Most Windows 11 users are unknowingly broadcasting their browsing habits to anyone on the network—until they flip a single setting. That setting, DNS over HTTPS (DoH), encrypts every domain lookup system-wide, a privacy upgrade that takes less than five minutes to activate and works on virtually any Windows 11 PC. As a recent walkthrough from How-To Geek makes clear, it’s one of the most impactful, low-effort changes you can make.
Why System-Wide Matters More Than Browser Extensions
Browsers like Firefox and Chrome have offered encrypted DNS for years, but they only protect web traffic. Any app that does its own name resolution—games, updaters, system services—still uses plaintext DNS unless you configure the operating system itself. Windows 11 closes that gap.
When you enable DoH at the system level, every query that flows through the Windows DNS client gets encrypted. No extra apps, no VPN required. The OS intercepts all lookups from the moment you connect, whether you’re on Wi-Fi at a café or plugged into Ethernet at home. That means your ISP, network administrator, or a snoop on the same public hotspot can no longer silently log which sites you visit.
The Privacy Equation: What You Gain and Give Up
Encrypting DNS is a powerful defense against passive surveillance and DNS-based attacks. Unencrypted DNS lookups travel in plaintext, visible to every router, switch, and middlebox between you and your destination. DoH wraps those queries inside an HTTPS tunnel, making them indistinguishable from regular web traffic. That stops ISPs from building a history of your browsing, blocks man-in-the-middle tampering that redirects you to phishing sites, and kicks away an easy reconnaissance tool for attackers.
The trade-off is a shift in trust. Instead of your ISP handling DNS, you’re handing your lookup data to a third-party provider like Cloudflare, Google, or Quad9. Each has its own privacy policy and jurisdiction, and not all are equal. Cloudflare’s 1.1.1.1 resolver, for instance, publishes transparency reports and commits to not selling data; Google logs queries temporarily for performance but deletes identifying information after 24–48 hours. If you pick a provider, you need to be comfortable with their practices.
Performance is rarely a concern. Large public resolvers run global anycast networks that can match or beat the responsiveness of many ISP DNS servers. In rare cases, a network appliance or captive portal might expect plaintext DNS and break when DoH is forced. For most home users, though, the change is seamless.
How to Enable DoH in Windows 11
Microsoft baked the feature into Windows 11’s network settings, no command line required. The same steps work for both Wi-Fi and Ethernet adapters.
- Open Settings (Windows + I) and go to Network & internet.
- Click your active connection—Wi-Fi or Ethernet—not the “Properties” at the top.
- Under DNS server assignment, click the Edit button.
- Change the dropdown from “Automatic (DHCP)” to Manual.
- Toggle IPv4 to On. (If your ISP supports IPv6, you can do both, but start with IPv4.)
- In the Preferred DNS field, enter the IP address of your chosen resolver. Popular options:
- Cloudflare: 1.1.1.1 (primary) and 1.0.0.1 (secondary)
- Google Public DNS: 8.8.8.8 and 8.8.4.4
- Quad9: 9.9.9.9 and 149.112.112.112 - In the DNS over HTTPS dropdown directly below, pick On (automatic template). This tries DoH but falls back to unencrypted if the server doesn’t support it—a safe choice for most people. For stricter protection, choose Encrypted only (DNS over HTTPS).
- Repeat for the Alternate DNS field using the secondary address and same encryption setting.
- Click Save.
After saving, Windows annotates the DNS server entries with “(Encrypted)” in the network properties. That’s your visual confirmation the client acknowledged the change.
If you prefer IPv6, toggle that section instead (or in addition), using:
- Cloudflare: 2606:4700:4700::1111 and 2606:4700:4700::1001
- Google: 2001:4860:4860::8888 and 2001:4860:4860::8844
Verifying It’s Working
Beyond the “(Encrypted)” label, you can double-check from PowerShell. Open an elevated prompt and run:
Get-DNSClientDohServerAddress
This lists all configured DoH addresses and the DNS-over-HTTPS templates Windows is using. On some builds, the legacy netsh dns show encryption command also returns encryption status.
A quick practical test: visit a website like Cloudflare’s 1.1.1.1/help or dnsleaktest.com. They’ll report whether your DNS queries are encrypted and which resolver is answering them.
When Things Go Wrong
The DNS encryption dropdown is grayed out. Group Policy or a device management profile may be locking your DNS settings. Check for a “Some settings are managed by your organization” banner. If you’re on a domain-joined machine, your IT department likely controls this.
Sites won’t load after enabling IPv6 DoH. Many home networks still don’t support IPv6 fully. Disable IPv6 in the DNS edit dialog and stick with IPv4 only, or confirm your ISP actually routes IPv6 traffic.
Everything works, then stops. A few networks expect plaintext DNS for captive portals or local name resolution. If you run into trouble at a hotel or office, switch the encryption dropdown to “On (automatic template)” rather than “Encrypted only” so the client can fall back. In stubborn cases, revert to DHCP-assigned DNS for that network.
For Enterprises and Power Users: Group Policy Controls
Organizations running Windows 11 Pro or Enterprise can manage DoH through Group Policy under:
Computer Configuration → Administrative Templates → Network → DNS Client
You find three policy modes:
- Allow DoH – client uses encryption if the configured servers support it.
- Prohibit DoH – encrypted DNS is disabled system-wide.
- Require DoH – name resolution fails unless the DNS server speaks DoH.
Microsoft warns explicitly against using “Require DoH” on domain-joined machines without thorough testing. Active Directory relies heavily on DNS, and many domain services still use unencrypted lookups. A forced DoH policy can break AD replication, authentication, and other critical functions. Instead, use “Allow DoH” and pair it with a managed resolver chain you trust.
IT admins can also push DoH settings via PowerShell using Set-DnsClientServerAddress with the -DnsOverHttps parameter, integrating the change into provisioning scripts or endpoint management tools.
What’s Next for Encrypted DNS
The landscape keeps evolving. Oblivious DoH (ODoH) adds a relay between you and the resolver so no single party sees both your IP address and your query content. It’s a stronger privacy guarantee, but adoption is still limited to a handful of services like Cloudflare’s 1.1.1.1 with a compatible proxy. Expect it to show up in future Windows builds or third-party clients before it becomes a one-click consumer option.
On the enterprise side, Microsoft continues to tighten DoH integration. Recent Windows Server releases mirror the client-side controls, hinting at a future where encrypted DNS is the default for internal and external lookups alike. For now, the takeaway is simple: the biggest privacy boost for the least effort is already sitting in your Windows 11 settings, and it’s time to turn it on.