>

Enable DNS over HTTPS (DoH) on Windows

Encrypt your DNS lookups with a DoH server so your ISP cannot easily see which sites you visit.

WindowsDNSprivacypowershellLow risk
Run Add-DnsClientDohServerAddress with the 1.1.1.1 Cloudflare template, then point your adapter's DNS at 1.1.1.1 and 1.0.0.1.

01Command

Command
$ Add-DnsClientDohServerAddress -ServerAddress "1.1.1.1" -DohTemplate "https://cloudflare-dns.com/dns-query" -AllowFallbackToUdp $false -AutoUpgrade $true
Set-DnsClientServerAddress -InterfaceAlias "Wi-Fi" -ServerAddresses 1.1.1.1,1.0.0.1

02What it does

By default Windows sends DNS queries in plain text, so the network operator can log every domain you resolve. Add-DnsClientDohServerAddress registers a known DoH template, and with AllowFallbackToUdp set to $false the lookup is refused rather than sent unencrypted if DoH fails. The second line makes Windows actually use those servers on your Wi-Fi adapter.

03Risk

RiskLow risk
RequirementsWindows 10 (build 1903+) or Windows 11. Run PowerShell as administrator.
!Warning: If the DoH template is mistyped or blocked by your network, web browsing may fail entirely — set AllowFallbackToUdp to $true first if you are on a strict corporate network.

04Undo

Undo
$ Remove-DnsClientDohServerAddress -ServerAddress "1.1.1.1"

05Sources

  • ipconfig - Windows CMD
    SS64 · technical · 2026-09-17
    Evidence: Covers ipconfig usage for viewing and renewing DNS settings that must point at the DoH-capable server address.
  • Add-DnsClientDohServerAddress
    Microsoft Learn · vendor-doc · 2026-09-17
    Evidence: Documents the cmdlet parameters: ServerAddress, DohTemplate, AllowFallbackToUdp and AutoUpgrade for configuring DNS-over-HTTPS on a client.

Last verified: 2026-09-18 · Category: Network

06Related solutions

Query DNS records with Resolve-DnsName in PowerShell
WindowsnetworkDNSpowershell

The modern, scriptable replacement for nslookup: ask for exact record types, hit specific DNS servers, and see TTLs as objects.

Low risk ✓ 2026-09-17
Flush the DNS resolver cache on Windows
WindowsnetworkDNStroubleshooting

Purge cached DNS lookups so Windows re-resolves hostnames from scratch — the fix for 'the new server is live but my browser still hits the old one'.

Medium risk ✓ 2026-09-17
Grep on Windows: Select-String
Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17