
index 28649fd9..31f11ba9 100644
--- a/content/options.mjs.js
+++ b/content/options.mjs.js
@@ -10,6 +10,11 @@
 // @ts-check
 /* eslint-env browser */
 
+import Logging from "../modules/logging.mjs.js";
+import prefs from "../modules/preferences.mjs.js";
+
+const log = Logging.getLogger("Options");
+
 /**
  * Set the active pane to the given navigation selector
  *
@@ -54,8 +59,10 @@ function setNavigation(navSelector) {
 
 /**
  * Add navigation logic to <nav> elements and initialize navigation.
+ *
+ * @returns {void}
  */
-document.addEventListener("DOMContentLoaded", () => {
+function initNavigation() {
 	const navElements = Array.from(document.querySelectorAll("nav"));
 	for (const navElement of navElements) {
 		/** @type {HTMLElement[]} */
@@ -69,4 +76,98 @@ document.addEventListener("DOMContentLoaded", () => {
 			};
 		}
 	}
+}
+
+/**
+ * React to a change event on an HTML element representing a preference.
+ *
+ * @param {Event} event
+ * @returns {void}
+ */
+function preferenceChanged(event) {
+	try {
+		const target = event.target;
+		if (!(target instanceof HTMLElement)) {
+			log.warn("Received unexpected change event for non HTML element", event);
+			return;
+		}
+		const prefName = target.dataset.pref;
+		if (!prefName) {
+			log.warn("Received unexpected change event for element without data-pref attribute", event);
+			return;
+		}
+		if (target instanceof HTMLInputElement) {
+			if (target.getAttribute("type") === "checkbox") {
+				prefs.setValue(prefName, target.checked);
+			} else if (target.getAttribute("type") === "text" ||
+				target.dataset.prefType === "string"
+			) {
+				prefs.setValue(prefName, target.value);
+			} else if (target.getAttribute("type") === "number") {
+				prefs.setValue(prefName, parseInt(target.value, 10));
+			} else {
+				log.error("Received change event for input element without unexpected type", event);
+			}
+		} else if (target instanceof HTMLSelectElement) {
+			if (target.dataset.prefType === "string") {
+				prefs.setValue(prefName, target.value);
+			} else {
+				prefs.setValue(prefName, parseInt(target.value, 10));
+			}
+		} else {
+			log.error("Received change event for unexpected element", event);
+		}
+	} catch (e) {
+		log.fatal("Unexpected error in preferenceChanged():", e);
+	}
+}
+
+/**
+ * Initialize logic for preferences.
+ *
+ * @returns {Promise<void>}
+ */
+async function initPreferences() {
+	await prefs.init();
+
+	// set prefs to initial value
+	/** @type {HTMLElement[]} */
+	const prefElements = Array.from(document.querySelectorAll("[data-pref]"));
+	for (const element of prefElements) {
+		const prefName = element.dataset.pref;
+		if (!prefName) {
+			log.error("Preference element has unexpected data-pref attribute", element);
+			continue;
+		}
+		if (element instanceof HTMLInputElement) {
+			if (element.getAttribute("type") === "checkbox") {
+				element.checked = prefs.getBool(prefName);
+			} else if (element.getAttribute("type") === "text" ||
+				element.dataset.prefType === "string"
+			) {
+				element.value = prefs.getString(prefName);
+			} else if (element.getAttribute("type") === "number") {
+				element.value = prefs.getNumber(prefName).toString();
+			} else {
+				log.error("Input element has unexpected type", element);
+			}
+		} else if (element instanceof HTMLSelectElement) {
+			if (element.dataset.prefType === "string") {
+				element.value = prefs.getString(prefName);
+			} else {
+				element.value = prefs.getNumber(prefName).toString();
+			}
+		} else {
+			log.error("Unexpected preference element", element);
+		}
+	}
+
+	// listening to changes
+	document.body.addEventListener("change", preferenceChanged);
+}
+
+document.addEventListener("DOMContentLoaded", () => {
+	initNavigation();
+	initPreferences().
+		catch(e => log.fatal("Unexpected error in initPreferences():", e));
 });
diff --git a/defaults/preferences/prefs.js b/defaults/preferences/prefs.js
deleted file mode 100644
index 96b1ecad..00000000
--- a/defaults/preferences/prefs.js
+++ /dev/null
@@ -1,148 +0,0 @@
-// Default preference values. These are accessible via the preferences system
-// or via the optional chrome/content/options.xul preferences dialog.
-/* eslint strict: "off", no-magic-numbers: "off" */
-/* global pref */
-// @ts-nocheck
-
-////////////////////////////////////////////////////////////////////////////////
-// general preferences - General
-////////////////////////////////////////////////////////////////////////////////
-
-pref("extensions.dkim_verifier.dkim.enable", true);
-
-// 0: don't store DKIM keys
-// 1: store DKIM keys
-// 2: store DKIM keys and compare with current key
-pref("extensions.dkim_verifier.key.storing", 0);
-
-pref("extensions.dkim_verifier.saveResult", false);
-pref("extensions.dkim_verifier.arh.read", false);
-
-////////////////////////////////////////////////////////////////////////////////
-// general preferences - DNS
-////////////////////////////////////////////////////////////////////////////////
-
-/*
- * 1 JS DNS
- * 2 libunbound
- */
-pref("extensions.dkim_verifier.dns.resolver", 1);
-pref("extensions.dkim_verifier.dns.getNameserversFromOS", true);
-pref("extensions.dkim_verifier.dns.nameserver", "8.8.8.8");
-pref("extensions.dkim_verifier.dns.timeout_connect", 5);
-pref("extensions.dkim_verifier.dns.dnssec.trustAnchor", ". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D");
-pref("extensions.dkim_verifier.dns.proxy.enable", false);
-// "socks", "socks4"
-pref("extensions.dkim_verifier.dns.proxy.type", "socks");
-pref("extensions.dkim_verifier.dns.proxy.host", "");
-pref("extensions.dkim_verifier.dns.proxy.port", "");
-pref("extensions.dkim_verifier.dns.jsdns.autoResetServerAlive", false);
-pref("extensions.dkim_verifier.dns.libunbound.path", "extensions/dnssec@nic.cz/plugins/ub_ds_windows-x86.dll");
-pref("extensions.dkim_verifier.dns.libunbound.path.relToProfileDir", true);
-
-
-////////////////////////////////////////////////////////////////////////////////
-// general preferences - Policy
