How to Configure Windows Sandbox Local DNS Over HTTPS (DoH) via XML in Windows 11

When analyzing suspicious URLs, testing untrusted software payloads, or auditing network tracking domains, standard unencrypted DNS queries expose query metadata to local network eavesdroppers and ISP logging. By default, Windows Sandbox inherits unencrypted DNS configuration from the host virtual network adapter. Enforcing DNS over HTTPS (DoH) inside the sandbox ensures that all domain resolution occurs over encrypted TLS connections to privacy-respecting DNS resolvers (such as Cloudflare or Quad9). This guide details how to configure DoH in Windows Sandbox using WSB XML files and PowerShell logon scripting.

The Architecture of Windows 11 Native DoH

Windows 11 includes native support for DNS over HTTPS within its internal DNS Client service (dnscache). Rather than configuring third-party DNS proxy daemons, DoH can be configured directly via netsh dns commands or PowerShell’s Set-DnsClientServerAddress and Set-DnsClientDohServerAddress cmdlets. Automated logon commands in a .wsb XML file allow you to provision these encrypted resolution templates upon guest launch.

Structuring Host Folders and Assets

Create a dedicated configuration directory on your Windows 11 host (for example, C:\SandboxDoH):

C:\SandboxDoH\
├── Enable-DoH.ps1
└── DoH_Sandbox.wsb

Authoring the Automated DoH Provisioning Script

Save the following PowerShell script as C:\SandboxDoH\Enable-DoH.ps1. This script identifies the active guest network interface, sets the resolver IP addresses, and enables DoH encryption templates:

# Enable-DoH.ps1 - Automated Windows Sandbox DoH Configuration
Write-Host "Configuring DNS over HTTPS (DoH) inside Windows Sandbox..." -ForegroundColor Cyan

# 1. Identify active sandbox network adapter
$Adapter = Get-NetAdapter | Where-Object { $_.Status -eq "Up" } | Select-Object -First 1

if (-not $Adapter) {
    Write-Error "No active network adapter detected in Sandbox."
    Exit 1
}

$InterfaceIndex = $Adapter.InterfaceIndex

# 2. Set DNS Servers to Cloudflare Privacy Resolvers (1.1.1.1 and 1.0.0.1)
Set-DnsClientServerAddress -InterfaceIndex $InterfaceIndex -ServerAddresses ("1.1.1.1", "1.0.0.1")

# 3. Configure and Enforce DoH Encryption Template via Netsh
# netsh dns add encryption server=1.1.1.1 dohtemplate=https://cloudflare-dns.com/dns-query autoupgrade=yes
netsh dns add encryption server=1.1.1.1 dohtemplate="https://cloudflare-dns.com/dns-query" autoupgrade=yes udpfallback=no | Out-Null
netsh dns add encryption server=1.0.0.1 dohtemplate="https://cloudflare-dns.com/dns-query" autoupgrade=yes udpfallback=no | Out-Null

# 4. Flush existing DNS cache
Clear-DnsClientCache

Write-Host "DoH configured and enforced on adapter $($Adapter.Name)." -ForegroundColor Green
Write-Host "Resolver: 1.1.1.1 (Template: https://cloudflare-dns.com/dns-query)" -ForegroundColor Yellow

Creating the WSB Configuration File

Create DoH_Sandbox.wsb to mount the assets folder and execute the setup script upon logon:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxDoH</HostFolder>
      <SandboxFolder>C:\SandboxAssets</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\SandboxAssets\Enable-DoH.ps1</Command>
  </LogonCommand>
</Configuration>

Running and Auditing Encrypted DNS Traffic

1. Double-click DoH_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up, mounts C:\SandboxDoH, and initiates the PowerShell script.
3. The script locks the DNS resolver to 1.1.1.1 and enforces encrypted HTTPS query templates with zero UDP fallback.
4. Open Microsoft Edge inside the sandbox and navigate to https://one.one.one.one/help to confirm that “Using DNS over HTTPS (DoH)” displays “Yes”.
5. Close the sandbox window when testing is complete. All networking settings and transient caches vanish completely.