Enabling DNS over HTTPS (DoH) on Windows

What you’ll achieve​

You’ll configure your Windows machine to use encrypted DNS queries (DoH) so that third-parties cannot easily intercept or modify DNS lookups. This enhances privacy and security, particularly on public or untrusted networks.

​

Prerequisites​

• Windows 10 (build 19628 or higher) or Windows 11.
• Administrator access (local or domain) or ability to edit Group Policy.
  
  
• A DoH-supporting DNS resolver (such as Cloudflare, Google, Quad9, etc.).
  
  
• If domain-joined or under corporate policy, ensure you have rights to override existing policies.

Known DoH Providers​

Steps​

Warning: Changing DNS and policy settings can cause connectivity issues if done incorrectly. Back up settings or create a system restore point before proceeding.

Click to expand...

---

A. Enable DoH via Windows Settings (for supported builds)​

1. Open Settings → Network & Internet.
2. Click the connection you use (Wi-Fi or Ethernet).
   
   
3. Click Properties.
4. Find DNS settings → click Edit.
   
   
5. Select Manual.
   
   
6. Enter Preferred DNS and Alternate DNS server addresses of a DoH provider.
   
   
7. Under DNS encryption / Preferred DNS encryption, choose Encrypted only (DoH) (or equivalent).
   
   
8. Save.
   
   
9. Flush DNS cache:
   
   Code:

   ipconfig /flushdns

B. Enable DoH via Registry (if settings UI is unavailable or locked)​

1. Run regedit.exe as Administrator.
   
   
2. Navigate to:
   
   Code:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters

   
   
3. Create or modify DWORD value EnableAutoDoh with decimal 2.
   • Value meanings:
     • 0 → automatic behavior / default
       
       
     • 1 → allow DoH pref but fallback to UDP if not available
       
       2 → “Encrypted only” — require DoH when possible
   
   
4. Reboot the machine.
   
   
5. Ensure network adapter DNS addresses are set to the DoH-resolver’s IPs.

C. Enable DoH via Group Policy (for domain or local GP)​

1. Open Local Group Policy Editor (gpedit.msc) or domain GPO editor.
   
   
2. Navigate to:
   
   Code:

   Computer Configuration → Policies → Administrative Templates → Network → DNS Client

   
   
3. Locate policy “Configure DNS over HTTPS (DoH) name resolution”.
   
   
4. Enablethe policy, then choose one of:
   • Require DoH (DNS queries must be over HTTPS; name resolution fails if unavailable)
   • Allow DoH (prefer HTTPS; fallback if not supported)
   • Prohibit DoH (disable DoH entirely)
   
   
5. Apply and either run gpupdate /force or restart.

D. Verify DoH is working​

1. Use PowerShell to list DoH server addresses:
   
   Code:

   Get-DNSClientDohServerAddress

   
   
2. Check “DNS settings” in your network adapter → the DNS entries should show (Encrypted) or indicate support for DoH.
   
   
3. Use browsers’ own secure DNS settings to check if the system-level DNS is encrypted (some offer status).
   
   
4. Use online tools (e.g. Cloudflare’s check DNS over HTTPS, or “What’s my DNS server”) to confirm.

E. Troubleshooting​

---

​

Summary​

By following this guide, you’ll set up Windows so that DNS lookups are encrypted via HTTPS. This helps prevent network-based attack vectors (e.g. ISP snooping, DNS manipulation) and gives you better privacy overall.