Enabling DNS over HTTPS (DoH) on Windows 11

The latest versions of Windows support the DNS over HTTPS (DoH) protocol, which allows domain name resolution (DNS queries) to be performed over an encrypted HTTPS connection. In this article, we’ll look at what the DNS over HTTPS protocol is used for, and how to use it in Windows.

How to Enable DNS over HTTPS from the Windows GUI

Windows 11 and Windows Server 2022 have built-in DNS-over-HTTPS (DoH) support in the DNS client. The client will use DoH to encrypt DNS traffic if you have specified the IP address of the DNS server that supports DoH in the settings of the network adapter.

Use PowerShell to list the IP addresses of public DNS servers that support DoH:

Get-DNSClientDohServerAddress

Specify the IPv4 or IPv6 address of one of these DNS servers in the network interface settings (or the address of an alternative DNS server with DoH support, after you have added it as described below.)

1. Navigate to Settings -> Network & Internet -> Ethernet (or Wi-Fi)
2. DNS traffic is not encrypted in this case.
3. Click the Edit
4. Enter the IP address of the DNS server and select -> On (automatic template) for the DNS over HTTPS parameter.  
5. Save the changes. Now the DNS queries from the computer will be encrypted.

Windows Server 2022 DNS client also supports DoH (however, the DNS Server service itself does not support DoH in this release.).

Specify the DNS server IP address in the network interface settings and enable the Encrypted only (DNS over HTTPS) mode.

DNS over HTTPS Configuration on Windows 11 via Command Prompt

On Windows, you can use the command line interface to enable and configure DNS over HTTPS.

First, add the IP address of the DoH server to the list of known DNS servers. For example, to add Cloudflare Family alternative DNS servers 1.1.1.3 and 1.0.0.3 (used to filter malware and adult content), run:

$DNSServer="1.1.1.3"
Add-DnsClientDohServerAddress -ServerAddress $DNSServer -DohTemplate "https://family.cloudflare-dns.com/dns-query" -AllowFallbackToUdp $False -AutoUpgrade $True

After you register the template for the DoH DNS server, assign that IP as the preferred DNS server in the network interface settings using the following PowerShell command:

Set-DnsClientServerAddress Ethernet0 -ServerAddresses ($DNSServer)

Then enable mandatory use of DNS over HTTPS for the network interface:

$i = Get-NetAdapter -Physical -Name Ethernet0
$s1 = "HKLM:System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\" + $i.InterfaceGuid + "\DohInterfaceSettings\Doh\$DNSServer"
New-Item -Path $s1 -Force | New-ItemProperty -Name "DohFlags" -Value 1 -PropertyType QWORD
Clear-DnsClientCache

Or use a separate GPO setting to enforce using DoH:

1. Open the local GPO editor (gpedit.msc)
2. Navigate to Computer Configuration -> Policies -> Administrative Templates -> Network -> DNS Client section
3. Enable the policy Configure DNS over HTTPS (DoH) name resolution and set the value to Require DoH.

How to verify that DNS over HTTPS works on Windows

To verify that the DNS client is using the encrypted HTTPS (443) protocol for name resolution instead of the default UDP/TCP port 53, use the built-in network traffic capture tool named PktMon.exe.

Remove all current Packet Monitor filters:

pktmon filter remove

Create a new filter for the default DNS port (53):

pktmon filter add -p 53

Start real-time traffic monitoring (traffic will be output to the console):

pktmon start --etw -m real-time

There should be no traffic on port 53 if you have properly configured DNS over HTTPS. This means that all DNS queries are sent in an encrypted HTTPS session (the screenshot below shows the console output with DoH disabled and enabled).

DNS over HTTPS support is implemented in all popular browsers (Google Chrome, Mozilla Firefox, Microsoft Edge, Opera). You can enable DoH support in any of them. This encrypts your browser’s DNS queries (DNS traffic from other apps will still sent as plain text).

DNS over HTTPS and DNS over TLS will cause problems for corporate network administrators by making it more difficult to restrict access to external resources from internal networks.