By john Even when a website shows the reassuring padlock of an encrypted connection, one part of the process is often still exposed: the DNS lookup that happens first. DNS over HTTPS, or DoH, closes that gap, and Windows 11 has it built in. Understanding it reveals a genuine, low-effort privacy improvement most people TANGKAS39 never enable.
The Gap DoH Fills
Before your PC connects to a website, it performs a DNS lookup to translate the site’s name into an IP address. Traditionally this lookup travels unencrypted, over what is known as port 53. That means anyone between your PC and the DNS server, such as your internet provider or someone on the same network, can see which domains you look up, even if the sites themselves use encryption.
DoH changes this by wrapping the DNS request inside an encrypted HTTPS connection, sending it over port 443, the same port normal secure web traffic uses. To anyone monitoring the network, your DNS queries now look like ordinary encrypted web traffic, and the domains you resolve are hidden.
Built Into Windows 11
Notably, this is native to Windows 11. Earlier, encrypted DNS on Windows required awkward workarounds, but Windows 11 exposes it in the standard Settings interface, under Network & Internet, in your connection’s DNS server settings. It is not on by default, so if you have never touched it, it is almost certainly off. You enable it by switching DNS to Manual and choosing a provider that supports encryption, such as Cloudflare, Google, or Quad9; Windows then shows your DNS as Encrypted.
What It Does and Doesn’t Do
Here is the honest scope. DoH hides your DNS queries from your internet provider and others on the network, which is a real privacy gain and also makes DNS tampering harder. But it is not anonymity. You are shifting trust from your provider to whichever DNS resolver you choose, and that resolver can still see your queries, so pick one whose privacy practices you trust.
It also does not hide everything. After the lookup, your provider can still see the IP addresses you connect to, and other metadata can sometimes reveal the destination. DoH is one useful layer, not a complete solution.
Should You Enable It?
For most home users, yes. It closes a well-documented privacy leak with essentially no performance cost, often using resolvers as fast as your provider’s. The main cautions are choosing a resolver you trust, and being aware that on some managed or corporate networks, or with parental-control setups that rely on inspecting DNS, encrypted DNS can interfere and may need adjusting.
The Takeaway
DNS over HTTPS encrypts the lookups your PC makes, hiding which sites you resolve from your provider and the network. Windows 11 makes it a simple built-in setting. It is not total privacy, but as a single toggle with a real payoff, it is one of the easier privacy upgrades available.