How to encrypt your DNS without touching your router using DNS over HTTPS

If you want to browse more privately without having to deal with your router, the solution is to enable DNS over HTTPS (DoH) directly on your devices and browsers . This technology encrypts DNS queries so they no longer travel in plain text, making it much harder for anyone trying to snoop or manipulate your online activity.

In addition to the technical aspects, here you'll find specific steps for Chrome, Edge, Firefox, Windows (including Windows Server 2022), Linux, macOS, and Android , along with tips for verifying that everything is working, alternatives like DoT/DNSCrypt, and business considerations. All with a practical approach and without touching your router.

What is DoH and why you should care

The DNS is the Internet's address guide: it transforms names like example.com into IPs that computers understand; the perennial problem is that traditional DNS queries are sent unencrypted , exposing which domains you resolve and allowing for manipulation along the way.

With DoH, the resolver and your computer communicate using HTTPS (port 443), integrating TLS to encrypt and authenticate requests . This makes it more difficult to spy on, hijack DNS, poison caches, and perform other malicious activities on open networks like airport Wi-Fi.

Regarding performance, independent measurements (such as those from samknows) indicate that the differences compared to classic DNS (Do53) are minimal or negligible in actual page load times . Furthermore, the use of persistent HTTPS connections helps reduce connection latency.

Note that although DoH improves privacy, it does not erase all possible traces : transport or application layer metadata (e.g., SNI or OCSP in certain contexts) still remains, so it is advisable to combine it with good practices (TLS 1.3, HTTP/3, end-to-end encryption, etc.).

If you're looking for alternatives or add-ons, there's DNS over TLS (DoT), DNSCrypt, DNSCurve, and DNSSEC . DoT encrypts at the transport layer on port 853, DNSSEC validates the integrity of the response, and DNSCrypt adds authentication and privacy options; each has its place in the ecosystem.

DoH vs DoT, ports and layers: the essentials

With DoT, the DNS message goes directly into a TLS tunnel (port 853). With DoH, the DNS travels as HTTP payload within HTTPS (port 443) ; this makes DoH traffic blend in with the rest of the web traffic, bypassing simple port blocking.

The protocol relies on TLS: Client Hello and Server Hello exchange and certificate validation; after that, the entire query/response flow travels encrypted . TLS 1.3 reduces routing, speeds up, and minimizes correlation risks, and HTTP/3 (over QUIC) can improve multiplexing against data loss.

There is also DNS over QUIC , similar to DoT but relying on QUIC to avoid inline header blocking. However, both HTTP/3 and DNS/QUIC depend on accessible UDP, so they are not always available and may force outages to HTTP/2 or classic TLS.

Practical privacy: DoH designers discourage the use of HTTP cookies in DNS resolutions ; most implementations adhere to this. Even so, the operating mode must be monitored: opportunistic (with possible fallback to plaintext) or strict (if there is no secure transport, it fails to resolve).

One thing you might see mentioned: it's sometimes said that DoH doesn't apply to HTTP sites . The correct thing is that DoH encrypts the name resolution, not the website content; if the page is HTTP, subsequent browsing won't be encrypted, but the DNS query can still be done over HTTPS.

Enable DoH in major browsers

It's easiest to do this in web browsers. Chrome, Edge, and Firefox already incorporate DoH and allow you to activate it quickly, with slight variations depending on the version.

Google Chrome

In current versions, go to chrome://settings/security and enable Secure DNS; you can use your current provider if it supports DoH or choose a recommended one (e.g., Cloudflare or Google ) . In older versions, the switch was in flags: chrome://flags/#dns-over-https (Secure DNS lookups option set to Enabled).

Chrome also tested an opportunistic mode: if your system resolver matches an internal list of DoH providers , it updates the transport without touching IPs; in corporate environments, this is usually disabled by policy.

Microsoft Edge (Chromium)

Similar process: edge://settings/privacy for secure DNS in recent versions; in previous builds, the flag edge://flags/#dns-over-https worked (Secure DNS lookups set to Enabled). It supports known providers or the one you already use if it supports DoH.