-////////////////////////////////////////////////////////////////////////////////
-
-pref("extensions.dkim_verifier.policy.signRules.enable", false);
-pref("extensions.dkim_verifier.policy.signRules.checkDefaultRules", true);
-pref("extensions.dkim_verifier.policy.signRules.autoAddRule", false);
-pref("extensions.dkim_verifier.policy.signRules.autoAddRule.onlyIfFromAddressInSDID", true);
-// 0: from address
-// 1: subdomain
-// 2: base domain
-pref("extensions.dkim_verifier.policy.signRules.autoAddRule.for", 0);
-pref("extensions.dkim_verifier.policy.signRules.sdid.allowSubDomains", true);
-pref("extensions.dkim_verifier.error.policy.wrong_sdid.asWarning", false);
-
-pref("extensions.dkim_verifier.policy.DMARC.shouldBeSigned.enable", false);
-// "none", "quarantine", "reject"
-pref("extensions.dkim_verifier.policy.DMARC.shouldBeSigned.neededPolicy", "none");
-
-
-////////////////////////////////////////////////////////////////////////////////
-// display preferences
-////////////////////////////////////////////////////////////////////////////////
-
-/*
- * 0   never
- * 10  when an e-mail with a valid DKIM signature is viewed  (SUCCESS)
- * 20  when an e-mail with a valid DKIM signature is viewed (including TEMPFAIL) (SUCCESS, TEMPFAIL)
- * 30  when an e-mail with a DKIM signature is viewed (SUCCESS, TEMPFAIL, PERMFAIL, loading)
- * 40  when an e-mail is viewed
- * 50  when a message is viewed
- */
-pref("extensions.dkim_verifier.showDKIMHeader", 30);
-/*
- * 0   never
- * 10  when an e-mail with a valid DKIM signature is viewed  (SUCCESS)
- * 20  when an e-mail with a valid DKIM signature is viewed (including TEMPFAIL) (SUCCESS, TEMPFAIL)
- * 30  when an e-mail with a DKIM signature is viewed (SUCCESS, TEMPFAIL, PERMFAIL, loading)
- * 40  when an e-mail is viewed
- * 50  when a message is viewed
- */
-pref("extensions.dkim_verifier.showDKIMStatusbarpanel", 0);
-/*
- * 1 text
- * 2 icon
- */
-pref("extensions.dkim_verifier.statusbarpanel.result.style", 1);
-/*
- * 0   never
- * 10  when an e-mail with a valid DKIM signature is viewed  (SUCCESS)
- * 20  when an e-mail with a valid DKIM signature is viewed (including TEMPFAIL) (SUCCESS, TEMPFAIL)
- * 30  when an e-mail with a DKIM signature is viewed (SUCCESS, TEMPFAIL, PERMFAIL, loading)
- * 40  when an e-mail is viewed
- * 50  when a message is viewed
- */
-pref("extensions.dkim_verifier.showDKIMFromTooltip", 0);
-
-pref("extensions.dkim_verifier.colorFrom", false);
-pref("extensions.dkim_verifier.color.success.text", "windowtext");
-pref("extensions.dkim_verifier.color.success.background", "#00FF00");
-pref("extensions.dkim_verifier.color.warning.text", "windowtext");
-pref("extensions.dkim_verifier.color.warning.background", "orange");
-pref("extensions.dkim_verifier.color.permfail.text", "windowtext");
-pref("extensions.dkim_verifier.color.permfail.background", "red");
-pref("extensions.dkim_verifier.color.tempfail.text", "unset");
-pref("extensions.dkim_verifier.color.tempfail.background", "unset");
-pref("extensions.dkim_verifier.color.nosig.text", "unset");
-pref("extensions.dkim_verifier.color.nosig.background", "unset");
-
-pref("extensions.dkim_verifier.display.favicon.show", true);
-
-
-////////////////////////////////////////////////////////////////////////////////
-// advanced preferences
-////////////////////////////////////////////////////////////////////////////////
-
-pref("extensions.dkim_verifier.debug", false);
-// "Fatal", "Error", "Warn", "Info", "Config", "Debug", "Trace", "All"
-pref("extensions.dkim_verifier.logging.console", "Debug");
-// "Fatal", "Error", "Warn", "Info", "Config", "Debug", "Trace", "All"
-pref("extensions.dkim_verifier.logging.dump", "Debug");
-pref("extensions.dkim_verifier.debugLevel", 0);
-pref("extensions.dkim_verifier.error.detailedReasons", false);
-pref("extensions.dkim_verifier.display.keySecure", true);
-pref("extensions.dkim_verifier.arh.replaceAddonResult", true);
-pref("extensions.dkim_verifier.arh.relaxedParsing", false);
-// 0: error, 1: warning, 2: ignore
-pref("extensions.dkim_verifier.error.illformed_i.treatAs", 1);
-pref("extensions.dkim_verifier.error.illformed_s.treatAs", 1);
-pref("extensions.dkim_verifier.error.policy.key_insecure.treatAs", 2);
-pref("extensions.dkim_verifier.error.key_testmode.ignore", false);
-pref("extensions.dkim_verifier.error.contentTypeCharsetAddedQuotes.treatAs", 0);
-pref("extensions.dkim_verifier.error.algorithm.sign.rsa-sha1.treatAs", 1);
-pref("extensions.dkim_verifier.error.algorithm.rsa.weakKeyLength.treatAs", 2);
-
-
-////////////////////////////////////////////////////////////////////////////////
-// account specific options
-////////////////////////////////////////////////////////////////////////////////
-
-// 0: default, 1: yes, 2: no
-pref("mail.server.default.dkim_verifier.dkim.enable", 0);
-pref("mail.server.default.dkim_verifier.arh.read", 0);
-// empty to allow all
-pref("mail.server.default.dkim_verifier.arh.allowedAuthserv", "");
diff --git a/jsconfig.json b/jsconfig.json
index d5b03145..297d8864 100644
--- a/jsconfig.json
+++ b/jsconfig.json
@@ -9,6 +9,9 @@
         "strict": true,
         "isolatedModules": true,
         "checkJs": true,
+        "moduleResolution": "node"
     },
-    "exclude": []
+    "exclude": [
+        "node_modules"
+    ]
 }
diff --git a/manifest.json b/manifest.json
index 1ebf75b9..9eb3d875 100644
--- a/manifest.json
+++ b/manifest.json
@@ -13,7 +13,8 @@
 		}
 	},
 	"permissions": [
-		"messagesRead"
+		"messagesRead",
+		"storage"
 	],
 	"background": {
 		"page": "content/background.html"
diff --git a/modules/AuthVerifier.mjs.js b/modules/AuthVerifier.mjs.js
index 065d1933..98574311 100644
--- a/modules/AuthVerifier.mjs.js
+++ b/modules/AuthVerifier.mjs.js
@@ -28,10 +28,9 @@ import { domainIsInDomain, getDomainFromAddr } from "./utils.mjs.js";
 import { DKIM_InternalError } from "./error.mjs.js";
 import Logging from "./logging.mjs.js";
 import MsgParser from "./msgParser.mjs.js";
-import Preferences from "./preferences.mjs.js";
+import prefs from "./preferences.mjs.js";
 
