Configure Static DNS with DoH on Windows 11

Setting up static DNS servers with DNS-over-HTTPS (DoH) in Windows 11 enhances your privacy and security by encrypting standard DNS queries. This guide provides clear, step-by-step instructions to manually assign static IPv4 or IPv6 DNS addresses and enable built-in DoH encryption templates directly through the Windows 11 Settings app.

Step 1: Open Network Adapter Properties

  1. Press Win + I to open Settings.
  2. Select Network & internet from the left sidebar.
  3. Click on your active connection type: Ethernet (for wired connections) or Wi-Fi (for wireless connections).
  4. If using Wi-Fi, click on Manage known networks and select your current network to open its properties.

Step 2: Edit DNS Server Assignment

  1. Scroll down to find the DNS server assignment section.
  2. Click the Edit button next to it.
  3. In the drop-down menu, change the setting from Automatic (DHCP) to Manual.

Step 3: Configure Static DNS and Enable DoH

  1. Toggle the IPv4 switch to On (you can also enable IPv6 if your network supports it).
  2. Enter your chosen static DNS addresses into the Preferred DNS and Alternate DNS fields. Common privacy-focused providers with native DoH support in Windows 11 include:
    • Cloudflare: 1.1.1.1 (Preferred) and 1.0.0.1 (Alternate)
    • Google: 8.8.8.8 (Preferred) and 8.8.4.4 (Alternate)
    • Quad9: 9.9.9.9 (Preferred) and 149.112.112.112 (Alternate)
  3. Under DNS encryption, select one of the following options:
    • Encrypted only (DNS over HTTPS): Windows will drop DNS requests if DoH fails.
    • Encrypted preferred, unencrypted allowed: Windows will fall back to unencrypted DNS if DoH fails.
  4. Set the DNS encryption preference for both the Preferred and Alternate DNS entries.
  5. Click Save to apply the configuration.

Step 4: Adding Custom DoH Providers (Optional)

If you use a custom DNS provider not recognized automatically by Windows 11, you must register the DoH template via PowerShell:

  1. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).

  2. Run the following command to register a custom DoH server template:

    netsh dns add encryption server=<IP_ADDRESS> dohtemplate=<DOH_URL> autoupgrade=yes udpfallback=no

  3. Replace <IP_ADDRESS> with the static IP of your DNS server and <DOH_URL> with the provider’s HTTPS endpoint.

  4. Return to Windows Settings and apply the static DNS server using the steps outlined above.