How to Enable DNS over HTTPS (DoH) in Windows 11 for Encrypted Browsing

Whenever you visit a website, open an application, or connect to an online server, your computer performs a Domain Name System (DNS) query to translate human-readable names like example.com into numeric IP addresses. Under traditional networking protocols, these queries are dispatched in clear, unencrypted plaintext across port 53.

Plaintext DNS allows internet service providers (ISPs), public Wi-Fi hotspot operators, and network eavesdroppers to track every single website you access, even when the subsequent web session is encrypted via HTTPS. Windows 11 includes native, system-wide support for DNS over HTTPS (DoH). DoH wraps your DNS resolution requests in encrypted TLS sessions, safeguarding your browsing privacy across all browsers and desktop applications.

Step 1: Open Network & Internet Settings

Configuring system-level DoH is done directly in Windows 11 Settings:

1. Press Windows + I to open the Settings app.
2. In the left-hand navigation pane, click Network & internet.
3. Select your active connection type: click Wi-Fi (and then click your connected network name) or click Ethernet.

Step 2: Edit DNS Server Assignment

Scroll down through your network adapter properties:

1. Locate the line titled DNS server assignment.
2. Click the Edit button positioned on the far right.
3. In the drop-down menu at the top of the pop-up sheet, change the setting from Automatic (DHCP) to Manual.
4. Toggle the IPv4 switch to On.

Step 3: Enter DoH-Compatible DNS Addresses

Windows 11 only activates encryption when connected to known, verified DoH resolver endpoints:

• Cloudflare DNS:
  • Preferred DNS: 1.1.1.1
  • Alternate DNS: 1.0.0.1
• Google Public DNS:
  • Preferred DNS: 8.8.8.8
  • Alternate DNS: 8.8.4.4
• Quad9 (Malware Blocking):
  • Preferred DNS: 9.9.9.9
  • Alternate DNS: 149.112.112.112

Step 4: Enforce Encrypted DNS Only

Once you enter a supported address into the Preferred DNS field, the DNS encryption dropdown beneath it becomes selectable:

1. Click the DNS encryption drop-down menu and choose Encrypted only (DNS over HTTPS).
2. Repeat the same for Alternate DNS encryption.
3. Click Save.

Your network adapter properties will now display IPv4 DNS servers: 1.1.1.1 (Encrypted). All network lookups originating from Windows 11 are now fully shielded behind HTTPS encryption.