 const log = Logging.getLogger("AuthVerifier");
-const prefs = new Preferences();
 
 /**
  * @typedef {Object} AuthResult|AuthResultV2
@@ -91,6 +90,7 @@ export default class AuthVerifier {
 	 * @return {Promise<AuthResult>}
 	 */
 	async verify(rawMessage, messageId) {
+		await prefs.init();
 		// check for saved AuthResult
 		let savedAuthResult = loadAuthResult(messageId);
 		if (savedAuthResult) {
@@ -119,7 +119,7 @@ export default class AuthVerifier {
 		const arhResult = getARHResult(messageId, msg);
 
 		if (arhResult) {
-			if (prefs.arh.replaceAddonResult) {
+			if (prefs["arh.replaceAddonResult"]) {
 				savedAuthResult = arhResult;
 			} else {
 				savedAuthResult = {
@@ -144,10 +144,10 @@ export default class AuthVerifier {
 			let dkimEnable = false;
 			if (true || !msgHdr.folder) {
 				// message is external
-				dkimEnable = prefs.dkim.enable;
+				dkimEnable = prefs["dkim.enable"];
 			} else if (msgHdr.folder.server.getIntValue("dkim_verifier.dkim.enable") === PREF.ENABLE.DEFAULT) {
 				// account uses global default
-				dkimEnable = prefs.dkim.enable;
+				dkimEnable = prefs["dkim.enable"];
 			} else if (msgHdr.folder.server.getIntValue("dkim_verifier.dkim.enable") === PREF.ENABLE.TRUE) {
 				// dkim enabled for account
 				dkimEnable = true;
@@ -491,7 +491,7 @@ function dkimSigResultV2_to_AuthResultDKIM(dkimSigResult) { // eslint-disable-li
 			authResultDKIM.res_num = 10;
 			let keySecureStr = "";
 			if (dkimSigResult.keySecure &&
-				prefs.display.keySecure) {
+				prefs["display.keySecure"]) {
 				keySecureStr = " \uD83D\uDD12";
 			}
 			authResultDKIM.result_str = browser.i18n.getMessage("SUCCESS",
@@ -516,7 +516,7 @@ function dkimSigResultV2_to_AuthResultDKIM(dkimSigResult) { // eslint-disable-li
 				authResultDKIM.res_num = 30;
 			}
 			let errorType = dkimSigResult.errorType;
-			if (!prefs.error.detailedReasons) {
+			if (!prefs["error.detailedReasons"]) {
 				switch (errorType) {
 					case "DKIM_SIGERROR_ILLFORMED_TAGSPEC":
 					case "DKIM_SIGERROR_DUPLICATE_TAG":
@@ -658,7 +658,7 @@ function AuthResultDKIMV2_to_dkimSigResultV2(authResultDKIM) {
  * @return {Promise<AuthResult>} authResult
  */
 async function addFavicons(authResult) {
-	if (!prefs.display.favicon.show) {
+	if (!prefs["display.favicon.show"]) {
 		return authResult;
 	}
 	for (let i = 0; i < authResult.dkim.length; i++) {
diff --git a/modules/dkim/verifier.mjs.js b/modules/dkim/verifier.mjs.js
index 0aae0e3d..3e570e6c 100644
--- a/modules/dkim/verifier.mjs.js
+++ b/modules/dkim/verifier.mjs.js
@@ -32,8 +32,8 @@ import {DKIM_InternalError, DKIM_SigError} from "../error.mjs.js";
 import {addrIsInDomain2, domainIsInDomain, stringEndsWith, stringEqual} from "../utils.mjs.js";
 import DkimCrypto from "./crypto.mjs.js";
 import Logging from "../logging.mjs.js";
-import Preferences from "../preferences.mjs.js";
 import RfcParser from "../rfcParser.mjs.js";
+import prefs from "../preferences.mjs.js";
 
 // TODO: move policy checking out of the verifier module
 class DummyPolicy {
@@ -109,7 +109,6 @@ const Policy = new DummyPolicy();
  */
 
 const log = Logging.getLogger("Verifier");
-const prefs = new Preferences().error;
 
 
 // Pattern for hyphenated-word as specified in Section 2.10 of RFC 6376
@@ -228,7 +227,7 @@ export function setKeyFetchFunction(keyFetchFunction) {
 			DKIMSignature.a_sig = algorithmTag[1];
 			DKIMSignature.a_hash = algorithmTag[2];
 		} else if (algorithmTag[0] === "rsa-sha1") {
-			switch (prefs.algorithm.sign["rsa-sha1"].treatAs) {
+			switch (prefs["error.algorithm.sign.rsa-sha1.treatAs"]) {
 				case 0: // error
 					throw new DKIM_SigError("DKIM_SIGERROR_INSECURE_A");
 				case 1: // warning
@@ -380,7 +379,7 @@ export function setKeyFetchFunction(keyFetchFunction) {
 			if (exception instanceof DKIM_SigError &&
 				exception.errorType === "DKIM_SIGERROR_ILLFORMED_I")
 			{
-				switch (prefs.illformed_i.treatAs) {
+				switch (prefs["error.illformed_i.treatAs"]) {
 					case 0: // error
 						throw exception;
 					case 1: // warning
@@ -436,7 +435,7 @@ export function setKeyFetchFunction(keyFetchFunction) {
 				// try to parse selector in a more relaxed way
 				const sub_domain_ = "(?:[A-Za-z0-9_](?:[A-Za-z0-9_-]*[A-Za-z0-9_])?)";
 				SelectorTag = RfcParser.parseTagValue(tagMap, "s", `${sub_domain_}(?:\\.${sub_domain_})*`);
-				switch (prefs.illformed_s.treatAs) {
+				switch (prefs["error.illformed_s.treatAs"]) {
 					case 0: // error
 						throw exception;
 					case 1: // warning
@@ -855,7 +854,7 @@ export function setKeyFetchFunction(keyFetchFunction) {
 
 		// if key is not signed by DNSSEC
 		if (!DKIMSignature.keyQueryResult.secure) {
-			switch (prefs.policy.key_insecure.treatAs) {
+			switch (prefs["error.policy.key_insecure.treatAs"]) {
 				case 0: // error
 					throw new DKIM_SigError("DKIM_POLICYERROR_KEY_INSECURE");
 				case 1: // warning
@@ -874,7 +873,7 @@ export function setKeyFetchFunction(keyFetchFunction) {
 
