I switched my PC to encrypted DNS in Windows 11, and browsing felt more private

Q: How do I enable system-wide DNS over HTTPS in Windows 11 through Settings?

Open Settings > Network & Internet > Wi-Fi, click your active connection, and click Edit next to DNS server assignment; switch the dropdown from Automatic to Manual, enable IPv4 (and repeat for IPv6 if desired), and enter your preferred and alternate DNS addresses (for example Cloudflare 1.1.1.1 and 1.0.0.1). In the DNS over HTTPS dropdown choose On (automatic template) so Windows fills the DoH template, then make sure the Fallback to plaintext toggle underneath is turned off to prevent silent downgrades. After saving, open a Command Prompt and run ipconfig /flushdns to clear any stale plain-text answers.

Q: Which DNS providers are pre-recognized by Windows 11 and how do I enter their addresses?

The article says Microsoft’s known-resolvers list includes Cloudflare and Quad9. Enter them in Settings > Network & Internet > (Wi-Fi or adapter) > your connection > Edit next to DNS server assignment, switch Automatic to Manual, enable IPv4 and put Cloudflare’s Preferred/Alternate as 1.1.1.1 and 1.0.0.1 or Quad9’s as 9.9.9.9 and 149.112.112.112 (and for IPv6 Cloudflare use 2606:4700:4700::1111).

Q: What does the 'Fallback to plaintext' toggle do and why should I turn it off?

When enabled, Fallback to plaintext lets Windows retry a DNS lookup using unencrypted DNS on port 53 if the encrypted DNS path fails, which sends your query in the clear. You should turn it off because those silent downgrades undermine the privacy you just enabled, since routine glitches, packet loss, firewalls, or joining a new network can trigger the plaintext fallback. The tradeoff is that turning it off may break captive-portal sign-in pages until you temporarily re-enable it.

My ISP used to get a readable list of every domain I visited. Two minutes in the settings took that away, though not as much as I first assumed.

VIEW GALLERY - 7

Yasir Mahmood

Guides Editor

Published Jul 30, 2026 8:40 PM CDT

4 minutes & 30 seconds read time

Voice: Yasir MahmoodSpeed

0:00 / 7:15

That padlock in your address bar shows up late. Before it appears, my PC has to ask a resolver which IP address belongs to the domain I typed, and that question goes out in plain text on port 53. My ISP reads it. So does the router at a hotel, and so does anyone sniffing the cafe Wi-Fi. I had known about the encrypted DNS option in Windows 11 for years, and I finally audited mine the same afternoon I worked through the command-line tools that fix Windows problems.

Windows 11 has shipped this switch since day one, and it's still off

The feature isn't new, which is the part that bothers me. Windows 11 has supported native DNS over HTTPS since build 22000 on Home and Pro alike, and it doesn't require a third-party app or registry edit.

What sold me on the system-wide version is everything the browser version leaves behind. If I flip the secure DNS switch in Chrome, then Chrome gets protected, and nothing else does. Many non-browser apps, including Windows Update and Teams, use the system DNS client and can benefit from system-wide encrypted DNS. The odd app that ships its own DNS stack can still override the system setting, but most apps don't bother.

Setting it up took me about two minutes. I opened Settings, went to Network & Internet > Wi-Fi, clicked my connection, and hit Edit next to DNS server assignment. Then I switched the dropdown from Automatic to Manual, enabled IPv4, and entered Cloudflare's 1.1.1.1 in Preferred DNS and 1.0.0.1 in Alternate DNS. Quad9 works the same way at 9.9.9.9 and 149.112.112.112.

I switched my PC to encrypted DNS in Windows 11, and browsing felt more private 01

VIEW GALLERY - 7 IMAGES

Both providers are on Microsoft's list of known resolvers, so the DNS over HTTPS dropdown offers On (automatic template), and Windows fills in the rest for you. I repeated the process under IPv6 with 2606:4700:4700::1111.

$248 USD

7 days ago: $248 USD30 days ago: $229.99 USD

7 days ago: $249 USD30 days ago: $229.99 USD

7 days ago: $399.97 CAD30 days ago: $464.97 CAD

7 days ago: $399.99 CAD30 days ago: $464.99 CAD

7 days ago: $397.69 AUD

$397.69 AUD

BuyBuy at Amazon

$499

7 days ago: $49930 days ago: $499

$499

BuyBuy at PC Case Gear

Check Price

CheckCheck Price at Amazon

I switched my PC to encrypted DNS in Windows 11, and browsing felt more private 02

Which resolver you pick is a trust decision more than a technical one. Cloudflare is the fastest I've used, Quad9 blocks known malware domains, and neither one logs your queries. After saving, press Win + R, type cmd, and press Enter to open a Command Prompt window. Then run ipconfig /flushdns so stale plain-text answers don't linger in the cache.

