How to enable DNS over HTTPS in Windows 11

DNS over HTTPS (DoH) encrypts your DNS lookups so your ISP can't see which sites you visit. Windows 11 supports it natively for Google, Cloudflare, and Quad9.

DNS over HTTPS (DoH) wraps your DNS lookups in an encrypted connection. This stops your ISP and anyone on your network from seeing which websites you look up, or from swapping in a fake address.

Choose a DNS provider that supports DoH in Windows 11

The Windows 11 DNS over HTTPS feature only works with a few DNS services.

To check which providers Windows 11 supports, open Windows Terminal (right-click the Start button, then click Windows Terminal) and run: netsh dns show encryption

The DNS services supported by Windows 11 are Google DNS, Cloudflare DNS, and Quad9 DNS.

Here's the list of supported IPv4 DNS service addresses:

• Google DNS primary: 8.8.8.8
• Google DNS secondary: 8.8.4.4
• Cloudflare DNS primary: 1.1.1.1
• Cloudflare DNS secondary: 1.0.0.1
• Quad9 DNS primary: 9.9.9.9
• Quad9 DNS secondary: 149.112.112.112

Here's the list of supported IPv6 DNS service addresses:

• Google DNS primary: 2001:4860:4860::8888
• Google DNS secondary: 2001:4860:4860::8844
• Cloudflare DNS primary: 2606:4700:4700::1111
• Cloudflare DNS secondary: 2606:4700:4700::1001
• Quad9 DNS primary: 2620:fe::fe
• Quad9 DNS secondary: 2620:fe::9

Pick one provider from the list above. You'll enter its primary and secondary addresses for both IPv4 and IPv6 in the steps below.

Enable DNS over HTTPS in Windows 11

1. Right-click the Start button (the Windows logo at the bottom of the screen).
2. Click Settings.
   
3. Click Network & internet in the left menu.
4. Click Wi-Fi (if you are on Wi-Fi) or Ethernet (if you are plugged in with a cable).
   
5. Click Hardware properties.
   
6. Click the Edit button next to DNS server assignment.
   
7. In the DNS dialog that opens, select Manual from the drop-down menu.
   
8. Turn on the IPv4 toggle.
9. In the Preferred DNS field, type the primary address for your chosen provider (for example, 8.8.8.8 for Google or 1.1.1.1 for Cloudflare).
10. In the DNS over HTTPS dropdown, select On (automatic template).
11. In the Alternate DNS field, type the secondary address (for example, 8.8.4.4 for Google or 1.0.0.1 for Cloudflare).
12. In the DNS over HTTPS dropdown, select On (automatic template).
    
13. Turn on the IPv6 toggle.
14. In the Preferred DNS field, type the IPv6 primary address (for example, 2001:4860:4860::8888 for Google).
15. In the DNS over HTTPS dropdown, select On (automatic template).
16. In the Alternate DNS field, type the IPv6 secondary address (for example, 2001:4860:4860::8844 for Google).
17. In the DNS over HTTPS dropdown, select On (automatic template).
    
18. Click Save.

Back on the Hardware properties page, you should see (Encrypted) next to each DNS server. That confirms DoH is active.

Related:

Windows

References:

https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/