Preventing Windows 11 Client Bypassing Pi-hole: A Networking Solution

Windows 11 clients bypass Pi-hole primarily because the operating system enforces DNS-over-HTTPS (DoH) or uses a secondary DNS provider for resolution when the primary fails. This behavior allows traffic to escape your local ad-blocking sinkhole, undermining network-wide security. To resolve this, you must disable DoH at the OS level and ensure strict static DNS configuration on the network interface. The root cause lies in Windows 11’s aggressive attempt to secure DNS queries by encrypting them via Microsoft’s servers or other public resolvers like Cloudflare. When enabled, these encrypted channels ignore the local Pi-hole IP address assigned to the primary DNS slot. Additionally, Windows may automatically switch to a manual DNS setting if it detects instability, further detaching the client from your local infrastructure. Fixing this requires a combination of GUI settings adjustments and Group Policy enforcement to prevent reversion.

Disable DNS-over-HTTPS in Windows Settings

The most common reason for bypass is the built-in DoH feature. Windows 11 handles this through the Network & Internet settings rather than deep registry edits. You need to navigate to Settings > Network & internet > Advanced network settings. From there, select More network adapter options to open the classic Control Panel view. Right-click your active Ethernet or Wi-Fi adapter and choose Properties. Double-click Internet Protocol Version 4 (TCP/IPv4). Click the Advanced button and go to the DNS tab. Ensure that "Register this connection's addresses in DNS" is unchecked if you are not using dynamic updates, though this is less critical than the main settings. Return to the main Settings window and look for Private networks or Public networks depending on your profile. Under the Additional settings section, find DNS over HTTPS. Set the mode to Off. If the option is grayed out, it indicates that a Group Policy object is already managing this setting, which is the enterprise-grade solution described below. Disabling this forces Windows to use standard, unencrypted DNS queries directed at the IP addresses you specify, allowing Pi-hole to intercept and filter them correctly.

Enforce Static DNS via Group Policy

For environments with multiple machines or users who might change settings, relying on individual GUI configurations is insufficient. Group Policy Objects (GPO) provide a centralized way to lock down DNS settings. Open the Group Policy Management Console on your domain controller. Create a new GPO linked to the organizational unit containing your Windows 11 clients. Edit the policy and navigate to User Configuration > Preferences > Control Panel Settings > Network Connections. Right-click and select New > Advanced TCP/IP Settings. In the dialog box, check the box for Use the following DNS server addresses. Enter your Pi-hole IP as the preferred server and a reliable fallback like 8.8.8.8 or your router’s IP as the alternate. Crucially, uncheck Register this connection's addresses in DNS if you want to avoid cluttering your internal DHCP server records, although keeping it checked is often harmless. Apply the policy and force a refresh on the client using gpupdate /force in an elevated command prompt. This method overrides user changes and ensures the NIC always points to your blocker.

Configure Network Interface Strictly

Even with GPOs, local interface settings can sometimes drift. It is vital to ensure the Network Interface Card (NIC) is not set to obtain DNS automatically via DHCP if your DHCP server is misconfigured. Navigate back to Adapter Properties as described in the previous section. Select Use the following DNS server addresses manually. Enter the Pi-hole IP in the Preferred field. In the Alternate field, enter a second Pi-hole instance if you have one, or a trusted external resolver. Avoid leaving these fields blank, as Windows will then query the DHCP-provided DNS, which might be your ISP’s default gateway if Pi-hole is not integrated into the DHCP scope. If you are using a home lab setup without Active Directory, you can achieve similar results by scripting the network configuration. Use PowerShell to set the DNS servers statically. Run the following command in an administrator terminal, replacing InterfaceIndex with your actual NIC index found via Get-NetIPConfiguration:

Set-DnsClientServerAddress -InterfaceIndex 12 -ServerAddresses ("192.168.1.50", "8.8.8.8")

This command hardcodes the DNS servers for that specific interface. To make this persistent across reboots, you can save this script and schedule it via Task Scheduler to run at logon. This approach is particularly useful for standalone PCs where GPO management is not feasible. For more details on handling connectivity issues during such configurations, refer to Troubleshooting LAN Connection Issues on a Brand New Windows 11 Machine.

Verify Resolution and Troubleshooting

After applying these changes, verify that the client is actually using Pi-hole. Open Command Prompt and run nslookup example.comipconfig /flushdns. Check the Windows Event Viewer under Applications and Services Logs > DNS Client for errors indicating registration failures. If the settings revert unexpectedly, check for third-party security software or VPN clients that may be injecting their own DNS providers. These applications often install virtual adapters that capture traffic before it reaches the physical NIC. Disable any unused virtual adapters in the Network Connections panel. Also, ensure that your DHCP server is distributing the correct DNS options. If your DHCP server hands out the Pi-hole IP, Windows 11 should respect it unless DoH is forced on. For deeper insights into why DNS settings might change automatically, see DNS Settings Automatically Changing to Manual on Windows 11 22H2.

Frequently Asked Questions

Why does my Windows 11 PC still bypass Pi-hole after disabling DoH?

You may have a secondary DNS provider configured in the adapter properties that Windows falls back to if the primary fails. Ensure only the Pi-hole IP is listed in the Preferred DNS field and consider removing the Alternate field entirely if you do not need a backup resolver.

Can I enforce DNS settings using only DHCP?

Yes, configuring your DHCP server to hand out the Pi-hole IP as the primary DNS option is the cleanest method. However, Windows 11’s DoH feature can still override this if not disabled in the OS settings, so combining DHCP configuration with local DoH disablement is recommended.

What happens if I leave DNS-over-HTTPS enabled?

Enabling DoH encrypts DNS queries between your PC and Microsoft’s servers, completely bypassing your local Pi-hole. This means ads and trackers will load normally, and you lose all visibility into network traffic logs provided by your ad blocker.

How do I check which DNS server Windows is currently using?

Run ipconfig /all in Command Prompt to see the configured adapters. For real-time verification, use nslookup google.com and observe the server address returned in the response. If it matches your Pi-hole IP, the configuration is working.

Is it safe to disable DoH on a home network?

Disabling DoH on a local network where you control the DNS resolver is generally safe and improves privacy by keeping queries within your infrastructure. It removes the encryption layer, but since the traffic stays on your LAN, the risk of interception is minimal compared to the benefit of ad blocking.