Microsoft’s Windows 11 has quietly packed a powerful privacy control for years, but a fresh guide from How-To Geek is putting the spotlight back on a feature most users never touch: DNS over HTTPS. Built directly into the operating system, it encrypts the domain-name lookups that your ISP would otherwise see in plaintext, yet many people mistake it for a full VPN or assume it’s already active.
The Encryption Already Sitting Inside Your PC
DNS over HTTPS, or DoH, works by taking the traditional DNS request—“where is example.com?”—and wrapping it inside the same encrypted HTTPS channel your browser uses for secure websites. Instead of sending that request unencrypted over port 53, Windows shoots it out over port 443, where it blends in with all the other encrypted traffic leaving your machine. A network observer can’t pick it out as a DNS query.
The catch? Microsoft never enabled it by default. The capability has been present since Windows 10 build 19628 and has carried through every release of Windows 11, but you have to actively configure a DoH-compatible DNS server in your network settings to benefit from it. As of July 2026, the operating system recognizes three public providers out of the box: Cloudflare (1.1.1.1 and 1.0.0.1), Google (8.8.8.8 and 8.8.4.4), and Quad9 (9.9.9.9 and 149.112.112.112).
What the Privacy Shield Doesn’t Cover
DoH encrypts only the lookup step, not the browsing that follows, a distinction that often gets muddled in popular coverage. After your PC resolves a domain, it still connects to the resulting IP address, and your internet provider can see that you’re communicating with that address, how much data flows, and when the sessions happen. Similarly, if a website doesn’t use HTTPS for the actual content, the page data remains visible. DoH also does not hide your device’s public IP address, mask your location, or tunnel application traffic the way a VPN does.
Moving your DNS queries from your ISP’s resolver to a third-party provider involves a trust shift, not a disappearance of trust. Cloudflare says it deletes all logs within 24 hours, Quad9 blocks known malicious domains and keeps no personal data, and Google logs some information for 24 to 48 hours. You are effectively choosing which organization receives a record of every domain your PC looks up.
Who Should Flip the Switch (and Who Absolutely Shouldn’t)
Home users on standalone PCs stand to gain the most. Enabling DoH with a reputable resolver stops the local network operator—whether that’s a nosy ISP or the owner of the coffee-shop Wi-Fi—from reading the names of sites you visit through DNS traffic. Combined with always-on HTTPS, it significantly raises the cost of casual snooping.
Power users need to check for one common overlap: web browsers. Chrome, Edge, and Firefox all have their own Secure DNS toggles. If a browser is set to use Google’s resolver, for example, while Windows is pointed at Cloudflare, the browser’s traffic follows its own rule and ignores the OS setting. That’s not a bug, but it can cause confusion when troubleshooting. Similarly, if you run a local DNS-based ad blocker or content filter (such as Pi-hole), enabling DoH on the PC without pointing it at the filter will bypass that protection entirely, because the encrypted query never reaches the local device.
IT administrators should not instruct employees to manually switch corporate machines to public resolvers. Managed environments depend on internal DNS for directory services, split-DNS scenarios, web filtering, and security monitoring. Pointing a domain-joined Windows 11 device at 1.1.1.1 can break access to intranet applications and remove a layer of threat detection. Enterprises that want encrypted DNS should configure it through Group Policy, Microsoft Intune, or Windows’ own DNS client commands, pointing devices to an organizational resolver that supports DoH.
From Plaintext to Padlock: How We Got Here
Traditional DNS has sent queries in the clear since the protocol’s inception, long before pervasive surveillance and data collection motivated privacy engineering. The first practical fixes appeared in the 2010s: DNSCrypt and then DNS-over-TLS, which encrypted the transport. DNS over HTTPS arrived as a formal standard in 2018 with RFC 8484, championed by browser vendors and public-resolver operators who wanted DNS to inherit the encryption guarantees already standard on the web.
Microsoft brought native DoH support to Windows 10 Insider builds in mid-2020, and the feature shipped in the Windows 10 21H2 update. Windows 11 launched with the same capability, but the setting remains off unless a user manually changes the DNS configuration. In the years since, Microsoft has expanded the list of recognized resolvers and added Group Policy controls for organizations, yet the feature has never been front and center—hence the periodic resurgences of how-to articles reminding people it’s there.
The July 2026 piece from How-To Geek is the latest nudge, and it’s a timely one: as unencrypted DNS increasingly looks like an anomalous holdover even as data-privacy regulations tighten worldwide, many people still don’t realize the setting exists.
Step-by-Step: How to Lock Down Your DNS in Windows 11
Enabling DoH takes about two minutes and doesn’t require any downloads.
- Open Settings → Network & internet.
- Click your active connection: Wi-Fi or Ethernet.
- Find DNS server assignment and click Edit.
- Switch from Automatic (DHCP) to Manual.
- Toggle IPv4 on.
- In the Preferred DNS and Alternate DNS fields, enter one of these pairs:
- Cloudflare:1.1.1.1/1.0.0.1
- Google:8.8.8.8/8.8.4.4
- Quad9:9.9.9.9/149.112.112.112 - Under each address, open the DNS over HTTPS dropdown and choose On (automatic template).
- Click Save.
After saving, you can verify the encryption is active by visiting Cloudflare’s browser test at 1.1.1.1/help; it will display “DNS over HTTPS: Yes” if the configuration worked.
What if you use a provider like NextDNS or Control D, or your organization runs its own DoH resolver? You’ll need to add an explicit DoH template via PowerShell because those addresses aren’t on Microsoft’s automatic list. For instance, to set NextDNS as a DoH server:
Add-DnsClientDohServerAddress -ServerAddress '45.90.28.0' -DohTemplate 'https://dns.nextdns.io/abcdef' -AllowFallbackToUdp $false -AutoUpgrade $true
Then manually enter that IP in the settings UI as described above. The template string must match exactly what your provider supplies.
If a site suddenly refuses to load after you make the change, flip the DNS assignment back to Automatic briefly to confirm whether the new resolver is at fault. And remember to repeat these steps on each Windows 11 device you use; the setting is per-machine, not network-wide.
The Road Ahead
DNS encryption is slowly becoming the default rather than an opt-in oddity. Both Android and iOS can use DNS over HTTPS or DNS over TLS when configured, and browsers continue to push their own secure-DNS settings. Microsoft’s Windows roadmap, as glimpsed through Insider builds, shows ongoing work to make encrypted DNS more discoverable and eventually possibly default for users on recognized safe networks. Regulatory pressure, particularly from Europe’s GDPR and similar frameworks, may accelerate that shift.
For now, the main takeaway is straightforward: Windows 11’s DNS over HTTPS is a real, built-in privacy boost that closes one long-standing data leak, but it’s not a cloak of invisibility. Flip it on if you’re on a personal machine and want to keep your ISP’s eyes off your domain lookups. Just don’t mistake it for a VPN.