{"id":21841,"date":"2026-07-10T12:46:15","date_gmt":"2026-07-10T11:46:15","guid":{"rendered":"https:\/\/innovatenews.site\/index.php\/2026\/07\/10\/windows-11-has-a-built-in-dns-over-https-mode-most-people-never-turn-on-and\/"},"modified":"2026-07-10T12:46:25","modified_gmt":"2026-07-10T11:46:25","slug":"windows-11-has-a-built-in-dns-over-https-mode-most-people-never-turn-on-and","status":"publish","type":"post","link":"https:\/\/innovatenews.site\/index.php\/2026\/07\/10\/windows-11-has-a-built-in-dns-over-https-mode-most-people-never-turn-on-and\/","title":{"rendered":"Windows 11 has a built-in DNS over HTTPS mode most people never turn on, and\u2026"},"content":{"rendered":"
\n

The topic Windows 11 has a built-in DNS over HTTPS mode most people never turn on, and\u2026<\/strong> is currently the subject of lively discussion \u2014 readers and analysts are keeping a close eye on developments.<\/p>\n

This is taking place in a dynamic environment: companies\u2019 decisions and competitors\u2019 reactions can quickly change the picture.<\/p>\n

Every time I dig through Windows 11’s network settings, I feel like I have discovered a new one. Last week, I was chasing down a random LAN disconnect issue and had reset all network settings to reconfigure everything. That’s when I noticed an option called DNS over HTTPS, which I had missed before.<\/p>\n

Turns out Windows 11 supports encrypting DNS natively since launch. Only the setting was tucked away, so most people never bother to enable it. After spending time configuring encrypted DNS on the router and self-hosted resolvers, I realized that Windows 11 itself has a built-in switch for that. That was a good enough reason to dig in.<\/p>\n

A DNS lookup request translates the domain name you type into an IP address before your PC can connect to anything. This happens before the HTTPS handshake with the site itself, and it traditionally occurs on port 53. So, the request itself isn\u2019t encrypted even if the site you\u2019re visiting is. Anyone positioned between your PC and that DNS server can see exactly which domains you\u2019re resolving. That could be your ISP, someone on the same Wi-Fi network, or a compromised router. That said, they can\u2019t see what you\u2019re doing once you\u2019ve opened the site.<\/p>\n

DNS over HTTPS changes that. It hides the same DNS request inside an encrypted connection, so it travels over port 443 instead of port 53. Anyone monitoring your traffic just sees a regular HTTPS connection to your DNS provider. They can’t tell which sites you’re actually resolving.<\/p>\n

\"\"<\/figure>\n

What caught me off guard is that Windows 11 has this built in already. DNS over HTTPS was tested in Windows 10, but it required registry edits with no interface access. It arrived officially with Windows 11. Surprisingly, this option wasn\u2019t on by default. So if you\u2019ve never touched it, and you go looking for it, expect it to be off.<\/p>\n

You can enable DNS over HTTPS from the Network & Internet section of the Settings app. You need to click the connection (Wi-Fi or Ethernet) you\u2019re using, then go to the DNS server assignment and click Edit. Switch the DNS server assignment from Automatic to Manual and toggle IPv4 on. Next, you can add your preferred and alternate DNS servers.<\/p>\n

Under each DNS server, use the drop-down for DNS over HTTPS and select On (Automatic Template), which applies the correct settings for that provider. Note that the dropdown only appears when Windows recognizes the DNS server as DoH-capable. Windows has hardcoded templates for DNS servers from Cloudflare, Google, and Quad9. If you use any other provider, the dropdown to use a template won\u2019t appear.<\/p>\n

You can still add a third-party DNS provider\u2019s DoH template into Windows and use it. for example, you can add NextDNS\u2019s DoH template on Windows 11 using PowerShell (run it as Administrator) with a single cmdlet (Set-DnsClientDohServerAddress). After that, when you use the NextDNS IPs, the dropdown will appear to select the relevant template.<\/p>\n

One thing worth checking after enabling is whether it\u2019s actually working, rather than assuming the toggle encrypts DNS queries. Cloudflare hosts a browser-based check at https:\/\/1.1.1.1\/help that tells you whether your DNS queries are encrypted and which resolver is handling them. I ran it right after switching over to Cloudflare DNS servers, and it confirmed that DoH was active.<\/p>\n

You’ll also want to make sure you turn off the Fall back to plaintext toggle. That\u2019s because Windows won\u2019t warn you if a DoH handshake fails and reverts to unencrypted lookups.<\/p>\n

\"\"<\/figure>\n

I assumed that using DNS over HTTPS might add noticeable overhead with every DNS lookup. TLS handshakes cost real time, and DNS is supposed to be a fast, forgettable step before the real connection takes place. Switching between tabs or opening new sites felt a bit sluggish initially.<\/p>\n

After a while, I couldn\u2019t point out the sluggishness. It all comes down to DNS caching. Once a domain is resolved, my Windows 11 PC doesn\u2019t re-query it on every request. That overhead only showed up the first time I opened a new site. It\u2019s small enough that a week\u2019s worth of use didn\u2019t reveal any downsides.<\/p>\n

Enabling DoH is great for an encrypted DNS experience, but it also affects a few things on your network. VPNs with split-tunneling can cause encrypted DNS queries to be routed outside the tunnel. That defeats the point of running a VPN. It\u2019s best to check how a VPN client handles DNS before you assume that the DoH setting in Windows works as expected.<\/p>\n

At the router level, parental controls and content filters inspect the plain DNS traffic on port 53. But with DoH, the PC sends encrypted queries over port 443 instead, and that traffic slips right past those filters that weren\u2019t meant to look inside HTTPS connections. Even corporate networks need to manage or restrict DoH through group policy for exactly this reason.<\/p>\n

But for home usage, it\u2019s totally worth it. If something depending on DNS inspection suddenly stops behaving normally, you can check this DoH setting in Windows first. There\u2019s no downside, since you can spend a minute choosing between Cloudflare, Google, Quad9, or adding another provider using PowerShell to stop your ISP from reading your DNS queries.<\/p>\n

Elevate your self-hosting journey with a DNS server that suits your needs.<\/p>\n

The DNS over HTTPS feature ships with Windows 11, but Microsoft hasn\u2019t exactly made it easy to discover. It\u2019ll take you a few clicks to dig deep into the network settings page, where most people never venture unless something\u2019s already broken. That\u2019s exactly how I discovered it. Turning it on takes less than five minutes, and you\u2019ll probably forget that the feature is even on. Once turned on, the feature works and incurs no additional daily cost.<\/p>\n