I switched my PC to encrypted DNS in Windows 11, and browsing felt more private 03

The toggle underneath the dropdown is the one that matters

Don't stop at the dropdown, and that's exactly where I'd have stopped a few years ago. Sitting right below it is a toggle called Fallback to plaintext; make sure it's off. Leaving it enabled undermines the exact security layer you just activated.

Our Latest TweakTown Guides

I switched my PC to encrypted DNS in Windows 11, and browsing felt more private 04

When fallback is enabled, and the encrypted path fails, Windows may retry the lookup using plaintext DNS instead of failing outright. It asks the same question the old way, on port 53, in the clear, and your page loads normally. You feel protected, but you aren't.

Frequently Asked Questions

TweakBot answers common questions about this guide using TweakTown's own coverage from this page and related content from our archive. Tap a question to reveal the answer, or type your own below.

Question #1

How do I enable system-wide DNS over HTTPS in Windows 11 through Settings?

Question #2

Which DNS providers are pre-recognized by Windows 11 and how do I enter their addresses?

Question #3

What does the 'Fallback to plaintext' toggle do and why should I turn it off?

Question #4

Will enabling encrypted DNS stop my ISP from knowing which sites I visit?

Enabling encrypted DNS stops your ISP from getting a readable list of the domain-name queries your PC makes, because those DNS lookups go to the chosen resolver instead (the article’s example moved them to Cloudflare). However, your ISP still sees the IP addresses you connect to, and the hostname can still appear in the TLS handshake unless your browser negotiates Encrypted Client Hello, so encrypted DNS hides the DNS question but does not hide the connection.

Answered

Have a question not listed here? Ask below and TweakBot will answer it.

Plenty of ordinary things trigger that downgrade. Your resolver becomes unreachable for a few seconds, the network drops enough packets to trigger a timeout, or a firewall blocks port 443 on that specific address. The most common one for me is joining a new network, because Windows still trusts whatever DNS configuration a network hands it.

I understand why the default exists. Microsoft would rather resolve a name than fail one, since a failed lookup reads as "the internet is down" to most people, and that generates support tickets. Privacy doesn't generate support tickets.

Turn the toggle off anyway. The honest tradeoff is that captive portals such as the hotel and airport login pages tend to break when DNS over HTTPS is required. So you'll flip it back on for the sign-in screen and flip it off again afterward. That's a minor annoyance a handful of times a year, and I'll take it over silent downgrades every day.

If you're on Pro, there's an equivalent Group Policy that enforces this across every adapter at once rather than one connection at a time.

I switched my PC to encrypted DNS in Windows 11, and browsing felt more private 05

Confirm it works, because the dropdown isn't evidence

A configured setting and a working setting are different things, so I check rather than assume. The cheapest check takes five seconds: go back to the connection page in Settings, and the resolver should read Encrypted beside it.

From there, PowerShell tells you more. You can type Get-DnsClientDohServerAddress, and it lists every template Windows knows about, which is how you confirm your resolver was recognized rather than ignored. If you prefer old-school Command Prompt syntax, netsh dns show encryption gets you the same list from a different angle. For a real-world test, Cloudflare hosts a checker at 1.1.1.1/help that reports whether your queries arrived encrypted and which resolver answered them, and DNSLeakTest catches any app still resolving outside the encrypted path.

I switched my PC to encrypted DNS in Windows 11, and browsing felt more private 06

Now for the honest accounting, because this is where the feeling of privacy and the fact of it drift apart. My ISP no longer gets a readable list of the domains I visit. Cloudflare gets it instead. I traded one set of eyes for another set I trust more, and that trade is worth making, but I didn't remove anybody from the picture.

The rest of the leaks stay put. My ISP still sees the IP address I connect to, and an IP address usually identifies the site on its own. The hostname still travels in the TLS handshake unless my browser negotiates Encrypted Client Hello. So encrypted DNS hides the question, not the connection, and it does nothing about my own IP address. Anyone selling it as a VPN replacement is selling you something.

Encrypted lookups are one layer, and the stack keeps going

DNS was the easiest layer to fix, so it made sense to fix it first. From here, I'd point you at resolver-level filtering with something like NextDNS, which strips trackers before they resolve, and at configuring DoH on the router so phones, tablets, and the TV ride along without touching each device. Then turn on Encrypted Client Hello in your browser and close the hostname leak too.