Mozilla Firefox

Open the menu, go to Settings , and in the General section, tap Network Settings ; there you'll see Enable DNS over HTTPS and you can choose a provider (Cloudflare, NextDNS, or a custom one) . Firefox supports TRR modes: opportunistic or strict, accessible from about:config (network.trr.mode parameter).

Mozilla even tested region-based activations with resolvers that adhere to strict privacy policies . For businesses, templates exist to disable DoH or target it to internal resolvers.

Configure DoH on your system: Windows 10/11 and Windows Server 2022

Windows 10/11 (client)

In modern versions you can enable secure DNS from Settings > Network & Internet , choosing your interface (Wi-Fi/Ethernet), editing DNS in Manual and checking Preferred encryption for IPv4/IPv6 with resolver IPs that support DoH.

If you're running on the latest version, there's a registry entry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters . Create a DWORD (32-bit) value: EnableAutoDoh=2 ; then restart your computer. This only works with resolvers that support DoH.

To check if you're using Do53 instead of DoH, Windows 10 2004 allows you to run: `pktmon filter add -p 53` and then `pktmon start --etw -m real-time` ; if you see a lot of traffic on port 53, you're still using clear . The `real-time` parameter only exists from 2004 onwards.

Windows Server 2022 (DNS client with DoH)

Starting with Windows Server 2022, the DNS client supports DoH. In Settings > Network & Internet > Ethernet , select the interface and go to DNS Settings > Edit . Under Manual, enter your DNS servers and use the Preferred DNS Encryption dropdown menu.

• Encryption only (DoH): maximum shielding; if the server does not support DoH, it does not resolve.
• Prefer encryption and allow unencrypted: attempts DoH and if it fails, falls back to plain text (no prompt).
• Unencrypted only: Classic DNS without TLS.

Save the changes. If you configure Set-DnsClientServerAddress in PowerShell , the DoH mode depends on whether the server is in the known DoH table . Currently, it cannot be configured using Windows Admin Center or sconfig.

Group Policy (GPO) for DoH in Windows Server 2022

Path: Computer Configuration > Administrative Templates > Network > DNS Client , Configure DNS over HTTPS (DoH) policy with options:

• Allow DoH: Uses DoH if the server supports it; otherwise, it goes unencrypted.
• Ban DoH: Blocks DoH on the client.
• Require DoH: forces DoH; if not available, there is no resolution.

Important warning: Do not use Require DoH on domain-joined computers , because Active Directory relies on the Windows server's DNS, which does not handle DoH queries. If you need to encrypt on AD DS networks, consider end-to-end IPsec for internal DNS traffic.

Known DoH Servers on Windows

Consult the list integrated with Get-DnsClientDohServerAddress in PowerShell. It usually includes, among others:

Supplier	Locations
Cloudflare	1.1.1.1 1.0.0.1 2606: 4700: 4700 :: 1111 2606: 4700: 4700 :: 1001
Google	8.8.8.8 8.8.4.4 2001: 4860: 4860 :: 8888 2001: 4860: 4860 :: 8844
Quad9	9.9.9.9 149.112.112.112 2620: fe :: fe 2620: fe :: fe: 9

To add a new one: Add-DnsClientDohServerAddress -ServerAddress 'IP' -DohTemplate 'DoH-template-URL' -AllowFallbackToUdp $False -AutoUpgrade $True . This prevents a fallback to UDP and enables automatic updates.

NRPT with DoH

The Name Resolution Policy Table allows you to force specific domains to be resolved by a specific DNS server; if this server supports DoH and is known, those queries will travel encrypted for those namespaces.

Linux, macOS, and Android/iOS: Practical Routes

Linux with dnscrypt-proxy + systemd-resolved

A flexible way to implement DoH on Linux is to use dnscrypt-proxy as a local proxy and hook it into systemd-resolved . Installation examples:

sudo apt update
sudo apt install dnscrypt-proxy

sudo pacman -S dnscrypt-proxy

sudo dnf install dnscrypt-proxy

Enable the service: `sudo systemctl enable dnscrypt-proxy` and ` sudo systemctl start dnscrypt-proxy` . Then edit `/etc/dnscrypt-proxy/ dnscrypt-proxy.toml` and choose DoH servers (for example, Cloudflare) by enabling their names in the `[static]` section.

