How to Configure Encrypted DNS with Fallback Rules in Windows 11 Using PowerShell

Traditional Domain Name System (DNS) queries are transmitted across networks in unencrypted plaintext over UDP port 53. This makes domain lookups vulnerable to eavesdropping, man-in-the-middle tampering, and ISP DNS redirection. DNS over HTTPS (DoH) resolves these vulnerabilities by encrypting DNS queries inside standard TLS sessions over port 443. Windows 11 natively integrates DoH into its networking core, allowing network administrators to configure strict encryption or flexible fallback modes using PowerShell.

Understanding Windows 11 Encrypted DNS Modes

Windows 11 supports three distinct encryption states for network adapters:

• Encrypted Only (Strict): The operating system requires that every DNS query be transmitted via DoH. If the secure DNS server is unreachable or fails cryptographic verification, lookups fail completely without transmitting unencrypted queries.
• Encrypted Preferred (Fallback Allowed): Windows attempts to transmit queries via DoH. If the secure server is unresponsive, the network stack falls back to standard plaintext DNS over UDP port 53.
• Unencrypted Only: Standard legacy plaintext DNS resolution.

Checking Known DoH Resolvers in Windows 11

Windows maintains a built-in table of trusted DNS over HTTPS templates (such as Cloudflare, Google, and Quad9). To view registered resolvers via PowerShell:

Get-DnsClientDohServerAddress

If you use a private enterprise DoH resolver (e.g., Pi-hole, AdGuard Home, or an internal DNS proxy), add it to the system table first:

# Register a custom internal DoH endpoint:
Add-DnsClientDohServerAddress -ServerAddress "192.168.1.1" -DohTemplate "https://dns.internal.lan/dns-query" -AllowFallbackToUdp $true -AutoUpgrade $true

Configuring Encrypted DNS on Network Adapters

To assign DNS addresses and enable DoH on your active network interface:

1. Right-click the Start button on Windows 11 and select Terminal (Admin) or PowerShell (Admin).
2. Identify your primary network adapter name:

   Get-NetAdapter | Where-Object {$_.Status -eq "Up"} | Select-Object Name, InterfaceDescription

3. Set primary and secondary DNS server IP addresses (e.g., Cloudflare 1.1.1.1 and 1.0.0.1):

   Set-DnsClientServerAddress -InterfaceAlias "Wi-Fi" -ServerAddresses ("1.1.1.1", "1.0.0.1")

4. Configure encryption settings using Set-DnsClientDohServerAddress or netsh:

   # Enforce Encrypted Only (Strict DoH, no plaintext fallback):
   Set-DnsClientDohServerAddress -ServerAddress "1.1.1.1" -DohTemplate "https://cloudflare-dns.com/dns-query" -AllowFallbackToUdp $false -AutoUpgrade $true
   Set-DnsClientDohServerAddress -ServerAddress "1.0.0.1" -DohTemplate "https://cloudflare-dns.com/dns-query" -AllowFallbackToUdp $false -AutoUpgrade $true

5. If you prefer resilient fallback on public Wi-Fi or hotel captive portals, set -AllowFallbackToUdp $true.

Verifying Active DoH Encryption

To confirm that your DNS queries are actively encrypted:

1. In PowerShell, clear the local DNS resolver cache:

   Clear-DnsClientCache

2. Perform a query while monitoring network packets, or visit an encrypted DNS diagnostic portal such as 1.1.1.1/help or Cloudflare’s ECH/DoH test page.
3. Verify that the diagnostics indicate Using DNS over HTTPS (DoH): Yes.

Deploying DNS over HTTPS with PowerShell hardens Windows 11 network security, preventing DNS snooping and establishing cryptographic integrity across enterprise connections.