Encrypt DNS lookups with DNS over HTTPS — via Mauro Huculak, Pureinfotech
Hidden settinglow riskNeeds adminWindows 11
Windows 11 can send DNS queries over HTTPS so the network you're on can't see or tamper with the sites you look up. It works out of the box with well-known public resolvers like Cloudflare, Google and Quad9.
Takes effect right away
The easy way
- Settings → Network & internet → Wi-Fi or Ethernet → your connection → DNS server assignment → Edit → Manual.
- Turn on IPv4 and enter a supported resolver (e.g.
1.1.1.1,8.8.8.8or9.9.9.9). On current Windows 11 builds set DNS over HTTPS to On (automatic template) and turn off Fallback to plaintext if you want encryption only; some builds instead show a Preferred DNS encryption list with Encrypted only (DNS over HTTPS) and Encrypted preferred, unencrypted allowed. Save. - To undo, set DNS server assignment back to Automatic (DHCP).
Command
Run in an administrator PowerShell / Terminal window.
Get-DnsClientDohServerAddressUndo
# Read-only: lists the resolvers Windows knows support DoH. Nothing to undo.Encrypted-only (fallback off) means no DNS at all if the server stops answering over HTTPS; allowing fallback silently drops back to plain DNS. Custom DNS replaces your router's, so local names and parental-control DNS may stop working, and encrypted DNS can bypass filtering DNS you set elsewhere. Windows 10 doesn't have this option. Menu wording varies between builds.
Sources
- How to enable DNS over HTTPS (DoH) on Windows 11 — by Mauro Huculak, Pureinfotech
- Secure DNS Client over HTTPS (DoH) — by Microsoft Learn
- Windows 11 security book — DNS security — by Microsoft Learn
- Troubleshoot DNS over HTTPS — Client configuration — by Microsoft Learn
- netsh encryption commands missing on Windows 10 (accepted answer) — by Microsoft Q&A
- Source reviewed
- 2026-11-02
- Link checked
- 2026-11-02
- Tested hands-on
- Not by Oddbyte.Me
Oddbyte.Me hasn't tried this on every Windows build, so keep the undo handy.