Restart the proxy with `sudo systemctl restart dnscrypt-proxy` . Then, point systemd-resolved to 127.0.0.1 in `/etc/systemd/resolved.conf` (set DNS options to `127.0.0.1` and `DNSStubListener=yes`) and restart: `sudo systemctl restart systemd-resolved`.

Finally, link the stub to /etc/resolv.conf so that all apps go through resolved:

sudo rm /etc/resolv.conf
sudo ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

Check with `dig google.com @127.0.0.1` ; if it responds with `localhost`, the queries are already going through the encrypted proxy . You can also use `nslookup` to validate this behavior.

Linux with DoT integrated into systemd-resolved

Since systemd version 239 , DNSOverTLS has been available ; strict mode was added in version 243. However, there are limitations to certificate validation, and SNI is not sent in some backends, making it easier for an attacker to exploit the system. In sensitive environments, strict DoH with a dedicated client (e.g., Cloudflared) is preferable.

Dedicated DoH client (Linux, macOS, Windows)

The `cloudflared proxy-dns` command exposes a local DNS server that forwards DNS servers via Domain-based DNS (DoH) to your preferred resolver (Cloudflare by default), adjustable with `proxy-dns-upstream` . It's a quick way to implement strict DNS at the system level without modifying your router.

MacOS

In System Preferences > Network , choose your interface, go to Advanced > DNS , and add resolvers such as 1.1.1.1/1.0.0.1, 8.8.8.8/8.8.4.4, or Quad9. If your provider supports DoH, the system may be able to take advantage of it depending on the version and configuration; there isn't always a clear indicator, so check with online tools or by capturing network traffic.

If you notice any blocking, a firewall or security suite may be intercepting the 443; try temporarily disabling them to isolate the problem.

Android and iOS

Android 9 and later offer private DNS : automatic (opportunistic) mode or strict mode by setting the provider's hostname. On iOS and Android, apps like 1.1.1.1 enable DoH or DoT in strict mode using the system's VPN interface.

Routers, Mikrotik and corporate environments

If you want to obfuscate DNS from the router without changing clients, there are firmwares that support DoH/DoT. On Mikrotik, you can enable DoH by uploading and importing the provider's root CA (e.g., DigiCert Global Root CA for Cloudflare) and configuring the DoH URL. Verify that the status is DoH=Yes at https://1.1.1.1/help .

The steps in Mikrotik: upload the certificate to Files, import it via System > Certificates > Import , and configure DNS to use DoH; you can also do this via the terminal if you prefer. Once operational, the router will prioritize the encrypted channel.

In enterprises, DoH has significant repercussions: monitoring, filtering, parental controls, and split horizons become complicated if apps bypass the corporate resolver. Therefore, many administrators use strict DoH/DoT policies, targeting their own resolvers and blocking public ones, or manage devices with GPO/MDM to force them to use controlled endpoints.

A real risk is the centralization of DNS data by a few public providers while smaller ISPs and resolvers adopt Domain Name System (DNS). There is a balance between privacy, governance, and data sovereignty that each organization must weigh.

Checks, performance and extended security

To check DoH, open nslookup or dig and see which server responds; some test pages indicate whether your DNS is using HTTPS . On Windows, 1.1.1.1/help is useful, and pktmon helps detect traffic on port 53 when it shouldn't be there.

In terms of performance, field tests show negligible differences compared to Do53 in page load and resolution times. HTTP/3/QUIC and persistent connections help to minimize the impact.

Remember that DoH protects the transport up to the resolver, but it doesn't protect you from upstream spoofed responses . That's what DNSSEC is for ; it allows you to validate the authenticity of the response from the authoritative server. It's also advisable to minimize or disable EDNS Client Subnet if you're concerned about exposure of the source subnet.

Finally, keep in mind that some older guides (more than a year old) may be outdated in menu paths, flags, or support; if something doesn't match your system, check the current version or documentation.

If you want to strengthen privacy without touching the router, combining strict DoH in the browser or system, a good public (or corporate) resolver, DNSSEC validation, and verification with tools will leave you very well covered for day-to-day use, even on untrusted networks.