The topic Windows 11 has a built-in DNS over HTTPS mode most people never turn on, and… is currently the subject of lively discussion — readers and analysts are keeping a close eye on developments.
This is taking place in a dynamic environment: companies’ decisions and competitors’ reactions can quickly change the picture.
Every time I dig through Windows 11’s network settings, I feel like I have discovered a new one. Last week, I was chasing down a random LAN disconnect issue and had reset all network settings to reconfigure everything. That’s when I noticed an option called DNS over HTTPS, which I had missed before.
Turns out Windows 11 supports encrypting DNS natively since launch. Only the setting was tucked away, so most people never bother to enable it. After spending time configuring encrypted DNS on the router and self-hosted resolvers, I realized that Windows 11 itself has a built-in switch for that. That was a good enough reason to dig in.
A DNS lookup request translates the domain name you type into an IP address before your PC can connect to anything. This happens before the HTTPS handshake with the site itself, and it traditionally occurs on port 53. So, the request itself isn’t encrypted even if the site you’re visiting is. Anyone positioned between your PC and that DNS server can see exactly which domains you’re resolving. That could be your ISP, someone on the same Wi-Fi network, or a compromised router. That said, they can’t see what you’re doing once you’ve opened the site.
DNS over HTTPS changes that. It hides the same DNS request inside an encrypted connection, so it travels over port 443 instead of port 53. Anyone monitoring your traffic just sees a regular HTTPS connection to your DNS provider. They can’t tell which sites you’re actually resolving.
What caught me off guard is that Windows 11 has this built in already. DNS over HTTPS was tested in Windows 10, but it required registry edits with no interface access. It arrived officially with Windows 11. Surprisingly, this option wasn’t on by default. So if you’ve never touched it, and you go looking for it, expect it to be off.
You can enable DNS over HTTPS from the Network & Internet section of the Settings app. You need to click the connection (Wi-Fi or Ethernet) you’re using, then go to the DNS server assignment and click Edit. Switch the DNS server assignment from Automatic to Manual and toggle IPv4 on. Next, you can add your preferred and alternate DNS servers.
Under each DNS server, use the drop-down for DNS over HTTPS and select On (Automatic Template), which applies the correct settings for that provider. Note that the dropdown only appears when Windows recognizes the DNS server as DoH-capable. Windows has hardcoded templates for DNS servers from Cloudflare, Google, and Quad9. If you use any other provider, the dropdown to use a template won’t appear.
You can still add a third-party DNS provider’s DoH template into Windows and use it. for example, you can add NextDNS’s DoH template on Windows 11 using PowerShell (run it as Administrator) with a single cmdlet (Set-DnsClientDohServerAddress). After that, when you use the NextDNS IPs, the dropdown will appear to select the relevant template.
One thing worth checking after enabling is whether it’s actually working, rather than assuming the toggle encrypts DNS queries. Cloudflare hosts a browser-based check at https://1.1.1.1/help that tells you whether your DNS queries are encrypted and which resolver is handling them. I ran it right after switching over to Cloudflare DNS servers, and it confirmed that DoH was active.
You’ll also want to make sure you turn off the Fall back to plaintext toggle. That’s because Windows won’t warn you if a DoH handshake fails and reverts to unencrypted lookups.
I assumed that using DNS over HTTPS might add noticeable overhead with every DNS lookup. TLS handshakes cost real time, and DNS is supposed to be a fast, forgettable step before the real connection takes place. Switching between tabs or opening new sites felt a bit sluggish initially.
After a while, I couldn’t point out the sluggishness. It all comes down to DNS caching. Once a domain is resolved, my Windows 11 PC doesn’t re-query it on every request. That overhead only showed up the first time I opened a new site. It’s small enough that a week’s worth of use didn’t reveal any downsides.
Enabling DoH is great for an encrypted DNS experience, but it also affects a few things on your network. VPNs with split-tunneling can cause encrypted DNS queries to be routed outside the tunnel. That defeats the point of running a VPN. It’s best to check how a VPN client handles DNS before you assume that the DoH setting in Windows works as expected.
At the router level, parental controls and content filters inspect the plain DNS traffic on port 53. But with DoH, the PC sends encrypted queries over port 443 instead, and that traffic slips right past those filters that weren’t meant to look inside HTTPS connections. Even corporate networks need to manage or restrict DoH through group policy for exactly this reason.
But for home usage, it’s totally worth it. If something depending on DNS inspection suddenly stops behaving normally, you can check this DoH setting in Windows first. There’s no downside, since you can spend a minute choosing between Cloudflare, Google, Quad9, or adding another provider using PowerShell to stop your ISP from reading your DNS queries.
Elevate your self-hosting journey with a DNS server that suits your needs.
The DNS over HTTPS feature ships with Windows 11, but Microsoft hasn’t exactly made it easy to discover. It’ll take you a few clicks to dig deep into the network settings page, where most people never venture unless something’s already broken. That’s exactly how I discovered it. Turning it on takes less than five minutes, and you’ll probably forget that the feature is even on. Once turned on, the feature works and incurs no additional daily cost.