What DNS over HTTPS is and how to enable it on Windows 11

You put HTTPS on everything, switch on a VPN sometimes, keep the firewall running. But there's one detail most people forget: every time you type an address into the browser, your device makes a DNS lookup — and that lookup travels in plain text, unencrypted. Your internet provider, the network administrator at the café or on any public Wi-Fi sees exactly which domains you visited. The destination page stays hidden; the domains you looked up don't.

That's where DNS over HTTPS (DoH) comes in. Enabling it takes less than two minutes on Windows 11 and closes one of the internet's oldest and most ignored privacy gaps.

DNS was never designed to be private

The DNS system was created in the 1980s to resolve domain names into IP addresses. Privacy wasn't a design requirement: queries go out in clear text over port 53, with no authentication and no encryption. Any equipment between you and the DNS server — your ISP's router, a compromised Wi-Fi access point, an adversary with network access — can read and potentially manipulate those responses.

Even when site content is encrypted with HTTPS, the history of domains you looked up remains exposed. It's like closing a car window but leaving the hood open: part of the problem is solved, part isn't.

The revelations about mass surveillance programs — like the ones documented in the Snowden case — showed that DNS queries are a classic target for metadata collection.

What is DNS over HTTPS (DoH)?

DoH wraps DNS queries inside ordinary HTTPS connections, using port 443. To any intermediate observer, the traffic looks like a normal web connection — indistinguishable from a request to any HTTPS site. Your internet provider can no longer see which domains you look up; neither can the local network administrator.

Beyond confidentiality, DoH provides integrity: responses arrive authenticated, which makes DNS spoofing attacks — where a malicious server redirects you to a fake site — much harder to pull off.

Which threats does DoH actually protect against?

DoH protects against DNS traffic monitoring by your provider or local network, DNS spoofing attacks and malicious redirects done on compromised routers. It doesn't replace a full VPN (the destination IP is still visible via SNI/QUIC) and doesn't protect against malware installed on the device itself. It's a layer of privacy and integrity, not a complete anonymity solution.

Which DoH providers should you use?

Windows 11 already knows a handful of DoH servers natively. The most recommended:

• Cloudflare (1.1.1.1 / 1.0.0.1) — the fastest public resolver, with an explicit policy of not selling browsing data. Template: https://cloudflare-dns.com/dns-query
• Quad9 (9.9.9.9 / 149.112.112.112) — a non-profit organization that blocks known malicious domains by default. A good option if you want malware filtering. Template: https://dns.quad9.net/dns-query
• Google (8.8.8.8 / 8.8.4.4) — fast and reliable, but Google's business model involves data. Technically secure, less ideal from a privacy standpoint.

For home use, Cloudflare (1.1.1.1) or Quad9 (9.9.9.9) covers both angles well: speed and threat filtering, per documentation confirmed by Cloudflare and Quad9.

How to enable DNS over HTTPS on Windows 11 (graphical interface)

1. Open Settings → Network & internet.
2. Click the active adapter (Wi-Fi or Ethernet).
3. Select Hardware properties.
4. Under DNS server assignment, click Edit.
5. Switch to Manual and turn on IPv4.
6. Enter 1.1.1.1 (preferred) and 1.0.0.1 (alternate) — or the Quad9 IPs.
7. In the DNS over HTTPS field, select On (manual template).
8. Click Save.

The "manual template" option guarantees that if DoH fails, the query doesn't silently fall back to clear-text DNS — it simply fails. For environments where any resolution outage is unacceptable, use "On (automatic template)", which allows a fallback to regular DNS.

Enabling it via PowerShell (for command-line people)

To configure Cloudflare with mandatory DoH via PowerShell (run as Administrator):

# Add the Cloudflare IPs with mandatory DoH
Add-DnsClientDohServerAddress -ServerAddress '1.1.1.1' `
  -DohTemplate 'https://cloudflare-dns.com/dns-query' `
  -AllowFallbackToUdp $False -AutoUpgrade $True

Add-DnsClientDohServerAddress -ServerAddress '1.0.0.1' `
  -DohTemplate 'https://cloudflare-dns.com/dns-query' `
  -AllowFallbackToUdp $False -AutoUpgrade $True

# Check the configuration
Get-DnsClientDohServerAddress

After adding the addresses to Windows' DoH pool, you still need to assign them to the adapter — the cmdlet above only registers the IP→template mapping. The adapter assignment step is done through the graphical interface (step 4 above) or via Set-DnsClientServerAddress.

How to check that DoH is working

Visit 1.1.1.1/help in your browser. Cloudflare's page shows whether the query arrived over DoH. You can also use browserleaks.com/dns to check which resolver is being used.

Is that enough to protect my network?

DoH is an important layer, but not the only one. The home router remains the most critical perimeter: default passwords, outdated firmware and unnecessary open services are classic compromise vectors — it's worth checking the essential Wi-Fi router settings if you haven't already.

At the account level, DoH doesn't replace two-factor authentication: encrypting DNS traffic doesn't stop a weak password from being compromised in a data breach. The layers complement each other.

Enabling DoH takes two minutes and eliminates an entire class of metadata exposure. It's the best cost-benefit ratio there is in home hardening — set it up now and forget it exists.