 		// check that the testing flag is not set
 		if (DKIMSignature.DKIMKey.t_array.indexOf("y") !== -1) {
-			if (prefs.key_testmode.ignore) {
+			if (prefs["error.key_testmode.ignore"]) {
 				DKIMSignature.warnings.push({name: "DKIM_SIGERROR_KEY_TESTMODE"});
 				log.debug("Warning: DKIM_SIGERROR_KEY_TESTMODE");
 			} else {
@@ -909,7 +908,7 @@ export function setKeyFetchFunction(keyFetchFunction) {
 			headerHashInput
 		);
 		if (!isValid) {
-			if (prefs.contentTypeCharsetAddedQuotes.treatAs > 0) {
+			if (prefs["error.contentTypeCharsetAddedQuotes.treatAs"] > 0) {
 				log.debug("Try with removed quotes in Content-Type charset.");
 				msg.headerFields.get("content-type")[0] =
 					msg.headerFields.get("content-type")[0].
@@ -926,7 +925,7 @@ export function setKeyFetchFunction(keyFetchFunction) {
 				);
 				if (!isValid) {
 					throw new DKIM_SigError("DKIM_SIGERROR_BADSIG");
-				} else if (prefs.contentTypeCharsetAddedQuotes.treatAs === 1) {
+				} else if (prefs["error.contentTypeCharsetAddedQuotes.treatAs"] === 1) {
 					DKIMSignature.warnings.push({name: "DKIM_SIGERROR_CONTENT_TYPE_CHARSET_ADDED_QUOTES"});
 					log.debug("Warning: DKIM_SIGERROR_CONTENT_TYPE_CHARSET_ADDED_QUOTES");
 				}
@@ -942,7 +941,7 @@ export function setKeyFetchFunction(keyFetchFunction) {
 		} else if (keyLength < 2048) {
 			// weak key
 			log.debug(`rsa key size: ${keyLength}`);
-			switch (prefs.algorithm.rsa.weakKeyLength.treatAs) {
+			switch (prefs["error.algorithm.rsa.weakKeyLength.treatAs"]) {
 				case 0: // error
 					throw new DKIM_SigError("DKIM_SIGWARNING_KEY_IS_WEAK");
 				case 1: // warning
@@ -1071,6 +1070,7 @@ export default class Verifier {
 	 */
 	verify(msg) {
 		const promise = (async () => {
+			await prefs.init();
 			const res = {
 				version: "2.0",
 				signatures: await processSignatures(msg),
diff --git a/modules/preferences.mjs.js b/modules/preferences.mjs.js
new file mode 100644
index 00000000..a150ed3d
--- /dev/null
+++ b/modules/preferences.mjs.js
@@ -0,0 +1,570 @@
+/**
+ * Provides access to the add-ons preferences.
+ *
+ * Copyright (c) 2020 Philippe Lieser
+ *
+ * This software is licensed under the terms of the MIT License.
+ *
+ * The above copyright and license notice shall be
+ * included in all copies or substantial portions of the Software.
+ */
+
+// @ts-check
+///<reference path="../WebExtensions.d.ts" />
+/* eslint-env webextensions */
+/* eslint no-magic-numbers: "off" */
+
+import Logging from "./logging.mjs.js";
+
+const log = Logging.getLogger("Verifier");
+
+/**
+ * Defines the interface for accessing the preferences and
+ * defines the default values of the preferences.
+ */
+export class BasePreferences {
+	/**
+	 * @callback ValueGetter
+	 * @param {string} name
+	 * @return {boolean|number|string|undefined}
+	 */
+	/**
+	 * @callback ValueSetter
+	 * @param {string} name
+	 * @param {boolean|number|string} value
+	 * @return {Promise<void>}
+	 */
+
+	/**
+	 * Creates an instance of BasePreferences.
+	 *
+	 * @param {ValueGetter} valueGetter
+	 * @param {ValueSetter} valueSetter
+	 * @memberof BasePreferences
+	 */
+	constructor(valueGetter, valueSetter) {
+		this._valueGetter = valueGetter;
+		this._valueSetter = valueSetter;
+	}
+
+	/**
+	 * Initialize the preference instance if needed.
+	 * Must be waited on before the instance can be used.
+	 *
+	 * @returns {Promise<void>}
+	 */
+	init() {
+		return Promise.resolve();
+	}
+
+	/**
+	 * Clear the stored preferences.
+	 *
+	 * @returns {Promise<void>}
+	 */
+	clear() {
+		this._prefs = {};
+		return Promise.resolve();
+	}
+
+	/**
+	 * @param {string} name
+	 * @param {boolean} defaultValue
+	 * @returns {boolean}
+	 * @memberof BasePreferences
+	 */
+	_tryGetBoolValue(name, defaultValue) {
+		const value = this._valueGetter(name);
+		if (typeof value === "boolean") {
+			return value;
+		}
+		if (typeof value === "undefined") {
+			return defaultValue;
+		}
+		throw new Error(`Preference ${name} has unexpected type ${typeof value}`);
+	}
+
+	/**
+	 * @param {string} name
+	 * @param {number} defaultValue
+	 * @returns {number}
+	 * @memberof BasePreferences
+	 */
+	_tryGetNumberValue(name, defaultValue) {
+		const value = this._valueGetter(name);
+		if (typeof value === "number") {
+			return value;
+		}
+		if (typeof value === "undefined") {
+			return defaultValue;
+		}
+		throw new Error(`Preference ${name} has unexpected type ${typeof value}`);
+	}
+
+	/**
+	 * @param {string} name
+	 * @param {string} defaultValue
+	 * @returns {string}
+	 * @memberof BasePreferences
+	 */
+	_tryGetStringValue(name, defaultValue) {
+		const value = this._valueGetter(name);
+		if (typeof value === "string") {
+			return value;
+		}
+		if (typeof value === "undefined") {
+			return defaultValue;
+		}
+		throw new Error(`Preference ${name} has unexpected type ${typeof value}`);
+	}
+
+	/**
+	 * @param {string} name
+	 * @returns {boolean|number|string}
+	 * @memberof BasePreferences
+	 */
+	getValue(name) {
+		if (!Object.prototype.hasOwnProperty.call(BasePreferences.prototype, name)) {
+			throw new Error(`Can not get nonexisting preference "${name}"`);
+		}
+		/** @type {any} */
+		const that = this;
+		return that[name];
+	}
+
+	/**
+	 * @param {string} name
+	 * @returns {boolean}
+	 * @memberof BasePreferences
+	 */
+	getBool(name) {
+		const value = this.getValue(name);
+		if (typeof value !== "boolean") {
+			throw new Error(`Preference ${name} has unexpected type ${typeof value}`);
+		}
+		return value;
+	}
+
+	/**
+	 * @param {string} name
+	 * @returns {number}
+	 * @memberof BasePreferences
+	 */
+	getNumber(name) {
+		const value = this.getValue(name);
+		if (typeof value !== "number") {
+			throw new Error(`Preference ${name} has unexpected type ${typeof value}`);
+		}
+		return value;
+	}
+
+	/**
+	 * @param {string} name
+	 * @returns {string}
+	 * @memberof BasePreferences
+	 */
+	getString(name) {
+		const value = this.getValue(name);
+		if (typeof value !== "string") {
+			throw new Error(`Preference ${name} has unexpected type ${typeof value}`);
+		}
+		return value;
+	}
+
+	/**
+	 * @param {string} name
+	 * @param {boolean|number|string} value
