How to enable DNS over HTTPS (DoH) in Windows 11 and improve your privacy

Informatec Digital » Resources » How to enable DNS over HTTPS (DoH) in Windows 11 and improve your privacy

If you're increasingly concerned about what others can see of your online activity , Windows 11 has a powerful setting that almost no one uses but can make a big difference to your privacy: DNS encryption using DNS over HTTPS (DoH). With a couple of configuration changes, your DNS requests will no longer travel in plain text but will be protected within a secure connection.

Enabling DoH in Windows 11 doesn't require installing any unusual programs or being a networking expert; it's something you can configure in just a few minutes through system settings. In return, you'll make it much harder for your internet service provider, public network administrators, or even potential attackers to spy on the websites you visit, record your browsing habits , or manipulate your connections . Let's take a closer look at what DoH is, why it's worthwhile, how to activate it step by step, and what advanced options are available within the Windows ecosystem.

What is DNS and why does it affect your privacy so much?

When you type an address like adslzone.com or any other website into your browser , your computer doesn't connect directly using that text. What the network actually understands are numerical IP addresses, so before loading the website, it has to query a DNS server to find out where that domain is hosted.

The DNS works like a kind of internet phone book : you enter a name and it returns the corresponding number (IP address). The problem is that, in the default configuration, this query travels unencrypted, in plain text. This means that any device between your PC and the internet—your internet service provider, a public Wi-Fi hotspot, a compromised router, an attacker on the same network—can see the addresses you're resolving.

Furthermore, many providers take advantage of this situation to generate a very detailed history of all the websites you visit . This is extremely sensitive information because it allows them to profile you as a user: what services you use, what your interests are, what your schedule is, etc. This data can be used for advertising, sold to third parties, or, in the worst-case scenario, end up in the hands of malicious actors.

It's also important to note that, without encryption, certain entities can block websites at the DNS level , redirect domains to advertising sites, or even manipulate responses to launch attacks. All of this is done by taking advantage of the fact that traditional DNS traffic travels in plain text and without guaranteed integrity.

What is DNS over HTTPS (DoH) and what advantages does it have?

DNS over HTTPS, or DoH, is a system that takes traditional DNS requests and encapsulates them within an encrypted HTTPS connection . It's the same type of encryption used when you visit a secure website with a padlock icon in your browser, but applied to the channel your computer uses to resolve domain names.

With DoH enabled, DNS queries are no longer easily visible to anyone in the way. All they'll see is encrypted HTTPS traffic to the DNS provider's server . They won't be able to read which domains are being queried, nor modify the response without compromising the connection's security.

Among the main advantages of enabling DNS over HTTPS in Windows 11, several stand out: firstly, your internet service provider can no longer easily view or record your entire domain history; secondly, it greatly complicates the interception or manipulation of requests by third parties . Furthermore, in some cases, it can help you bypass certain basic DNS-level blocks implemented by some providers.

It's worth noting that encryption introduces a small extra step to each request, but in practice, the performance loss is usually minimal or imperceptible to most users. In return, the improvement in privacy and security is considerable, so the overall benefit is generally well in favor of enabling it.

How to enable DNS over HTTPS (DoH) in Windows 11 step by step

Windows 11 includes native support for DNS over HTTPS, so you don't need external programs. The process boils down to two parts: manually configuring DoH-compatible DNS servers and then choosing the type of encryption you want to use for those servers.

1. Access the Windows 11 network settings

The first step is to open the System Settings app. The quickest way is to press the Windows key + I simultaneously. You can also do this from the Start menu, but the shortcut is more convenient if you plan to repeat it multiple times.

In Settings, go to the "Network & Internet" section . There you'll see options for both Wi-Fi and Ethernet (wired) connections. Choose the one you're currently using: if you're browsing over Wi-Fi, tap "Wi-Fi"; if you're using a wired connection, tap "Ethernet".

Once in the relevant section, locate your active connection and click on "Hardware Properties" or the entry that displays the network details. From there, you can modify the IP and DNS settings for that specific interface.

2. Change the DNS assignment to manual

In your connection properties, you'll see a section called "DNS Server Assignment" . It's usually set to "Automatic (DHCP)," which means your router or internet service provider decides which DNS server you use and how those requests are handled.

Click the "Edit" button in that section. A pop-up window will open where you should select the "Manual" option from the settings dropdown. This change allows you to specify which DNS servers you want to use instead of accepting the ones assigned by the network.

In the manual configuration, enable the IPv4 switch and, if your network supports it, also enable the IPv6 switch. Most home connections work perfectly with IPv4, but IPv6 is becoming increasingly common, so it's advisable to enable it if available so that queries can also be made using that protocol.

