How to Configure DNS over HTTPS (DoH) in Windows 11 Using PowerShell

Every time you browse the web, launch an application, or connect to a cloud service, your computer translates human-readable domain names (such as example.com) into numerical IP addresses. Traditionally, this domain name system (DNS) query traverses the internet as unencrypted, plaintext UDP packets across port 53. This legacy architecture leaves your browsing history vulnerable to passive ISP monitoring, public Wi-Fi eavesdropping, and man-in-the-middle DNS hijacking.

To secure internet traffic against interception, Windows 11 natively integrates DNS over HTTPS (DoH). By wrapping DNS queries inside TLS-encrypted HTTPS sessions over standard port 443, DoH masks your domain lookups within regular web traffic. While the Windows Settings app provides basic toggles, managing DoH via PowerShell allows administrators to register custom secure resolvers, enforce strict encryption without plaintext fallback, and automate deployment across client fleets. In this guide, we walk through configuring DNS over HTTPS in Windows 11 using PowerShell cmdlets.

Understanding Windows 11 DoH Operational Modes

Before applying DNS encryption settings, understanding Windows 11’s three encryption enforcement modes is critical:

DoH Enforcement Mode	Behavior & Security Posture	Plaintext Fallback
Unencrypted Only (Prohibit)	Sends all DNS queries over standard plaintext UDP port 53. Default behavior for legacy environments.	Always Plaintext
Encrypted Preferred (Allow)	Attempts to negotiate a secure TLS session with the DNS resolver. If DoH fails or times out, it falls back to unencrypted port 53.	Permitted (Vulnerable to downgrade attacks)
Encrypted Only (RequireEncryption)	Strict zero-trust mode. Queries must use TLS HTTPS encryption. If the DoH server is unreachable, DNS lookups fail rather than leaking data.	Strictly Blocked

Step 1: Inspecting Known DoH Resolvers in Windows 11

Windows 11 maintains an internal template table of recognized DoH providers. To view which secure servers are natively pre-configured on your system, open an elevated PowerShell prompt:

1. Right-click the Start menu button and choose Terminal (Admin) or PowerShell (Admin).
2. Execute the Get-DnsClientDohServerAddress cmdlet:

   Get-DnsClientDohServerAddress

PowerShell will return the built-in resolver mappings for major public privacy providers, including:

• Cloudflare: 1.1.1.1 and 1.0.0.1 (Template: https://cloudflare-dns.com/dns-query)
• Google: 8.8.8.8 and 8.8.4.4 (Template: https://dns.google/dns-query)
• Quad9: 9.9.9.9 and 149.112.112.112 (Template: https://dns.quad9.net/dns-query)

Step 2: Adding a Custom DoH Resolver Template

If you prefer using a private DNS resolver, an enterprise pi-hole, or services like NextDNS or AdGuard, you must register the IP address and its corresponding DoH template URI before Windows will encrypt queries to it.

For example, to register AdGuard DNS (94.140.14.14):

Add-DnsClientDohServerAddress -ServerAddress "94.140.14.14" `
    -DnsOverHttpsTemplate "https://dns.adguard-dns.com/dns-query" `
    -AllowFallbackToUdp $false `
    -AutoUpgrade $true

Parameter details:

• -ServerAddress: The destination IPv4 or IPv6 resolver address.
• -DnsOverHttpsTemplate: The standard RFC 8484 HTTPS query endpoint.
• -AllowFallbackToUdp $false: Prevents unencrypted UDP leakage if the HTTPS handshake fails.
• -AutoUpgrade $true: Instructs the Windows DNS client to upgrade to HTTPS automatically whenever this IP is assigned.

Step 3: Assigning Secure DNS Addresses to Network Adapters

Once your target DoH resolver is recognized in the template table, configure your active network adapter (such as Wi-Fi or Ethernet) to use those DNS servers.

First, list your active network interface names:

Get-NetAdapter | Select-Object Name, InterfaceDescription, Status

Assign your preferred primary and secondary DNS servers (for instance, Cloudflare’s secure resolvers) to your active adapter:

Set-DnsClientServerAddress -InterfaceAlias "Wi-Fi" -ServerAddresses ("1.1.1.1", "1.0.0.1")

Step 4: Enforcing Strict DoH Encryption

To mandate that Windows 11 strictly encrypts all queries without falling back to plaintext UDP on that adapter, configure the DoH encryption policy via netsh or registry automation:

netsh dns add encryption server=1.1.1.1 dohtemplate=https://cloudflare-dns.com/dns-query autoupgrade=yes udpfallback=no
netsh dns add encryption server=1.0.0.1 dohtemplate=https://cloudflare-dns.com/dns-query autoupgrade=yes udpfallback=no

Setting udpfallback=no guarantees that if an attacker attempts an SSL-strip attack or if a rogue router blocks HTTPS DNS port 443, Windows will refuse to leak plaintext lookups onto the network.

Step 5: Validating Encrypted DNS Operation

To verify that your DNS traffic is successfully encrypted and resolving via HTTPS:

1. Flush your local DNS client resolver cache to clear existing socket memories:

   Clear-DnsClientCache

2. Query a test domain using Resolve-DnsName:

   Resolve-DnsName -Name "cloudflare.com" -Type A

3. Verify in your web browser by navigating to Cloudflare’s diagnostic check at 1.1.1.1/help. The page should confirm that Using DNS over HTTPS (DoH) is marked as Yes.
4. Alternatively, open Wireshark and filter by dns. When performing lookups with DoH enforced, you will observe zero packets captured on UDP port 53, confirming that all DNS queries are encapsulated inside TLS traffic across port 443.