Microsoft packed Windows 11 with a free, system-wide privacy shield that clamps down on one of the web’s oldest listening posts — and it’s sitting inside your network settings right now, likely switched off. A fresh wave of attention around the feature, spurred by a recent MakeUseOf report, makes it clear that ordinary users still overlook DNS over HTTPS, even though it takes less than five minutes to turn on and works across every app on the machine.

The Leak Nobody Talks About: Your DNS Requests Are an Open Book

Every time you open a website, your PC first asks a Domain Name System server to translate the human-friendly address into a numeric IP address. That handshake, called a DNS query, was invented decades ago when the internet was a smaller, friendlier place. Security didn’t enter the design brief. The query travels in plain text — unencrypted — across your home network, your ISP’s infrastructure, and any intermediate hops. Anyone with a privileged view can read it.

An ISP can compile a list of every service you consult: news outlets, banking portals, streaming platforms, health sites, gaming servers, even the domains pinged by Windows Update or your email client. The same goes for the operator of a coffee-shop hotspot or a hotel Wi-Fi service. The metadata may not contain your message, but it faithfully logs your destinations, creating a detailed pattern of habits, interests, and affiliations.

HTTPS — the padlock in your browser — only secures the contents of a web session after the DNS resolution is complete. Before that tunnel exists, the domain name itself is broadcast like an announcement. Closing that gap is where DNS over HTTPS enters the picture.

What Windows 11 Actually Does: Encrypting the Address Book

DNS over HTTPS, or DoH, wraps each domain lookup inside a standard encrypted HTTPS connection. Other than the IP address of the resolver, the queries become unreadable in transit. The operating system version built into Windows 11 (and earlier into Windows 10 preview builds starting with build 19628) bakes this directly into the network stack. When you flip the right switch, every process — browsers, email programs, game launchers, cloud sync tools, system services, Microsoft Store apps — gets its DNS traffic shielded automatically.

Microsoft’s implementation sits at the correct layer. Browser-level DoH has existed in Chrome, Edge, and Firefox for years, but it only covers lookups generated inside that application. A PC running dozens of online-aware programs leaks through a hundred gaps unless the whole machine is protected. The Windows 11 setting closes the collection in one pass.

How to Enable the Setting in Five Minutes

The path exists entirely within the Settings app, no command line or registry hacking required. The flow:

  1. Open Settings > Network & Internet.
  2. Click Wi-Fi or Ethernet, depending on your connection.
  3. Select your active network’s Hardware properties.
  4. Find DNS server assignment and click the Edit button.
  5. Change the drop‑down from Automatic (DHCP) to Manual.
  6. Toggle on IPv4 and enter the preferred and alternate addresses of a DoH-capable resolver. Three trustworthy options from the MakeUseOf report:
    - Cloudflare: 1.1.1.1 and 1.0.0.1 (fast, privacy-respecting)
    - Google: 8.8.8.8 and 8.8.4.4 (reliable, retains limited diagnostic data)
    - Quad9: 9.9.9.9 and 149.112.112.112 (blocks known malicious domains)
  7. Under each server entry, set DNS over HTTPS to On (Automatic Template). This lets Windows handle the encryption handshake without extra input.
  8. Crucially, switch Fallback to plaintext to Off. If left enabled, Windows can silently revert to unencrypted DNS whenever the encrypted channel stumbles, undoing the whole setup.
  9. If your network uses IPv6 — most modern ISPs do — scroll down, toggle IPv6 on, and fill in the matching addresses for your chosen provider. Cloudflare’s are 2606:4700:4700::1111 and 2606:4700:4700::1001; Quad9’s are 2620:fe::fe and 2620:fe::9. Skip this step and half your lookups may still flow in cleartext.
  10. Hit Save.

Return to the Hardware properties screen. Beside your new DNS addresses, you should see an Encrypted label. That small badge is your confirmation. If it doesn’t appear, double‑check that both the encryption preference and the fallback toggle are set correctly, and that the resolver addresses you entered are DoH‑ready.

What This Means for Different Types of Windows 11 Users

For home users, the change is a rare free lunch. There are no subscriptions, no extra software, and no slowdowns you’ll notice. Laptops that roam between home, office, and public Wi-Fi benefit most, because system‑level DoH travels with the machine and doesn’t depend on a router that you may not control.

