How to Completely Disable ‘DNS over HTTPS’ (DoH) via Group Policy in Microsoft Edge

DNS over HTTPS (DoH) is a modern networking protocol designed to perform Domain Name System resolution via the HTTPS protocol. By encrypting DNS queries, DoH prevents local network operators, ISPs, and malicious actors on the local segment from eavesdropping on or manipulating DNS requests. While highly beneficial for consumer privacy on untrusted public Wi-Fi networks, DoH creates a massive blind spot for enterprise security architectures. In managed corporate environments, network administrators rely on inspecting plain-text DNS traffic at the firewall or local resolver level to enforce content filtering, block known malware domains (sinkholing), and monitor for data exfiltration. When a browser like Microsoft Edge bypasses the operating system’s local DNS settings and encrypts its queries directly to a third-party DoH provider (like Cloudflare or Google), it completely subverts these critical enterprise network security controls.

This guide explains how to completely disable ‘DNS over HTTPS’ (DoH) via Group Policy in Microsoft Edge, forcing the browser to rely exclusively on the local, unencrypted, and easily monitored DNS resolver provided by the host operating system.

Disable DNS over HTTPS via Group Policy

To enforce a strict configuration that explicitly strips the browser’s ability to use secure DNS resolution and forces fallback to standard port 53 UDP traffic, we must deploy an administrative template.

1. Log into Windows with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge

5. In the right-hand pane, locate the policy named Control how DNS-over-HTTPS is used (internally known as BuiltInDnsClientEnabled).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. Under the Options section, look for the dropdown menu labeled “Configure DNS-over-HTTPS mode”.
9. Explicitly select Disable DNS-over-HTTPS from the list. (By setting this specific value, we instruct the Chromium networking stack to permanently disable the Built-In DNS client, guaranteeing that all resolution requests are handed directly to the host OS and sent in plain text to the DHCP-assigned corporate DNS server).
10. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes modifying the core Chromium networking stack require the browser to restart to instantiate the new DNS resolution pathways.

Close all active instances of Microsoft Edge. To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, launch Microsoft Edge and navigate to edge://settings/privacy. Scroll down to the “Security” section. You will find that the option labeled “Use secure DNS to specify how to lookup the network address for websites” is completely greyed out, locked in the “Off” position, and tagged with a briefcase icon stating “Your browser is managed by your organization.” Microsoft Edge will now unequivocally utilize standard port 53 DNS, ensuring total visibility for your enterprise perimeter firewalls.