3. Choose DNS servers that are compatible with DoH

Once manual mode is enabled, you'll see fields to enter the IP addresses of the DNS servers. This is where you need to enter the details of a provider that officially supports DNS over HTTPS , since Windows 11 includes an internal Windows list of known DoH servers.

Some of the most commonly used ones, already included in Windows' internal list for automatic encryption configuration, are the following:

• Cloudflare1.1.1.1 as the preferred DNS and 1.0.0.1 as the alternate DNS. They also have IPv6 addresses 2606:4700:4700::1111 and 2606:4700:4700::1001.
• Google Public DNS8.8.8.8 as the preferred server and 8.8.4.4 as the alternate. In IPv6 they use 2001:4860:4860::8888 and 2001:4860:4860::8844.
• Quad99.9.9.9 is the preferred address and 149.112.112.112 is the alternate. In IPv6, they have, among others, 2620:fe::fe and 2620:fe::fe:9.

Enter, for example, the Google or Cloudflare addresses in the Preferred DNS and Alternate DNS fields for IPv4. If you also have IPv6 enabled, fill in the corresponding fields with the IPv6 addresses of your chosen provider. From there, Windows 11 will know that these servers support DoH and will be able to offer you the various encryption options.

4. Configure DNS encryption (DoH) in Windows 11

Just below the DNS addresses for each protocol, you'll find one or more encryption-related options, depending on your version of Windows 11 and the type of server you've configured. This is where you can enable DNS over HTTPS and configure how your computer will handle these queries.

In many configurations, Windows displays a " DNS Encryption " or "DNS over HTTPS" menu for the preferred and alternate DNS servers. Here you might find, among other options, the following:

• Encryption only (DNS over HTTPS)The client will always attempt to use DoH with that server. If the server or the secure connection fails, the plaintext query will not be executed.
• Encryption preferred, no encryption allowed (or similar text): DoH is first attempted and, if that is not possible, classic queries without encryption are reinstated.
• Unencrypted only: disables DoH for that specific server, using only traditional plaintext DNS.

If privacy is your priority and you want to go all out, select "Encrypted only (DNS over HTTPS)" for both your preferred and alternate servers . This way, all DNS traffic to those servers will always travel over HTTPS and never in plain text.

In some interface texts, you may also see the option "Enabled (automatic template) ." This indicates that Windows 11 recognizes the server as part of its list of known DoH resolvers and automatically uses the appropriate HTTPS template to send encrypted requests, without you having to specify it manually.

5. Use manual DoH templates with specific vendors

For some servers, or if you want even finer control, you may find it possible to use a manual DNS template over HTTPS . This allows you to directly specify the URL that your provider uses for its DoH service.

This is the case, for example, with certain advanced Quad9 configurations, where you can specify a particular template that includes options like ECS (EDNS Client Subnet) so that resolutions are handled from the data center closest to your location . In that template field, you enter something like the URL that the provider documents for their DoH endpoint.

If you choose the manual template option, be sure to copy the address exactly as provided by the DNS service in its official documentation. A typo could cause the encryption to fail or prevent the domains from resolving altogether.

How to check if DNS over HTTPS is working

Once you've saved the changes to your connection settings, DNS requests should normally be encrypted. Even so, it's worth doing a couple of checks to make sure everything has been applied correctly and that you're not still browsing in plain text without realizing it.

Verification from within Windows settings

Go back to Settings > Network & Internet > Wi-Fi or Ethernet (depending on which one you're using) and access your connection's hardware properties again. Scroll down to the section where the DNS server addresses you just configured are displayed.

If everything is in order, next to each DNS server IP address you should see a label such as "(Encrypted)" or similar text . This label is the quickest way to confirm that Windows has recognized the server as DoH-compliant and is encrypting the queries.

Check DoH with PowerShell

Another very reliable way to check the status of DNS over HTTPS is to use PowerShell , the advanced Windows console. To do this, open the Start menu, search for "PowerShell ," right-click, and select "Run as administrator" to obtain the necessary permissions.

In the window that opens, type the following command and press Enter :

Get-DnsClientDohServerAddress

The output of this command will show a list of DoH servers that the Windows DNS client knows , including the ones you've configured. You'll see their IP addresses and a status indicator. If "Enabled" appears for your configured DNS servers, it means your computer is using DoH with them.

Use online tests to confirm encryption

As an additional check, you can use test pages offered by some DNS providers. For example, Cloudflare has online tools that let you see if your browser is using DNS over HTTPS or DNS over TLS . Simply access one of these pages from your usual browser and follow the instructions.