+	 * @returns {Promise<void>}
+	 * @memberof BasePreferences
+	 */
+	async setValue(name, value) {
+		if (typeof value !== typeof this.getValue(name)) {
+			throw new Error(`Can not set preference with type ${typeof this.getValue(name)} to a ${typeof value}`);
+		}
+		await this._valueSetter(name, value);
+	}
+
+	////////////////////////////////////////////////////////////////////////////
+	//#region General preferences
+	////////////////////////////////////////////////////////////////////////////
+
+	get "dkim.enable"() {
+		return this._tryGetBoolValue("dkim.enable", true);
+	}
+	/**
+	 * - 0: don't store DKIM keys
+	 * - 1: store DKIM keys
+	 * - 2: store DKIM keys and compare with current key
+	 */
+	get "key.storing"() {
+		return this._tryGetNumberValue("key.storing", 0);
+	}
+	get "saveResult"() {
+		return this._tryGetBoolValue("saveResult", false);
+	}
+
+	get "arh.read"() {
+		return this._tryGetBoolValue("arh.read", false);
+	}
+	get "arh.replaceAddonResult"() {
+		return this._tryGetBoolValue("arh.replaceAddonResult", true);
+	}
+	get "arh.relaxedParsing"() {
+		return this._tryGetBoolValue("arh.relaxedParsing", false);
+	}
+	//#endregion
+
+	////////////////////////////////////////////////////////////////////////////
+	//#region Error preferences
+	////////////////////////////////////////////////////////////////////////////
+
+	/**
+	 * - 0: error
+	 * - 1: warning
+	 * - 2: ignore
+	 */
+	get "error.illformed_i.treatAs"() {
+		return this._tryGetNumberValue("error.illformed_i.treatAs", 1);
+	}
+	/**
+	 * - 0: error
+	 * - 1: warning
+	 * - 2: ignore
+	 */
+	get "error.illformed_s.treatAs"() {
+		return this._tryGetNumberValue("error.illformed_s.treatAs", 1);
+	}
+	/**
+	 * - 0: error
+	 * - 1: warning
+	 * - 2: ignore
+	 */
+	get "error.policy.key_insecure.treatAs"() {
+		return this._tryGetNumberValue("error.policy.key_insecure.treatAs", 2);
+	}
+	get "error.key_testmode.ignore"() {
+		return this._tryGetBoolValue("error.key_testmode.ignore", false);
+	}
+	/**
+	 * - 0: error
+	 * - 1: warning
+	 * - 2: ignore
+	 */
+	get "error.contentTypeCharsetAddedQuotes.treatAs"() {
+		return this._tryGetNumberValue("error.contentTypeCharsetAddedQuotes.treatAs", 0);
+	}
+	/**
+	 * - 0: error
+	 * - 1: warning
+	 * - 2: ignore
+	 */
+	get "error.algorithm.sign.rsa-sha1.treatAs"() {
+		return this._tryGetNumberValue("error.algorithm.sign.rsa-sha1.treatAs", 1);
+	}
+	/**
+	 * - 0: error
+	 * - 1: warning
+	 * - 2: ignore
+	 */
+	get "error.algorithm.rsa.weakKeyLength.treatAs"() {
+		return this._tryGetNumberValue("error.algorithm.rsa.weakKeyLength.treatAs", 2);
+	}
+
+	get "error.detailedReasons"() {
+		return this._tryGetBoolValue("error.detailedReasons", false);
+	}
+	//#endregion
+
+	////////////////////////////////////////////////////////////////////////////
+	//#region DNS preferences
+	////////////////////////////////////////////////////////////////////////////
+
+	/**
+	 * - 1 JS DNS
+	 * - 2 libunbound
+	 */
+	get "dns.resolver"() {
+		return this._tryGetNumberValue("dns.resolver", 1);
+	}
+	get "dns.getNameserversFromOS"() {
+		return this._tryGetBoolValue("dns.getNameserversFromOS", true);
+	}
+	get "dns.nameserver"() {
+		return this._tryGetStringValue("dns.nameserver", "8.8.8.8");
+	}
+	get "dns.timeout_connect"() {
+		return this._tryGetNumberValue("dns.timeout_connect", 5);
+	}
+	get "dns.dnssec.trustAnchor"() {
+		return this._tryGetStringValue("dns.dnssec.trustAnchor",
+			". IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D");
+	}
+	get "dns.proxy.enable"() {
+		return this._tryGetBoolValue("dns.proxy.enable", false);
+	}
+	/**
+	* - socks
+	* - socks4
+	*/
+	get "dns.proxy.type"() {
+		return this._tryGetStringValue("dns.proxy.type", "socks");
+	}
+	get "dns.proxy.host"() {
+		return this._tryGetStringValue("dns.proxy.host", "");
+	}
+	get "dns.proxy.port"() {
+		return this._tryGetStringValue("dns.proxy.port", "");
+	}
+	get "dns.jsdns.autoResetServerAlive"() {
+		return this._tryGetBoolValue("dns.jsdns.autoResetServerAlive", false);
+	}
+	get "dns.libunbound.path"() {
+		return this._tryGetStringValue("dns.libunbound.path",
+			"extensions/dnssec@nic.cz/plugins/ub_ds_windows-x86.dll");
+	}
+	get "dns.libunbound.path.relToProfileDir"() {
+		return this._tryGetBoolValue("dns.libunbound.path.relToProfileDir", true);
+	}
+	//#endregion
+
+	////////////////////////////////////////////////////////////////////////////
+	//#region Policy preferences
+	////////////////////////////////////////////////////////////////////////////
+
+	get "policy.signRules.enable"() {
+		return this._tryGetBoolValue("policy.signRules.enable", false);
+	}
+	get "policy.signRules.checkDefaultRules"() {
+		return this._tryGetBoolValue("policy.signRules.checkDefaultRules", true);
+	}
+	get "policy.signRules.autoAddRule"() {
+		return this._tryGetBoolValue("policy.signRules.autoAddRule", false);
+	}
+	get "policy.signRules.autoAddRule.onlyIfFromAddressInSDID"() {
+		return this._tryGetBoolValue("policy.signRules.autoAddRule.onlyIfFromAddressInSDID", true);
+	}
+	/**
+	 * - 0: from address
+	 * - 1: subdomain
+	 * - 2: base domain
+	 */
+	get "policy.signRules.autoAddRule.for"() {
+		return this._tryGetNumberValue("policy.signRules.autoAddRule.for", 0);
+	}
+	get "policy.signRules.sdid.allowSubDomains"() {
+		return this._tryGetBoolValue("policy.signRules.sdid.allowSubDomains", true);
+	}
+	get "policy.signRules.error.wrong_sdid.asWarning"() {
+		// pref("extensions.dkim_verifier.error.policy.wrong_sdid.asWarning", false);
+		return this._tryGetBoolValue("policy.signRules.error.wrong_sdid.asWarning", false);
+	}
+
+	get "policy.DMARC.shouldBeSigned.enable"() {
+		return this._tryGetBoolValue("policy.DMARC.shouldBeSigned.enable", false);
+	}
+	/**
+	 * - none
+	 * - quarantine
+	 * - reject
+	 */
+	get "policy.DMARC.shouldBeSigned.neededPolicy"() {
+		return this._tryGetStringValue("policy.DMARC.shouldBeSigned.neededPolicy", "none");
+	}
+	//#endregion
+
+	////////////////////////////////////////////////////////////////////////////
+	//#region Display preferences
+	////////////////////////////////////////////////////////////////////////////
+
+	/**
+	 * -  0:  never
