Every time you type a website into your browser, your ISP gets a free ticket to watch it.A few Windows 11 privacy settings get talked about a lot, but this one rarely does, even though it's been sitting inside your PC this whole time.It's not a third-party app, and you don't need to install anything new.
You only need to know where to look, and honestly, most people never do.Your ISP can see every site you visit, and it's barely hiding it DNS requests still travel in plain text by default Picture asking a stranger for directions to a building before you walk inside.They won't know what you do once you're through the door, but they'll always know you asked, and exactly where you are headed.
That's roughly what happens every time your PC loads a website.Before your browser can connect to anything, it first has to resolve the domain name into an address.That lookup traditionally goes out over port 53 with no encryption wrapped around it at all.
It doesn't matter if the site itself loads behind a padlock and full HTTPS.The request asking where that site lives happens first, out in the open, on a completely separate channel from the secure connection that follows.Your provider isn't the only one who gets a look either.
Anyone sharing your network segment, plus whatever router the request happens to pass through along the way, can read that same information.DNS over HTTPS is Windows 11's quiet fix for this It's built in, but Microsoft never turned it on for you This is where DNS over HTTPS, or DoH, comes in.Instead of sending that lookup out in the open, it folds the request into the same kind of encrypted channel your browser already uses for HTTPS sites, sending it out over port 443 instead of port 53.
From the outside, that traffic just blends into the pile of other encrypted connections your PC is already making.Nobody watching the wire can pick it out as a DNS lookup.One quick thing worth clearing up.
DoH isn't a VPN, even though people sometimes lump the two together.It only encrypts the lookup step, not your actual browsing traffic afterward.If you want the fuller picture on what a VPN does and doesn't hide from your provider, you need to learn what your ISP still knows about you, even with a VPN.
How to turn on DNS over HTTPS in Windows 11 It's a short, one-time setup in Settings It's really easy to switch this on.Open Settings, then head to Network & Internet.Click your active connection, either Wi-Fi or Ethernet.
Find the DNS server assignment section and click Edit.Switch it from Automatic to Manual, then toggle IPv4 on.Type in a preferred and an alternate DNS server address.
For Cloudflare, use 1.1.1.1 as preferred and 1.0.0.1 as alternate.For Google, use 8.8.8.8 and 8.8.4.4.For Quad9, use 9.9.9.9 and 149.112.112.112.
Under each server, open the dropdown and pick On (Automatic Template).Click Save.Close That dropdown only shows up when Windows recognizes the provider as DoH capable, which currently covers Cloudflare, Google, and Quad9.
Using a different provider like NextDNS still works, but you'll need to add its template through PowerShell first.Once you're done, it's worth checking that everything is actually working rather than just trusting the toggle.Cloudflare runs a simple browser test at 1.1.1.1/help that confirms whether your DNS queries are encrypted.
What changes on your network once this is on Your browser might already have its own opinion Here's something that trips people up.Chrome, Firefox, and Edge all ship with their own secure DNS setting.If a browser's built-in setting is already turned on and pointed at a different provider than the one you picked at the OS level, that browser will keep using its own choice for its own traffic.
Everything else on your PC, like background apps and other services, still follows the Windows-level setting you just configured.Nothing about this is broken.It's just two settings doing similar jobs in different places, so don't be surprised if you go check your browser later and find a different provider listed there.
Two setups are worth double-checking before you roll this out everywhere.Split-tunnel VPNs sometimes let DNS traffic slip outside the tunnel entirely, since the VPN client and Windows can each assume the other one is handling it.And if your router or workplace network leans on filtering software that blocks certain sites by inspecting DNS traffic, that software typically depends on reading requests in the clear.
Encrypt the lookup, and the filter has nothing left to inspect.It's also worth remembering this setting only covers the device you configured it on.Your smart TV, game console, or a family member's laptop on the same network is still sending its DNS requests the old way unless you repeat these steps on each device, or make the change at the router level instead.
If a site suddenly refuses to load after you make this change, don't panic and assume your PC is broken.Head back into the same DNS settings and switch back to Automatic for a minute to confirm whether the new DNS provider is actually the cause.Nine times out of ten, that's all it takes to figure out what's going on.
And if you want to keep tightening things up on your PC after this, there are many privacy features worth disabling on Windows 11.Related The Overlooked Windows 11 Privacy Upgrade That Just Works Unencrypted DNS exposes every site you visit.Here's how to encrypt it to keep your browsing private from ISPs and prying eyes.
Posts 3 By Rich Hein Never let your ISP know your business DNS over HTTPS won't make you invisible online, and it was never meant to.What it does is close off one of the quieter ways your browsing gets logged without you ever agreeing to it.Windows 11 has had this built in the whole time but never bothered to put it front and center.
Read More
