How to Enable DNS Over HTTPS (DoH) in Windows 11 for Better Privacy

In an increasingly connected world, protecting your online privacy is more important than ever. One crucial step is encrypting your DNS (Domain Name System) requests, the behind-the-scenes process that translates website names (like google.com) into IP addresses your computer understands. By encrypting these requests, you prevent eavesdropping from third parties like your internet service provider (ISP), network administrators, or even governments, safeguarding your browsing history and online activities. Windows 11 offers a built-in solution: DNS over HTTPS (DoH). This guide provides a comprehensive walkthrough on how to enable and configure DoH on your Windows 11 system.

Setting Up DNS over HTTPS Through Windows 11 Settings

The easiest way to start encrypting your DNS traffic is through the Windows 11 Settings app. Here’s how:

1- Open Settings: Press the Windows key + i or right-click the Start button and select “Settings.”

2- Navigate to Network Settings: In the Settings app, click on “Network & Internet” from the left-hand menu.

3- Select Your Connection: Click on your active internet connection (Wi-Fi or Ethernet). Ensure you click the connection name, not the “Properties” shortcut.

4- Access Hardware Properties: On the connection’s properties page, select “Hardware Properties.

5- Edit DNS Server Assignment: Locate “DNS Server Assignment” and click the “Edit” button next to it.

6- Configure Manual DNS: In the dialog box that appears, set the “DNS settings” to “Manual.” Then, enable the “IPv4” switch.

7- Enter Preferred and Alternate DNS Servers: Input the IP addresses of your preferred and alternate DNS servers. Several reputable providers offer DoH:

Google DNS: Preferred: 8.8.8.8, Alternate: 8.8.4.4

Cloudflare DNS: Preferred: 1.1.1.1, Alternate: 1.0.0.1

Quad9 DNS: Preferred: 9.9.9.9, Alternate: 149.112.112.112

For IPv6, enable the “IPv6” switch and enter the corresponding addresses if your network supports it.

Enable DNS over HTTPS: Toggle the “DNS over HTTPS” switch to “On.” This is the crucial step that encrypts your DNS lookups.

Save Your Changes: Click “Save” to apply the settings.

Verify Encryption: Check your connection properties to confirm that your DNS servers are now labeled as “(Encrypted).”

If you encounter any connectivity issues after making these changes, double-check the IP addresses for any typos. Disabling IPv6 DNS in the settings may also help resolve issues if your network doesn’t support it.

Configuring Custom DoH Servers Using PowerShell

Windows 11, by default, only supports DoH for a predefined list of DNS providers. If you wish to use a custom DoH server, you’ll need to register it using PowerShell:

1- Open PowerShell as Administrator: Click the Start menu, type “powershell,” right-click “Windows PowerShell,” and select “Run as administrator.”

2- Add Your Custom DoH Server: Use the following PowerShell command, replacing the placeholders with your DNS provider’s information: 1Add-DnsClientDohServerAddress -ServerAddress 'IP_ADDRESS' -DohTemplate 'https://your-doh-server/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True Replace 'IP_ADDRESS' with the IP address of your custom DNS server and 'https://your-doh-server/dns-query' with the appropriate DoH template URL provided by your DNS provider.

3- Confirm Registered Servers: To view a list of your DoH-enabled servers, run the following command in PowerShell: 1Get-DnsClientDohServerAddress

4- Assign Your Custom Server in Settings: Follow the steps outlined in the first section to assign your custom DoH server in the network connection settings.

Managing DoH Settings via Group Policy

In managed environments or when specific settings are locked, the DoH option in the Settings app might be grayed out. This is typically controlled by Group Policy. Here’s how to configure DoH through Group Policy Editor:

1- Open Group Policy Editor: Press Windows key + R, type gpedit.msc, and press Enter.

2- Navigate to DNS Client Settings: Go to “Computer Configuration” > “Administrative Templates” > “Network” > “DNS Client.”

3- Open Configure DNS over HTTPS Policy: Find the policy called “Configure DNS over HTTPS (DoH) name resolution” and double-click it.

4- Enable and Configure DoH: Set the policy to “Enabled” and choose your preferred mode:

• Unencrypted only: Disables DoH.
• Encrypted preferred, unencrypted allowed: Tries DoH first, falling back to standard DNS if it’s unavailable. This is often the recommended setting.
• Encrypted only (DNS over HTTPS): Requires DoH for all DNS lookups.

5- Apply and Restart: Click “Apply” and then “OK.” Restart your computer for the changes to take effect.

If the DoH policy repeatedly reverts to “Prohibit DoH,” a third-party application (e.g., a VPN client) might be enforcing this setting. Temporarily disabling or uninstalling the conflicting software, or manually removing the registry value HKLMSOFTWAREPoliciesMicrosoftWindows NTDNSClientDoHPolicy after each reboot, can offer a short-term solution. However, the policy will return if the software remains installed.

Browser DNS over HTTPS Settings and Potential Limitations

While enabling DoH at the system level protects most applications, some browsers have their own DoH settings that might override or ignore the system configuration.

• Chrome and Edge: These browsers might default to Google DNS or their own DNS resolver, even if Windows is set to use a different DoH provider. To ensure they use the system DNS settings:
  • Disable the browser’s internal secure DNS option, or set it to “Use system DNS.”
  • In Chrome, you can disable the “Async DNS resolver” at chrome://flags/#enable-async-dns to force it to use Windows DNS settings.
• Firefox: In Firefox, configure DoH settings within the browser, or use the system resolver. set network.trr.mode to 5 in about:config.

Some applications might still bypass system DNS settings and utilize their own resolution methods. However, enabling DoH at the operating system level will encrypt DNS traffic for most standard Windows applications, enhancing your overall privacy.

Conclusion

Implementing DNS over HTTPS in Windows 11 is a simple yet effective way to fortify your online privacy. By encrypting your DNS queries, you prevent unwanted monitoring and increase your security. Regularly check your settings, and be mindful of browser configurations and third-party software that might interfere with your DoH setup. Embrace these steps to take control of your data and browse the web with greater peace of mind.