For power users and enthusiasts, the setup adds a verifiable privacy layer that complements a VPN rather than replacing it. You do, however, need to be mindful of one conflict: some VPN clients manage their own DNS to prevent leaks. Overriding those settings at the OS level can interfere. Run a quick leak test (several reputable VPN providers offer them online) after configuring everything.

For IT administrators, DoH raises a governance puzzle. Encrypted DNS keeps employees safer on untrusted networks, but it can also blind internal security monitoring that relies on DNS logs. Microsoft supplies policy controls that let organizations permit, require, or block DoH. If your managed devices need to keep DNS traffic visible to your secure web gateway or SIEM, you’ll want to set those policies before users rush to enable the feature on their own.

The Long Road to Encrypted DNS: A Brief History

The original DNS protocol (RFC 1034, 1987) had no encryption; it simply wasn’t a threat model. As the web grew commercial and surveillance advertising took off, ISPs and network operators discovered the value of DNS metadata. The 2017 repeal of the FCC’s broadband privacy rules in the United States removed a barrier that had restricted ISPs from collecting and selling browsing data without consent. Suddenly, DNS snooping wasn’t theoretical — it was a business asset.

Browsers moved first. Mozilla Firefox offered DoH in 2018, Chrome and Edge followed, and VPN services have long used their own encrypted DNS tunnels. But browser‑only protection leaves out every other network‑aware program. Microsoft’s decision to build DoH into the Windows 10 networking layer (and continue it in Windows 11) was the first time an operating system made it a native toggle. Apple’s macOS and iOS have similar capabilities, as does Android, so the feature itself is no longer an experiment. It’s just under‑publicized on Windows.

Make Sure Your Privacy Isn’t Half‑Baked

Pre‑release builds of Windows 11 sometimes hide DoH behind a feature flag, and the final configuration path looks a little different from the Windows 10 interface. The fallback toggle, in particular, has been a moving target across builds. On current stable Windows 11 releases, you’ll find it right beneath the encrypted DNS dropdown. If it’s missing, a newer update may have changed the layout, so search Microsoft’s support site for the latest steps.

IPv6 leaks remain the stealthy gotcha. Many people never think about IPv6 because their router makes it transparent. But if you enabled DoH only for IPv4, your machine will happily resolve domains over unencrypted IPv6 without alerting you. The fix is simple: add the IPv6 server entries and confirm they also display the Encrypted label.

Don’t treat DoH as a substitute for other protections. It hides which sites you visit from passive observers, but it does not conceal your public IP address, encrypt your traffic content (beyond the DNS layer), or stop websites from tracking you with cookies and fingerprinting. For full traffic encryption, you still need HTTPS and, where appropriate, a VPN.

What to Do Now

If you’re reading this on a Windows 11 PC, open Settings and check the hardware properties of your current network connection. If the DNS server assignment still says “Automatic (DHCP),” you’re almost certainly sending unencrypted queries to your ISP’s resolver. Pick one of the three public resolvers above, configure both address families, flip the encryption switch, disable fallback, and verify the label.

For those who manage family devices, consider that phones, game consoles, and smart TVs don’t always offer a system‑wide DoH option. A router that supports encrypted DNS can protect the entire household without per‑device configuration. ASUS, TP‑Link, and several other vendors now offer DoH options in their firmware. Upgrading your router’s DNS settings is an efficient complement to configuring Windows.

Finally, treat this as a habit, not a one‑time task. After major Windows feature updates, revisit the network settings to confirm the Encrypted label still appears and that no new network profile has reverted to automatic. A little vigilance keeps the privacy seal intact.

The Outlook: From Niche Setting to Baseline Expectation

DNS over HTTPS is already on the path from power‑user tweak to default behavior. Windows 11 shows the infrastructure is ready. What’s missing is better discovery: a setup prompt, a privacy scorecard, or even a simple notification after an update that nudges users toward encryption. Microsoft has been cautious about pushing network changes that could break enterprise or parental‑control setups, but as resolver reliability improves and policy controls mature, that caution will likely ease.

The broader industry is moving in one direction. ISPs such as Comcast and Verizon are exploring their own encrypted DNS offerings, partly to stay relevant and partly because customer pressure is growing. Router makers are integrating DoH into setup wizards. The foundation for a world where cleartext DNS is the exception, not the rule, is already laid in Windows 11. The only thing missing is enough users flicking the switch.