Tips & Tricks How to enable and test DNS over HTTPS on Windows 10

[Skip1]

Most devices that are connected to the Internet rely on plain text DNS lookups. These lookups "translate" domain names, e.g. teamos-hkrg.com, to IP addresses that devices use to establish connections. Anyone listening on the network, including the ISP, knows exactly which sites and services are opened on the device because of this.
Turning on Windows 10's system-level DoH will enable DNS over HTTPS for all browsers installed on your PC that support it, plus any other internet-based programs that can use it now or in the future. Brave, Chrome, Edge Chromium, Firefox and Opera all currently support DoH, but until now you had to configure each browser’s DoH settings individually—a tedious process if you used more than one. Using the Windows 10 DoH applies your PC’s internet adapter so that every browser or app that accesses it will use the same DNS settings.

You need to be running build 19628 or higher for this functionality to be enabled.
These are the steps to enable DoH system wide on Windows 10:

1. Tap on Start.
2. Type regedit.exe and hit Enter to load the Registry Editor.
3. Confirm the UAC prompt if it is displayed.
4. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters.
5. Right-click on Parameters and select New > Dword (32-bit) Value.
6. Name it EnableAutoDOH.
7. Set its value to 2.
8. Restart the Windows system.

You should know that you need a DNS service that supports DoH. Three popular services include (with ipv4 & ipv6 addresses).
1. Cloudflare (1.1.1.1 , 1.0.0.1 , 2606:4700:4700::1111 , 2606:4700:4700::1001)
2. Google (8.8.8.8 , 8.8.4.4 , 2001:4860:4860::8888 , 2001:4860:4860::8844)
3. Quad9 (9.9.9.9 149.112.112.112 , 2620:fe::fe and 2620:fe::fe:9 )

Here is how you change DNS settings:

1. Select Start > Settings > Network & Internet > Change adapter settings.
2. Right-click on the adapter that is used and select Properties.
3. Double-click on either Internet Protocol Version 4 or 6 (or both one after the other) to set a new DNS provider.
4. Select "Use the following DNS server addresses".
5. Enter the addresses listed above.
6. Click ok to apply the changes.

Note that you can revert the changes at any time by switching to the "automatically" option or editing DNS servers.

Here you can test whether DNS over HTTPS is enabled.

Windows 10 comes with built-in functionality to test whether DNS over HTTPS is working.

1. Open a PowerShell window.
2. Run the following commands one after the other:
   1. pktmon filter remove // removes any existing filters.
   2. pktmon filter add -p 53 // adds traffic filter for port 53, the port that classic DNS uses.
   3. pktmon start --etw -m real-time // start real-time logging of traffic.
3. If DNS over HTTPS is used, it show "little to no traffic".

 

[QuanLam]

Sounds useful! Trying it now!

Thanks for the share!

Sincerely
Quan Lam

 

[fantom]

You You

 

[*Maestro*]

Nicely done I will save this.
Thank you @skip1

 

[SlavkoPejic]

Thank you

 

[leperdu]

Thank you