+	 * - 10:  when an e-mail with a valid DKIM signature is viewed  (SUCCESS)
+	 * - 20:  when an e-mail with a valid DKIM signature is viewed (including TEMPFAIL) (SUCCESS, TEMPFAIL)
+	 * - 30:  when an e-mail with a DKIM signature is viewed (SUCCESS, TEMPFAIL, PERMFAIL, loading)
+	 * - 40:  when an e-mail is viewed
+	 * - 50:  when a message is viewed
+	 */
+	get "showDKIMHeader"() {
+		return this._tryGetNumberValue("showDKIMHeader", 30);
+	}
+	/**
+	 * -  0:  never
+	 * - 10:  when an e-mail with a valid DKIM signature is viewed  (SUCCESS)
+	 * - 20:  when an e-mail with a valid DKIM signature is viewed (including TEMPFAIL) (SUCCESS, TEMPFAIL)
+	 * - 30:  when an e-mail with a DKIM signature is viewed (SUCCESS, TEMPFAIL, PERMFAIL, loading)
+	 * - 40:  when an e-mail is viewed
+	 * - 50:  when a message is viewed
+	 */
+	get "showDKIMStatusbarpanel"() {
+		return this._tryGetNumberValue("showDKIMStatusbarpanel", 0);
+	}
+	/**
+	 * - 1:  text
+	 * - 2:  icon
+	 */
+	get "statusbarpanel.result.style"() {
+		return this._tryGetNumberValue("statusbarpanel.result.style", 1);
+	}
+	/**
+	 * -  0:  never
+	 * - 10:  when an e-mail with a valid DKIM signature is viewed  (SUCCESS)
+	 * - 20:  when an e-mail with a valid DKIM signature is viewed (including TEMPFAIL) (SUCCESS, TEMPFAIL)
+	 * - 30:  when an e-mail with a DKIM signature is viewed (SUCCESS, TEMPFAIL, PERMFAIL, loading)
+	 * - 40:  when an e-mail is viewed
+	 * - 50:  when a message is viewed
+	 */
+	get "showDKIMFromTooltip"() {
+		return this._tryGetNumberValue("showDKIMFromTooltip", 0);
+	}
+
+	get "colorFrom"() {
+		return this._tryGetBoolValue("colorFrom", false);
+	}
+	get "color.success.text"() {
+		return this._tryGetStringValue("color.success.text", "windowtext");
+	}
+	get "color.success.background"() {
+		return this._tryGetStringValue("color.success.background", "#00FF00");
+	}
+	get "color.warning.text"() {
+		return this._tryGetStringValue("color.warning.text", "windowtext");
+	}
+	get "color.warning.background"() {
+		return this._tryGetStringValue("color.warning.background", "orange");
+	}
+	get "color.permfail.text"() {
+		return this._tryGetStringValue("color.permfail.text", "windowtext");
+	}
+	get "color.permfail.background"() {
+		return this._tryGetStringValue("color.permfail.background", "red");
+	}
+	get "color.tempfail.text"() {
+		return this._tryGetStringValue("color.tempfail.text", "unset");
+	}
+	get "color.tempfail.background"() {
+		return this._tryGetStringValue("color.tempfail.background", "unset");
+	}
+	get "color.nosig.text"() {
+		return this._tryGetStringValue("color.nosig.text", "unset");
+	}
+	get "color.nosig.background"() {
+		return this._tryGetStringValue("color.nosig.background", "unset");
+	}
+
+	get "display.favicon.show"() {
+		return this._tryGetBoolValue("display.favicon.show", true);
+	}
+
+	get "display.keySecure"() {
+		return this._tryGetBoolValue("display.keySecure", true);
+	}
+	//#endregion
+
+	////////////////////////////////////////////////////////////////////////////
+	//#region Other preferences
+	////////////////////////////////////////////////////////////////////////////
+
+	get "debug"() {
+		return this._tryGetBoolValue("debug", false);
+	}
+	/**
+	 * - Fatal
+	 * - Error
+	 * - Warn
+	 * - Info
+	 * - Config
+	 * - Debug
+	 * - Trace
+	 * - All
+	 */
+	get "logging.console"() {
+		return this._tryGetStringValue("logging.console", "Debug");
+	}
+	//#endregion
+}
+
+/**
+ * Preference implementation backed by a simple Object.
+ * Used for testing only.
+ */
+export class ObjPreferences extends BasePreferences {
+	constructor() {
+		super(
+			(name) => { return this._prefs[name]; },
+			(name, value) => { this._prefs[name] = value; return Promise.resolve(); },
+		);
+		/** @type {Object.<string, boolean|number|string|undefined>} */
+		this._prefs = {};
+	}
+}
+
+/**
+ * Preference implementation backed by browser.storage.local.
+ * Keeps itself in sync with the storage.
+ */
+export class StorageLocalPreferences extends BasePreferences {
+	constructor() {
+		const checkInitialized = () => {
+			if (!this._isInitialized) {
+				throw new Error("StorageLocalPreferences is not yet initialized");
+			}
+		};
+		super(
+			(name) => {
+				checkInitialized();
+				return this._prefs[name];
+			},
+			(name, value) => {
+				checkInitialized();
+				this._prefs[name] = value;
+				const promise = browser.storage.local.set({ preferences: this._prefs });
+				promise.catch(error => log.fatal("Storing preferences in browser.storage.local failed", error));
+				return promise;
+			},
+		);
+		this._isInitialized = false;
+		/** @type {Object.<string, boolean|number|string|undefined>} */
+		this._prefs = {};
+	}
+
+	async init() {
+		if (this._isInitialized) {
+			return;
+		}
+		const { preferences } = await browser.storage.local.get("preferences");
+		if (preferences) {
+			this._prefs = preferences;
+		}
+		browser.storage.onChanged.addListener((changes, areaName) => {
+			if (areaName !== "local") {
+				return;
+			}
+			const prefChange = changes.preferences;
+			if (prefChange) {
+				this._prefs = Object.assign({}, prefChange.newValue);
+			}
+		});
+		this._isInitialized = true;
+	}
+
+	clear() {
+		this._prefs = {};
+		const promise = browser.storage.local.set({ preferences: this._prefs });
+		promise.catch(error => log.fatal("Storing preferences in browser.storage.local failed", error));
+		return promise;
+	}
+}
+
+const prefs = new StorageLocalPreferences();
+export default prefs;
+
+////////////////////////////////////////////////////////////////////////////////
+// account specific options
+////////////////////////////////////////////////////////////////////////////////
+
+// 0: default, 1: yes, 2: no
+// pref("mail.server.default.dkim_verifier.dkim.enable", 0);
+// pref("mail.server.default.dkim_verifier.arh.read", 0);
+
+// empty to allow all
+// pref("mail.server.default.dkim_verifier.arh.allowedAuthserv", "");
diff --git a/test/Readme.md b/test/Readme.md
index 5af4b9fe..714d7ed2 100644
--- a/test/Readme.md
+++ b/test/Readme.md
@@ -4,6 +4,11 @@ The unit test are written with [Mocha](https://mochajs.org/) and [Chai](https://
 
