Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Windows 11 includes a built-in privacy feature for DNS queries called DNS-over-HTTPS (DoH). When it’s enabled, your device sends DNS requests over an encrypted HTTPS connection instead of plain DNS, which helps reduce passive eavesdropping on local networks.
This guide walks you through turning DoH on, selecting a provider, verifying it’s actually in use, and handling the edge cases where the setting doesn’t show up or stops working.
As an Amazon Associate I earn from qualifying purchases.
What DNS-over-HTTPS (DoH) does in Windows 11
DNS translates names like example.com into IP addresses. Without DoH, DNS typically uses port 53 (or related DNS transports) and can be observable on the network path.
Free tools Windows power users keep installed
One-click scans. No signup required.
With DoH, Windows 11 sends DNS queries via HTTPS (commonly port 443). That means the DNS content is encrypted in transit, while the IP connection still looks like normal HTTPS traffic.
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Prerequisites and what you should check first
Confirm your Windows 11 edition and version
DoH support is available on Windows 11 builds where the network stack supports OS-level DNS encryption. For best results, update to the latest Windows 11 release (for example, 22H2 or 23H2 plus current cumulative updates).
Use an interface that Windows 11 can manage
The DoH setting is applied per network connection (Wi‑Fi or Ethernet). If you’re using a third-party network configuration tool, custom DNS management, or an always-on VPN, you may not see the toggle or it may be overridden.
Understand what provider selection means
You can either use an OS-recommended configuration (when available) or add a specific DoH endpoint. Different providers may use different URL paths and query formats, so it matters what you enter.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How to enable DNS over HTTPS in Windows 11 (Settings app)
The exact wording can vary slightly across Windows 11 builds, but the flow is consistent: Settings > Network & internet > your adapter > DNS settings > enable DNS over HTTPS.
Step-by-step: Wi‑Fi or Ethernet
- Open Settings (press Win + I).
- Go to Network & internet.
- Select Wi‑Fi (or Ethernet).
- Find and open the active connection details, such as Hardware properties or Your network properties.
- Look for DNS server assignment. Change it to Edit if needed and set it to Manual so you can control DNS behavior.
- Find the option labeled DNS over HTTPS and switch it On.
- Choose a provider option if Windows offers a list, or select Custom to enter the DoH endpoint.
- Click Save. If Windows prompts to restart the network connection, approve it.
What you’ll typically configure
Depending on the build, you’ll either choose:
- A preset provider (Windows-managed selection), or
- A custom DoH server entry that includes a hostname and an HTTPS URL endpoint.
If you enter custom endpoints, match the format exactly (path and parameters matter).
Choose a DoH provider: common options and their endpoints
Below are popular public DNS-over-HTTPS endpoints you can use when Windows asks for a custom DoH server. Providers sometimes change URLs, so double-check against their current documentation if something stops working.
| Provider | DoH endpoint (HTTPS URL) | Notes |
|---|---|---|
| Cloudflare | https://cloudflare-dns.com/dns-query |
Often used with GET/POST; Windows may only need the base URL. |
https://dns.google/resolve |
Legacy path widely used for DoH; the exact resolver behavior can vary. | |
| Quad9 | https://dns.quad9.net/dns-query |
Frequently chosen for privacy-focused filtering options. |
| NextDNS (example) | https://dns.nextdns.io |
Some setups require an account-specific hostname or token. |
If Windows requests additional fields (like a hostname separately from the URL), enter them exactly as indicated by the UI. When in doubt, test with verification steps later in this guide.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify it’s working (and what to test)
Windows can turn the setting on, but you still want proof that DoH traffic is being used to resolve names.
Quick functional checks
- DNS resolution still works: open a website you haven’t visited recently and confirm it loads normally.
- Run a flush + retry: clear the DNS cache and re-test lookups.
Use these commands in Windows Terminal (admin not always required):
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
- Press Start, search cmd or PowerShell.
- Run:
ipconfig /flushdns - Test name resolution again (e.g., open a new tab, or use
nslookup example.com).
Network-level verification (reliable)
For strong confirmation, capture traffic and look for HTTPS connections to the DoH provider endpoint while a DNS lookup happens.
- Start a browser or app that triggers DNS resolution.
- Use a packet capture tool (like Wireshark) and filter for the provider domain (for example,
cloudflare-dns.com). - Confirm you see HTTPS traffic targeting port 443 and the provider’s domain during name resolution.
Because Windows may use encrypted DNS, you won’t see DNS text in the packet payload, but you should see the HTTPS session to the DoH host.
When the Windows 11 DoH toggle is missing
If you don’t see a DNS over HTTPS option in Settings, it’s usually due to version/build limitations, admin policy, or third-party DNS management.
Check these common causes
- Windows isn’t updated: go to Settings > Windows Update and install the latest cumulative update.
- Admin policy restrictions: organizations can disable DNS encryption features via Group Policy or MDM.
- DNS is managed elsewhere: if a VPN or security tool sets DNS, Windows may hide or ignore the DoH toggle.
- Wrong adapter context: ensure you’re viewing the active Wi‑Fi/Ethernet connection properties.
Validate with Group Policy (if you’re on Pro/Enterprise)
If you manage machines, check policy controls that govern DNS encryption and name resolution settings. If DoH is blocked, the UI may not provide the switch or may revert after saving.
Troubleshooting: common failures and fixes
When DNS-over-HTTPS is misconfigured, the most common symptom is that websites won’t load (or load intermittently), while IP connectivity still looks fine.
