Windows 11: Sending Conventional DNS Requests with DNS-over-HTTPS Enabled

Windows 11: Sending Conventional DNS Requests with DNS-over-HTTPS (DoH) Enabled

In recent years, there has been a growing concern about the security and privacy of DNS traffic. As a response to these concerns, the IETF (Internet Engineering Task Force) has developed a new standard called DNS-over-HTTPS (DoH), which encrypts DNS queries and responses to protect them from eavesdropping and manipulation.

What is DNS-over-HTTPS (DoH)?

DoH is a protocol that allows DNS queries and responses to be sent over HTTPS, the same secure protocol used for web browsing. By encrypting DNS traffic, DoH prevents eavesdropping, tampering, and interception of DNS queries and responses. DoH also allows DNS queries to be sent over port 443, which is typically open in most networks, making it easier to bypass firewalls and other network restrictions.

How to Enable DoH in Windows 11?

To enable DoH in Windows 11, follow these steps:

1. Open the Windows Settings app.
2. Go to the Network & Internet section.
3. Click on the DNS settings link.
4. Turn on the Enable IPv6 toggle switch.
5. Select the Manual option under IP settings.
6. Enter the IP address of a DoH-compatible DNS server in the Preferred DNS field. For example, you can use the following DoH-compatible DNS servers:

• Cloudflare: 1.1.1.1
• Google: 8.8.8.8
• Quad9: 9.9.9.9

Make sure to append the DoH path to the IP address, like this:

DoH and Wi-Fi Networks

When using DoH over a Wi-Fi network, you may still see explicit DNS requests being sent to the network's DNS server. This is because some Wi-Fi networks may still require explicit DNS requests to be sent to the network's DNS server for various reasons, such as network management or security. However, this does not mean that DoH is not working or that your DNS queries are not being encrypted.

To verify that DoH is working properly, you can use a network monitoring tool like Wireshark. If you see TCP traffic to port 443 and the DoH path in the request, then DoH is working as expected. If you see explicit DNS requests being sent to the network's DNS server, this is likely due to the network's requirements and does not indicate a problem with DoH.

DNS-over-HTTPS (DoH) is a protocol that encrypts DNS queries and responses to protect them from eavesdropping and manipulation. To enable DoH in Windows 11, follow these steps:

1. Open the Windows Settings app.
2. Go to the Network & Internet section.
3. Click on the DNS settings link.
4. Turn on the Enable IPv6 toggle switch.
5. Select the Manual option under IP settings.
6. Enter the IP address of a DoH-compatible DNS server in the Preferred DNS field.

Make sure to append the DoH path to the IP address, like this:

References

• RFC 8484: DNS Queries over HTTPS (DoH)
• Cloudflare: DNS over HTTPS
• Google: Use DNS over HTTPS in Chrome
• Quad9: Frequently Asked Questions

--endarticle--