 ## Running unit tests in a browser
 
+> **Note**:
+> The unit test do currently not have a fake implementation of the storage API.
+> Instead they use a preference implementation that differs from the one
+> actually used in the add-on.
+
 Because of *CORS* opening the runner html page directly from the file system does not work.
 A HTTP server is needed instead.
 
@@ -22,6 +27,11 @@ node node_modules/http-server/bin/http-server .
 
 ## Running unit test in Node
 
+> **Note**:
+> As the Web Crypto API is not available in Node,
+> the crypto implementation used differs from the one
+> actually used in the add-on.
+
 ```PowerShell
 # Install dependencies
 npm install --save-dev mocha
@@ -30,7 +40,9 @@ npm install --save-dev chai
 # https://github.com/mochajs/mocha/pull/4038
 npm install --save-dev esm
 
+npm install --save-dev sinon
+npm install --save-dev webextensions-api-fake
+
 # Run tests
-node node_modules/jasmine/bin/jasmine
-node node_modules/mocha/bin/mocha --recursive
+node node_modules/mocha/bin/mocha --recursive --reporter dot
 ```
diff --git a/test/helpers/initWebExtensions.mjs.js b/test/helpers/initWebExtensions.mjs.js
new file mode 100644
index 00000000..5554e85b
--- /dev/null
+++ b/test/helpers/initWebExtensions.mjs.js
@@ -0,0 +1,36 @@
+/**
+ * Copyright (c) 2020 Philippe Lieser
+ *
+ * This software is licensed under the terms of the MIT License.
+ *
+ * The above copyright and license notice shall be
+ * included in all copies or substantial portions of the Software.
+ */
+
+// @ts-check
+
+import prefs from "../../modules/preferences.mjs.js";
+
+export let hasWebExtensions = false;
+/** @type {import("webextensions-api-fake/dist").BrowserFake} */
+export let fakeBrowser;
+
+before(async function () {
+	try {
+		const { default: browserFake } = await import("webextensions-api-fake");
+		// workaround for https://github.com/stoically/webextensions-api-fake/issues/4
+		if (browserFake.default) {
+			fakeBrowser = browserFake.default();
+		} else {
+			fakeBrowser = browserFake();
+		}
+		// @ts-ignore
+		globalThis.browser = fakeBrowser;
+		hasWebExtensions = true;
+	} catch (e) {
+		// Ugly workaround for running tests for modules that use the global prefs in the browser
+		prefs._valueGetter = (name) => { return prefs._prefs[name]; };
+		prefs.init = () => { return Promise.resolve(); };
+		prefs.clear = () => { prefs._prefs = {}; return Promise.resolve(); };
+	}
+});
diff --git a/test/unittest/SpecRunner.html b/test/unittest/SpecRunner.html
index 5b42e948..ff841044 100644
--- a/test/unittest/SpecRunner.html
+++ b/test/unittest/SpecRunner.html
@@ -21,6 +21,7 @@
     </script>
     <script type="module" src="cryptoSpec.mjs.js"></script>
     <script type="module" src="utilsSpec.mjs.js"></script>
+    <script type="module" src="preferencesSpec.mjs.js"></script>
     <script type="module" src="msgParserSpec.mjs.js"></script>
     <script type="module" src="verifierSpec.mjs.js"></script>
     <script type="module" class="mocha-exec">
diff --git a/test/unittest/preferencesSpec.mjs.js b/test/unittest/preferencesSpec.mjs.js
new file mode 100644
index 00000000..231dd980
--- /dev/null
+++ b/test/unittest/preferencesSpec.mjs.js
@@ -0,0 +1,361 @@
+/**
+ * Copyright (c) 2020 Philippe Lieser
+ *
+ * This software is licensed under the terms of the MIT License.
+ *
+ * The above copyright and license notice shall be
+ * included in all copies or substantial portions of the Software.
+ */
+
+// @ts-check
+///<reference path="../../WebExtensions.d.ts" />
+/* eslint-env webextensions */
+
+import { fakeBrowser, hasWebExtensions } from "../helpers/initWebExtensions.mjs.js";
+import prefs, { ObjPreferences, StorageLocalPreferences } from "../../modules/preferences.mjs.js";
+import expect from "../helpers/chaiUtils.mjs.js";
+
+describe("preferences [unittest]", function () {
+	/** @type {import("../../modules/preferences.mjs.js").BasePreferences} */
+	let pref;
+
+	before(async function () {
+		pref = hasWebExtensions ? prefs : new ObjPreferences();
+		await pref.init();
+	});
+
+	beforeEach(async function () {
+		await pref.clear();
+	});
+
+	describe("getValue", function () {
+		it("get string", function () {
+			expect(
+				pref.getValue("dns.nameserver")
+			).to.be.equal("8.8.8.8");
+		});
+		it("get number", function () {
+			expect(
+				pref.getValue("error.algorithm.rsa.weakKeyLength.treatAs")
+			).to.be.equal(2);
+		});
+		it("get bool", function () {
+			expect(
+				pref.getValue("policy.signRules.enable")
+			).to.be.false;
+		});
+		it("throw if not exist", function () {
+			expect(
+				() => pref.getValue("policy.xxx")
+			).to.throw;
+			expect(
+				() => pref.getValue("policy.xxx.yyy")
+			).to.throw;
+			expect(
+				() => pref.getValue("policy.signRules")
+			).to.throw;
+			expect(
+				() => pref.getValue("policy.signRules.xxx")
+			).to.throw;
+			expect(
+				() => pref.getValue("policy.signRules")
+			).to.throw;
+		});
+	});
+	describe("getBool/getNumber/getString", function () {
+		it("get string", function () {
+			expect(
+				pref.getString("dns.nameserver")
+			).to.be.equal("8.8.8.8");
+		});
+		it("get number", function () {
+			expect(
+				pref.getNumber("error.algorithm.rsa.weakKeyLength.treatAs")
+			).to.be.equal(2);
+		});
+		it("get bool", function () {
+			expect(
+				pref.getBool("policy.signRules.enable")
+			).to.be.false;
+		});
+		it("throw if not exist", function () {
+			expect(
+				() => pref.getBool("policy.xxx")
+			).to.throw;
+			expect(
+				() => pref.getNumber("policy.xxx.yyy")
+			).to.throw;
+			expect(
+				() => pref.getString("policy.signRules")
+			).to.throw;
+		});
+		it("throw if unexpected type", function () {
+			expect(
+				() => pref.getBool("dns.proxy.type")
+			).to;
+			expect(
+				() => pref.getNumber("dns.proxy.type")
+			).to;
+			expect(
+				() => pref.getBool("error.algorithm.rsa.weakKeyLength.treatAs")
+			).to;
+			expect(
+				() => pref.getString("error.algorithm.rsa.weakKeyLength.treatAs")
+			).to;
+			expect(
+				() => pref.getNumber("display.favicon.show")
+			).to;
+			expect(
+				() => pref.getString("display.favicon.show")
+			).to;
+		});
+	});
+	describe("getter access", function () {
+		it("get string", function () {
+			expect(
+				pref["dns.nameserver"]
+			).to.be.equal("8.8.8.8");
+		});
+		it("get number", function () {
+			expect(
+				pref["error.algorithm.rsa.weakKeyLength.treatAs"]
+			).to.be.equal(2);
+		});
+		it("get bool", function () {
+			expect(
+				pref["policy.signRules.enable"]
+			).to.be.false;
+		});
+		it("throw if not exist", function () {
+			expect(
+				// @ts-ignore
+				() => pref["policy.xxx"]
+			).to.throw;
+			expect(
+				// @ts-ignore
+				() => pref["policy.xxx.yyy"]
+			).to.throw;
+			expect(