Problem: DoH is On but DNS resolution fails
- Flush cache: run
ipconfig /flushdnsthen retry. - Confirm provider URL accuracy: compare your custom DoH endpoint against the provider’s current format (including path).
- Try a known-good public provider: temporarily switch from a custom endpoint to Cloudflare (
https://cloudflare-dns.com/dns-query) and test. - Disable restrictive security filters: some firewall or endpoint security products can block outbound HTTPS to the DoH host.
Problem: Option won’t stick (reverts after reboot)
- Check for MDM/Group Policy: if managed, your device may be applying a policy that overrides manual settings.
- Re-check DNS server assignment: ensure you set DNS server assignment to the correct mode (often Manual) before turning DoH on.
- Restart the adapter: toggle Wi‑Fi off/on or disable/enable the Ethernet adapter once after changes.
Problem: Captive portals (hotels, airports) break DNS
Captive portals often require initial HTTP/HTTPS flows and may rely on DNS behavior that’s incompatible with certain DNS encryption configurations. If sign-in pages don’t appear:
- Temporarily turn DNS over HTTPS Off for the affected network.
- Connect, complete portal authentication, then re-enable DoH.
Problem: VPN interferes
Some VPN clients push DNS settings or run their own encrypted DNS tunnel. If DoH is enabled on Windows while the VPN already provides DNS encryption, you can get conflicts or unexpected routes.
- Try switching DoH Off when the VPN is connected.
- Or test whether the VPN advertises DoH/DoT and keep only one layer enabled.
Alternatives and overlaps (browser and VPN behavior)
Windows DoH isn’t the only place DNS encryption can happen. Browsers and security tools may implement their own DoH. Knowing what’s active helps you avoid duplicate features that fight each other.
Platform: Microsoft Edge
Edge can use its own Secure DNS behavior, which may be separate from Windows’ DNS-over-HTTPS setting.
Rank #3
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
- Open Edge settings: edge://settings/privacy.
- Find Security or Use secure DNS.
- Set Use secure DNS to On (or choose a provider), then save.
- Test DNS resolution and verify which endpoints get contacted during lookups.
Platform: Google Chrome
Chrome has Secure DNS (DoH) settings that can overlap with Windows configuration.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Open: chrome://settings/security.
- Go to Advanced protection and locate Secure DNS.
- Set Secure DNS to an available option (for example, with a provider) and save.
- Re-test connectivity after a
ipconfig /flushdnsto avoid caching confusion.
Platform: Firefox
Firefox can enable DNS over HTTPS via its own network settings.
- Open about:config (and accept the warning).
- Search for
network.trr.uri. - Set it to a DoH URI such as
https://cloudflare-dns.com/dns-query. - Confirm DNS over HTTPS is active by testing and checking provider traffic.
Security and privacy realities (what DoH does and doesn’t fix)
DoH encrypts DNS query contents in transit, which helps against passive monitoring. However, it doesn’t automatically provide anonymity.
- DoH provider sees queries: the resolver you choose can log metadata and queries depending on its privacy policy.
- Traffic metadata still exists: your device still makes connections to DoH endpoints over HTTPS, which can be correlated by observers.
- Not a substitute for full threat protection: phishing, malware, and malicious sites still require browser/security hygiene and protections.
Common mistakes to avoid
- Entering a wrong DoH URL: missing paths like
/dns-querycan make the provider return errors. - Forgetting adapter context: enabling DoH on Wi‑Fi doesn’t affect Ethernet, and vice versa.
- Testing without flushing DNS: cached results can hide whether DoH is actually being used.
- Leaving multiple DNS encryption layers active: browser secure DNS and Windows DoH together can complicate troubleshooting.
FAQs
Does enabling Windows 11 DNS over HTTPS replace my DNS server settings?
It changes how Windows sends DNS queries (over HTTPS), but you still typically define which DNS server/provider is used. Some configurations rely on DoH endpoints rather than the classic DNS server address.
Will DoH slow down browsing?
Usually the difference is small because DNS lookups are cached and HTTPS connections are fast, but a poor network path to the DoH provider can add latency. If you notice delays, try a different provider and test after flushing the DNS cache.
Can I use a private/internal DoH server?
Yes, if you control the endpoint and Windows supports your provider format in the UI. Make sure the endpoint is reachable from client devices over HTTPS (typically port 443) and the URL format matches what the server expects.
Why do captive portal sign-in pages fail with DoH?
Captive portals can require specific DNS behavior and unauthenticated web flows. If the network blocks or redirects encrypted DNS traffic, the portal can’t discover or reach needed endpoints, so disabling DoH briefly can help.
Is DoH required to be safe?
No. It’s one privacy improvement, not a complete security solution. You still need HTTPS, phishing protection, updated browsers, and endpoint defenses for comprehensive safety.
Bottom Line
Windows 11 DNS-over-HTTPS is a practical privacy upgrade: it encrypts DNS queries by routing them through an HTTPS-based resolver. Enable it in Settings for the active Wi‑Fi or Ethernet profile, choose a reliable provider endpoint, and verify the behavior using DNS cache flushing and traffic inspection.
If the toggle is missing or connections break, update Windows, check policy/VPN overrides, and test with a known-good public provider like Cloudflare. Once it’s stable, you’ll get better protection against passive DNS snooping with minimal day-to-day friction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
