guide · static export
Security

Turn On DNS over HTTPS in Windows 11

Encrypt your lookups so the local network cannot read them: the built-in DoH client, which resolvers support it, and how to prove it works.

by@guidox updated:10/31/26 time:15 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 11 tools:PowerShell as administrator, Windows 11 22H2 or newer
TL;DR

Set a DoH-capable resolver in the adapter's DNS settings, switch **DNS encryption** to *Encrypted only*, and confirm with `netsh dns show encryption` that the template is active.

Before you start

Requirements

  • Windows 11 22H2 or newer
  • Admin rights
  • Fifteen minutes
Step by step

Instructions

01

Set the resolver by hand

Automatic DNS from the router cannot be encrypted, because the router does not advertise a DoH template. Manual IPv4 entries are the starting point.

Settings > Network & internet > Ethernet > DNS server assignment > Edit > Manual
02

Switch encryption on

The dropdown next to the resolver holds three states. Encrypted only refuses plain DNS entirely, which is the strongest setting and the most brittle one.

DNS over HTTPS > Encrypted only
⚠ warningCaptive portals in hotels and cafes resolve through plain DNS. Use Encrypted preferred while travelling.
03

Add a template the UI does not know

Windows only offers encryption for resolvers with a known template. The command adds one, after which the dropdown works for that address.

netsh dns add encryption server=1.1.1.1 dohtemplate=https://cloudflare-dns.com/dns-query autoupgrade=yes udpfallback=no
04

Read back the configured templates

The list shows which resolvers have a template, whether they upgrade automatically, and whether a UDP fallback exists. An empty template column means the resolver stays plain.

netsh dns show encryption
tipudpfallback=no is what makes Encrypted only meaningful; with a fallback, a blocked HTTPS path drops to port 53.
05

Prove traffic is really encrypted

Block plain DNS outbound and resolve a name. If the lookup still succeeds, the client is using HTTPS; if it fails, Windows is still on port 53.

New-NetFirewallRule -DisplayName BlockPlainDns -Direction Outbound -Protocol UDP -RemotePort 53 -Action Block
06

Remove the test rule

The block is a diagnostic, not a setting to keep: some applications bring their own resolver and will look broken while the rule exists.

Remove-NetFirewallRule -DisplayName BlockPlainDns
⚠ warningIf names stopped resolving between the two steps, the encryption is not active; check the template list again.
Troubleshooting

Common issues

Pages stop loading after the switch

The resolver has no template or a captive portal intercepted the lookup. Set Encrypted preferred and reconnect.

The encryption dropdown is missing

The build is older than 22H2, or no template is known. Run the netsh add first, then reopen the page.

The company VPN breaks

The tunnel pushes its own DNS servers, which have no DoH template. Use the VPN resolver unencrypted or split DNS.

Browsing feels slower on the first page

A new resolver starts with a cold cache. Compare two lookups with Measure-Command around Resolve-DnsName.

FAQ

Frequently asked

Does this hide which sites I visit?

It hides the lookup from the local network. The TLS handshake still names the server, and the resolver itself sees every query.

What about IPv6?

The template is per address. Add the AAAA resolver as well or turn IPv6 off on that adapter.

How to undo this

Set DNS server assignment back to Automatic (DHCP) and remove the template with netsh dns delete encryption server=1.1.1.1. Delete the firewall rule if a copy of it survived.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress