How to Enable DNS over HTTPS in Windows 11

What DNS over HTTPS changes — and what it doesn't

Every time you open a site, Windows asks a DNS server to turn the name into an IP address — and classic DNS travels in plaintext, on UDP port 53. Anyone sitting between your PC and the resolver — the hotel Wi-Fi, the office router, the internet provider — can log every single domain you look up, which is a surprisingly complete picture of your day. DoH wraps the same question into an HTTPS connection, so the lookup itself becomes unreadable on the way.

What DoH does not do is anonymity. The resolver you choose — Cloudflare, Google, Quad9 — now sees your lookups instead of your ISP, so you are moving trust, not eliminating it. Websites still see your IP address, and a VPN still encrypts far more than DNS ever could. Think of DoH as closing one specific letterbox that happened to be wide open, not as a disguise.

Enabling DoH with a known resolver

Open Settings → Network & internet, click your active connection (Wi-Fi or Ethernet) to open its properties, find “DNS server assignment” and click Edit. In the dialog, change the mode from Automatic (DHCP) to Manual, switch IPv4 on, type the resolver into “Preferred DNS”, then open “DNS encryption” and choose “Encrypted only”. Save, and the properties page should show the server with an Encrypted badge. If your network uses IPv6, repeat for the IPv6 toggle with the resolver's v6 address.

Windows 11 ships with templates for the big public resolvers, so picking one of them is the zero-effort route. The practical differences are small: speed is nearly identical on a healthy line, and what varies is the logging policy and the extras. Quad9, for instance, filters known malware domains on top of resolving, while Cloudflare promises to purge logs within 24 hours.

• Cloudflare — 1.1.1.1 and 1.0.0.1, IPv6 2606:4700:4700::1111 — logs deleted within 24 hours
• Google Public DNS — 8.8.8.8 and 8.8.4.4, IPv6 2001:4860:4860::8888
• Quad9 — 9.9.9.9 and 149.112.112.112 — blocks malicious domains as a bonus
• Your ISP's servers — usually no DoH template, so encryption options stay greyed out

Custom resolvers, checks and honest caveats

If you want a resolver Windows does not know — a company server or a filtering service — the encryption dropdown will stay on “Unencrypted only” until you teach Windows the template. Run an elevated terminal and add it: netsh dns add encryption server=1.2.3.4 dohtemplate=https://dns.example.com/dns-query autoupgrade=yes udpfallback=no — after that, the Encrypted options appear for that address too. To verify what is active, PowerShell's Get-DnsClientDohServerAddress lists every server with its template and state, and Cloudflare's check page at one.one.one.one/help shows a plain “Using DNS over HTTPS: Yes” when it works.

Two honest caveats before you celebrate. On corporate networks and VPNs, leave DNS alone — the tunnel or the domain policy usually supplies its own resolvers, and overriding them can break internal names. And some antivirus suites intercept DNS locally to filter traffic, which can collide with DoH; if the internet dies right after you flip the switch, reopen the adapter's Edit dialog and set the mode back to Automatic (DHCP). Nothing is lost — you are one toggle away from the old behavior.

Questions and Answers

Read next

All articles · FAQ