+				// @ts-ignore
+				() => pref["policy.signRules"]
+			).to.throw;
+			expect(
+				// @ts-ignore
+				() => pref["policy.signRules.xxx"]
+			).to.throw;
+			expect(
+				// @ts-ignore
+				() => pref["policy.signRules"]
+			).to.throw;
+		});
+	});
+	describe("set value", function () {
+		it("getter access after setting", function () {
+			expect(
+				pref["display.favicon.show"]
+			).to.be.true;
+			pref.setValue("display.favicon.show", false);
+			expect(
+				pref["display.favicon.show"]
+			).to.be.false;
+			pref.setValue("display.favicon.show", true);
+			expect(
+				pref["display.favicon.show"]
+			).to.be.true;
+		});
+		it("set string", function () {
+			pref.setValue("dns.nameserver", "foo");
+			expect(
+				pref["dns.nameserver"]
+			).to.be.equal("foo");
+			pref.setValue("dns.nameserver", "bar");
+			expect(
+				pref["dns.nameserver"]
+			).to.be.equal("bar");
+		});
+		it("set number", function () {
+			expect(
+				pref["error.algorithm.rsa.weakKeyLength.treatAs"]
+			).to.be.equal(2);
+			pref.setValue("error.algorithm.rsa.weakKeyLength.treatAs", 3);
+			expect(
+				pref["error.algorithm.rsa.weakKeyLength.treatAs"]
+			).to.be.equal(3);
+			pref.setValue("error.algorithm.rsa.weakKeyLength.treatAs", 1);
+			expect(
+				pref["error.algorithm.rsa.weakKeyLength.treatAs"]
+			).to.be.equal(1);
+		});
+		it("set bool", function () {
+			expect(
+				pref["display.favicon.show"]
+			).to.be.true;
+			pref.setValue("display.favicon.show", false);
+			expect(
+				pref["display.favicon.show"]
+			).to.be.false;
+			pref.setValue("display.favicon.show", true);
+			expect(
+				pref["display.favicon.show"]
+			).to.be.true;
+		});
+		it("getValue after setting", function () {
+			expect(
+				pref.getValue("display.favicon.show")
+			).to.be.true;
+			pref.setValue("display.favicon.show", false);
+			expect(
+				pref.getValue("display.favicon.show")
+			).to.be.false;
+			pref.setValue("display.favicon.show", true);
+			expect(
+				pref.getValue("display.favicon.show")
+			).to.be.true;
+		});
+		it("throw if not exist", function () {
+			expect(
+				() => pref.setValue("policy.xxx", 1)
+			).to.throw;
+			expect(
+				() => pref.setValue("policy.xxx.yyy", true)
+			).to.throw;
+			expect(
+				() => pref.setValue("policy.signRules", "foo")
+			).to.throw;
+			expect(
+				() => pref.setValue("policy.signRules.xxx", 2)
+			).to.throw;
+			expect(
+				() => pref.setValue("policy.signRules", false)
+			).to.throw;
+		});
+		it("throw if unexpected type", function () {
+			expect(
+				() => pref.setValue("dns.nameserver", 1)
+			).to;
+			expect(
+				() => pref.setValue("dns.nameserver", true)
+			).to;
+			expect(
+				() => pref.setValue("error.algorithm.rsa.weakKeyLength.treatAs", "foo")
+			).to;
+			expect(
+				() => pref.setValue("error.algorithm.rsa.weakKeyLength.treatAs", true)
+			).to;
+			expect(
+				() => pref.setValue("display.favicon.show", "foo")
+			).to;
+			expect(
+				() => pref.setValue("display.favicon.show", 2)
+			).to;
+		});
+	});
+	describe("storage", function () {
+		before(function () {
+			if (!hasWebExtensions) {
+				// eslint-disable-next-line no-invalid-this
+				this.skip();
+			}
+		});
+
+		beforeEach(function () {
+			fakeBrowser.storage.local.clear.resetHistory();
+			fakeBrowser.storage.local.get.resetHistory();
+			fakeBrowser.storage.local.set.resetHistory();
+		});
+
+		it("store and load prefs to/from storage", async function () {
+			pref.setValue("dns.nameserver", "fooBar");
+			expect(
+				fakeBrowser.storage.local.set.calledOnceWithExactly(
+					{ preferences: { "dns.nameserver": "fooBar" } })
+			).to.be.true;
+			const loadedPref = new StorageLocalPreferences();
+			await loadedPref.init();
+			expect(
+				fakeBrowser.storage.local.get.callCount
+			).to.be.equal(1);
+			expect(
+				loadedPref["dns.nameserver"]
+			).to.be.equal("fooBar");
+		});
+		it("clear storage", async function () {
+			await browser.storage.local.set({ someStorage: "this should not be cleared by prefs" });
+
+			pref.setValue("dns.nameserver", "fooBar");
+			expect(
+				pref["dns.nameserver"]
+			).to.be.equal("fooBar");
+
+			// clearing prefs should not affect other storage
+			pref.clear();
+			expect(
+				fakeBrowser.storage.local.set.lastCall.calledWithExactly(
+					{ preferences: {} })
+			).to.be.true;
+			expect(
+				pref["dns.nameserver"]
+			).to.be.equal("8.8.8.8");
+			expect(
+				(await browser.storage.local.get("someStorage")).someStorage
+			).to.be.equal("this should not be cleared by prefs");
+
+			// loading new prefs after clear should have defaults again
+			const loadedPref = new StorageLocalPreferences();
+			await loadedPref.init();
+			expect(
+				loadedPref["dns.nameserver"]
+			).to.be.equal("8.8.8.8");
+		});
+		it("pref should change on storage update", async function () {
+			const pref2 = new StorageLocalPreferences();
+			await pref2.init();
+			// setting option on global pref object
+			pref.setValue("dns.nameserver", "fooBar");
+			fakeBrowser.storage.onChanged.addListener.yield({
+				preferences: {
+					oldValue: pref2._prefs,
+					newValue: pref._prefs,
+				}
+			}, "local");
+			// should sync it to local pref object
+			expect(
+				pref2["dns.nameserver"]
+			).to.be.equal("fooBar");
+
+			// setting option on local pref object
+			pref2.setValue("dns.nameserver", "muh");
+			fakeBrowser.storage.onChanged.addListener.yield({
+				preferences: {
+					oldValue: pref._prefs,
+					newValue: pref2._prefs,
+				}
+			}, "local");
+			// should sync it to global pref object
+			expect(
+				pref["dns.nameserver"]
+			).to.be.equal("muh");
+		});
+		it("other storage changes are ignored", function () {
+			pref.setValue("dns.nameserver", "fooBar");
+			fakeBrowser.storage.onChanged.addListener.yield({
+				preferences: {
+					oldValue: pref._prefs,
+					newValue: {},
+				}
+			}, "sync");
+			expect(
+				pref["dns.nameserver"]
+			).to.be.equal("fooBar");
+			fakeBrowser.storage.onChanged.addListener.yield({
+				preferencesX: {
+					oldValue: pref._prefs,
+					newValue: {},
+				}
+			}, "local");
+			expect(
+				pref["dns.nameserver"]
+			).to.be.equal("fooBar");
+		});
+	});
+});
diff --git a/test/unittest/verifierSpec.mjs.js b/test/unittest/verifierSpec.mjs.js
index 68dd61aa..7c377b25 100644
--- a/test/unittest/verifierSpec.mjs.js
+++ b/test/unittest/verifierSpec.mjs.js
@@ -11,6 +11,7 @@
 /* eslint no-unused-vars: ["error", { "varsIgnorePattern": "VerifierModule" }]*/
 
 import "../helpers/fetchKey.mjs.js";
+import "../helpers/initWebExtensions.mjs.js";
 import Verifier, * as VerifierModule from "../../modules/dkim/verifier.mjs.js";
 import MsgParser from "../../modules/msgParser.mjs.js";
 import expect from "../helpers/chaiUtils.mjs.js";