Verify DNS over HTTPS in Windows 11 with Packet Tools

DNS over HTTPS (DoH) enhances online privacy by encrypting standard DNS lookups inside HTTPS traffic. This guide outlines how to use packet inspection tools, specifically Wireshark and the built-in Windows pktmon utility, to capture network traffic in Windows 11 and confirm that your DNS queries are securely encrypted over port 443 rather than transmitted as plaintext over port 53.

Step 1: Ensure DNS over HTTPS is Enabled in Windows 11

Before analyzing network packets, confirm DoH is active on your system:

Open Settings (Win + I) and navigate to Network & internet.
Select your active connection (Wi-Fi or Ethernet).
Click Hardware properties (or Edit next to DNS server assignment).
Set DNS to Manual, enter a DoH-compatible IPv4/IPv6 address (such as Cloudflare 1.1.1.1 or Google 8.8.8.8), and set DNS over HTTPS to Encrypted only (DNS over HTTPS).

Step 2: Verify DoH Using Wireshark

Wireshark is the standard packet analysis tool for inspecting protocol encryption.

1. Start Capture

Launch Wireshark with administrator privileges.
Select your active network adapter and double-click it to start capturing packets.

2. Test for Plaintext DNS Leaks

In the top filter bar, enter:
```
dns
```
Open a terminal or browser and query a domain (e.g., run ipconfig /flushdns followed by accessing a new website).
Expected Result: If DoH is working correctly, standard plaintext DNS queries (UDP/TCP port 53) will show zero results or only internal local-link queries (such as MDNS/LLMNR), confirming that public domain queries are not leaking unencrypted.

3. Inspect the Encrypted DoH Stream

Clear the filter and enter:
```
tls.handshake.type == 1 or (tcp.port == 443 and ip.addr == <Your_DoH_Server_IP>)
```
(Replace <Your_DoH_Server_IP> with your configured DNS IP, e.g., 1.1.1.1)
Generate DNS requests by browsing to new websites.
Expected Result: You will observe standard TLS handshakes and subsequent Application Data packets sent over TCP port 443. The contents of these packets will be encrypted and unreadable, confirming that your DNS queries are securely wrapped inside HTTPS.

Step 3: Verify DoH Using Windows Built-in `pktmon`

If Wireshark is not installed, you can use the built-in Windows Packet Monitor.

1. Filter for Standard Port 53 Traffic

Open PowerShell or Command Prompt as Administrator and run:

pktmon filter remove
pktmon filter add DNS_Plaintext -p 53
pktmon start --etw

2. Generate Network Activity

Flush the DNS cache and make a request:

ipconfig /flushdns
ping example.com

3. Stop and Review the Capture

Stop the monitoring session:

pktmon stop

Analysis: If the packet count for the DNS_Plaintext filter shows 0, your system is not using traditional plaintext DNS.

4. Filter for DoH Traffic on Port 443

Reset filters to monitor DoH IP traffic:

pktmon filter remove
pktmon filter add DoH_Traffic -p 443 -i 1.1.1.1
pktmon start --etw

Run ipconfig /flushdns and resolve another domain, then run pktmon stop. You will see packet counters increment on port 443, validating that DNS queries are routing through the encrypted HTTPS channel.