The Overlooked Windows 11 Privacy Upgrade That Just Works
For a long time, I never thought about what happens when I type a web address into a browser and hit "Enter." In fact, your computer asks a DNS server where to find the site, and unless you've previously made changes to your settings, that request goes out in plain text, visible to any system your traffic passes through on its way across the network.
That doesn't sit well with me, and if you're a privacy- or security-conscious person, it probably doesn't sit well with you either. First, I don't like my ISP building a history of every site I visit, and I definitely don't want this data floating around where hackers or other bad actors could intercept it, especially when using public Wi-Fi . This is why I encrypt my DNS.
What Is DNS?
DNS is like the internet's phone book. When you type in a web address, like howtogeek.com, your computer doesn't understand that text directly. It needs a numerical IP address in order to connect you to the correct website. DNS translates this data in the background.
The issue I have with traditional DNS requests is that they aren't secure. They go out unencrypted, which means anyone on the path, like your internet service provider, network admins, or worse, a hacker can see the sites you're visiting. They can't necessarily see what you're doing on a site protected by HTTPS, but the fact that you visited it is still exposed.
The Benefits
There are some clear advantages to encrypting your DNS. ISPs, admins, and hackers can't easily log or intercept every site you visit. It helps protect you from potential DNS hijacking or "man-in-the-middle" attacks where someone tampers with your lookups in order to send you to a malicious site. On top of that, it's easy to enable in modern browsers and operating systems.
The Downside
There are some tradeoffs to consider. You're shifting trust away from your ISP to a third-party DNS provider which raises its own concerns, especially if you're using a giant like Cloudflare or Google. Some networks may not work well with encrypted DNS, and if you're already paying for a VPN, the benefits can overlap.
In some cases, you may notice a small impact on your performance, though I haven't experienced any. Your mileage may vary here.
Types of Encrypted DNS
DNS over HTTPS
DNS over HTTPS works just like it sounds. Instead of sending your DNS requests out in plain text, it wraps them inside standard HTTPS traffic, the same thing your browser already uses when you connect to a secure site. This makes snooping or tampering with those requests harder because it looks just like normal encrypted web traffic.
DNS over TLS (DoT)
DNS over TLS (DoT) secures your lookups by sending them through a dedicated encrypted channel using the same protocol that keeps websites safe. Unlike DoH, which disguises DNS traffic as regular web traffic, DoT runs on its own port, making it easier for networks to identify and sometimes block. The advantage is that it still provides strong protection against snooping or tampering, and many operating systems and routers now support it directly.
Oblivious DoH (ODoH)
Oblivious DoH (ODoH) is a newer twist on DNS protection that adds an extra layer of privacy. It works like regular DoH, but routes your request through a relay before it gets to the DNS server. This way, no single party knows who you are and what website you're trying to visit. The relay sees your IP address while the DNS server only sees the request itself. This protocol isn't currently supported as widely as DoH and DoT.
How to Enable Encrypted DNS over HTTPS in Windows 11
You can encrypt your DNS within Windows 11 or within Firefox or Chrome. I choose to do it at the system level because then everything is protected, my apps, web browsing, and games. It's all encrypted.
To encrypt your DNS, start by typing Settingsinto the taskbar search box, then click on the "settings" icon.
From there, click Network & Internet and then click on your Wi-Fi or Ethernet connection.
Once you've got your internet connection, find the DNS server assignment edit button, and click on it.
Once on this screen you'll see IPv4 and IPv6. Most home networks support both protocols. You can run a quick check using Test-IPv6.com to see what your ISP supports. My ISP hasn't completely rolled out IPv6, so I'm going to enable IPv4.
Once you are in the DNS settings for IPv4 enter the IP address of your DNS provider in the Preferred DNS field. I'm using Google as my DNS provider. Their primary DNS server IP address is 8.8.8.8. If you want to use Cloudflare, type 1.1.1.1in the Preferred DNS field. Next, in the DNS over HTTPS dropdown menu directly below the Preferred DNS field, choose the "On (automatic template)" setting.
Now find the Alternate DNS section and type the alternate IP address of your DNS provider. For Google, it's 8.8.4.4. If you're using Cloudflare, the Alternate DNS IP address is 1.0.0.1. Now, in the DNS over HTTPS dropdown menu directly below the Alternate DNS field, choose the "On (automatic template) setting."
With everything set up for Google as your DNS provider, your settings should look like this.
Now click Save and you're done. You've enabled DNS over HTTPS.
If your ISP supports IPv6, then choose IPv6 from the DNS Server settings dialog. The setup is the same as above, just the addresses change.
If Google is your primary DNS provider, then type 2001:4860:4860::8888in the Primary DNS field and type 2001:4860:4860::8844in the the Alternate DNS field. If you're using Cloudflare as your DNS provider, type 2606:4700:4700::1111in the Preferred DNS field and 2606:4700:4700::1001in the Alternate DNS field. It should look like this if you're using Google.
Click save and it's all set.
I've written before about privacy and security issues in Windows , and in the browser extensions we install on browsers. Encrypting your DNS falls into the same category of high-impact, low-effort improvements that will help protect your data. It keeps your browsing habits out of your ISP's logs, closes a potential attack vector for hackers and adds a layer of protection when you find yourself using Wi-Fi on an untrusted network.