Although these tests focus on the browser, they are a good reference to complement what you have seen in the Windows settings and in PowerShell, confirming that the queries leave encrypted from your system.

DNS over HTTPS in Windows Server 2022 and Group Policy

In addition to Windows 11, Microsoft has incorporated support for DNS over HTTPS in Windows Server starting with version 2022. On these systems, the DNS client can establish encrypted connections using HTTPS to servers that are on its list of known DoH resolvers, similar to how it works in the desktop environment.

In Windows Server with desktop experience, basic configuration is done from the same Settings > Network & Internet > Ethernet panel . You select the network interface to configure, enter its network screen, scroll down to "DNS Settings," and click "Edit" to change the mode from automatic to manual, just like in Windows 11.

From there, you enter DNS servers that are on the list of known DoH servers . If they are, the "Preferred DNS encryption" dropdown will be enabled, from which you can choose between several behaviors:

• Encryption only (DNS over HTTPS)All DNS queries are attempted using DoH. If the server does not support DoH or the HTTPS connection fails, the resolution will also fail.
• Preferred and unencrypted ciphers are supportedDoH is prioritized, but if for some reason it is not possible, it reverts to unencrypted plaintext DNS queries.
• Unencrypted onlyDoH is disabled for that server and only traditional DNS is used.

When you configure Windows Server DNS addresses using PowerShell and the cmdlet Set-DnsClientServerAddressThe DoH behavior depends on whether those addresses They appear or do not appear in the internal table of known DoH serversAt this time, that specific DoH configuration cannot yet be adjusted with Windows Admin Center nor with tools like sconfig.cmd on Server 2022.

Configure DoH using group policy

Configuración del equipo\Directivas\Plantillas administrativas\Red\Cliente DNS

By enabling this policy , you can choose between three main behaviors for the DNS client:

• Allow DoHQueries will be made using DNS over HTTPS when the configured DNS servers support it. If they do not support it, unencrypted queries will be used.
• Ban DoH: prevents the use of DNS over HTTPS, always forcing traditional plaintext DNS.
• Require DoH: forces all queries to be made with DoH; if the servers do not accept it, name resolution fails.

It's important to be cautious with the "Require DoH" option on domain-joined computers because Active Directory services rely heavily on traditional DNS, and the Windows DNS Server role doesn't natively support DoH queries. In these types of networks, if you want to protect internal DNS traffic, it's usually better to use solutions like IPsec- based connection security rules to encrypt traffic between clients and servers.

List of known DoH servers on Windows

Both Windows 11 and Windows Server include a built-in list of DNS servers known to support DoH . This list allows the system to automatically enable encryption options and automatic templates for those specific servers.

To see which servers are on that list, you can use the cmdlet Get-DnsClientDohServerAddress in PowerShell. Among the most common providers that appear are Cloudflare, Google and Quad9, with their most well-known IPv4 and IPv6 addresses, such as the already mentioned 1.1.1.1, 8.8.8.8 or 9.9.9.9 along with their alternatives.

If you want to add a new server to that known server table, for example your own resolver or one from a specialized third party, you can use the command Add-DnsClientDohServerAddress specifying the server IP address, the DoH template, and whether or not you allow reverting to UDP in case of failure:

Add-DnsClientDohServerAddress -ServerAddress "<IP-del-resolvedor>" -DohTemplate "<URL-plantilla-DoH>" -AllowFallbackToUdp $False -AutoUpgrade $True

In this way, Windows will know that the server supports DoH, will always try to use it securely and, depending on the option chosen, will avoid returning to unencrypted queries as much as possible.

Using the NRPT (Name Resolution Policy Table) with DoH

In advanced scenarios, such as complex corporate networks or hybrid configurations, you can use the Name Resolution Policy Table (NRPT) to forward queries for specific domains to designated DNS servers. If those servers support Domain-based DNS (DoH) and are registered as such, queries for those namespaces will be made using DNS over HTTPS.

This allows, for example, certain critical or particularly sensitive domains to always be resolved through a trusted resolver with DoH enabled, while the rest of the DNS traffic can follow a different policy or use different servers.

Enabling and leveraging DNS over HTTPS in Windows 11—and, where applicable, in Windows Server 2022—is a fairly simple way to increase the privacy and security of your daily browsing without drastically changing how you use your computer. With a few configuration steps and some extra checks, your DNS queries will no longer be that vulnerable point anyone could see in plain text, but will instead travel protected within an encrypted connection, much more in line with what's expected of a secure connection today.