Setup in Windows

1. Navigate to Start → Settings → Network & internet → Wi‑Fi or Ethernet, then select <Wireless_network> properties if you're using Wi‑Fi.

2. Under DNS server assignment, click Edit → Manual and enable IPv4.

3. In the Preferred DNS and Alternate DNS fields, enter the primary and secondary IPv4 addresses for your selected operating mode:

   
   

   Mode	IPv4
   Basic	Primary: 77.88.8.8 Secondary: 77.88.8.1
   Safe	Primary: 77.88.8.88 Secondary: 77.88.8.2
   Family	Primary: 77.88.8.7 Secondary: 77.88.8.3

4. Configure DNS encryption (DoH) by following the steps for your Windows version.

   Tip

   To check your version number on Windows 11, type winver in the search bar and press Enter. This opens a window with information about your current system version.

   Version 21H1

   Version 21H2 and above

   For each DNS server, select your desired option in the Preferred DNS encryption field:

   • Unencrypted only: Use standard DNS without encryption.
   • Encrypted only (DNS over HTTPS): Use DoH only.
   • Encrypted preferred, unencrypted allowed: Attempt to use DoH and fall back to unencrypted DNS if DoH isn't available.

   For each DNS server, in the DNS over HTTPS field, select On (manual template) and specify the DoH template corresponding to your selected operating mode.

   Mode	DoH template
   Basic	https://common.dot.dns.yandex.net or https://common.dot.dns.yandex.net/dns-query
   Safe	https://safe.dot.dns.yandex.net or https://safe.dot.dns.yandex.net/dns-query
   Family	https://family.dot.dns.yandex.net or https://family.dot.dns.yandex.net/dns-query

5. Apply your changes and verify that encryption is active.

Testing

Verify that DNS traffic is encrypted using Packet Monitor (Pktmon), the network diagnostic tool included in Windows:

1. Open Command Prompt or PowerShell as an administrator.

2. Run the following command to clear any existing network traffic packet filters in Pktmon:

   pktmon filter remove
   

3. Add a filter for DNS port 53:

   pktmon filter add -p 53
   

4. Activate real-time monitoring:

   pktmon start --etw -m real-time
   

   Command Prompt should output all port 53 packets. If DoH is enabled, nothing will appear because Windows is routing DNS requests over HTTPS instead of port 53.

   If the output shows traffic on port 53, it means that DoH isn't configured properly. Check your DNS server settings and verify that the servers support DoH.

1. Open the Start menu and select Settings.

   

2. In the side menu, select Network & internet.

   

3. Select Properties.

   

4. Next to DNS server assignment, select Edit.

   

5. In the window that opens, select Manual.

   

6. Select the protocol version you're using.

   

7. In the Preferred DNS and Alternate DNS fields, enter the IP addresses of the DNS servers that you selected.

   

1. In the search box on the taskbar, type control panel and select the Control Panel in the results.

2. Under View by, select Category.

   

3. In the Network and Internet section, click View network status and tasks.

   

4. Click Change adapter settings.

   

5. Right-click your network connection, then select Properties.

   

6. Click Internet Protocol Version 4 (TCP/IPv4) → Properties.

   

7. Enable the option Use the following DNS server addresses.

   

8. In the Preferred DNS server and Alternate DNS server fields, enter the IP addresses of the DNS servers that you selected.

   

1. Swipe left from the right edge of the screen or move the mouse pointer to the upper-right corner of the screen and then down. Click Search. In the search box, type control panel and select the Control Panel in the results.

   

2. Under View by, select Category.

   

3. In the Network and Internet section, click View network status and tasks.

   

4. Click Change adapter settings.

   

5. Right-click your network connection, then select Properties.

   

6. Click Internet Protocol Version 4 (TCP/IPv4) → Properties.

   

7. Enable the option Use the following DNS server addresses.

   

8. In the Preferred DNS server and Alternate DNS server fields, enter the IP addresses of the DNS servers that you selected.

   

1. Click Start → Control Panel. Under View by, select Category.

   

2. In the Network and Internet section, click View network status and tasks.

   

3. Under View your active networks, click the link next to Connections.

   

4. Click Properties.

   

5. Click Internet Protocol Version 4 (TCP/IPv4) → Properties.

   Note

   If your operating system is password-protected, enter the administrator password.

6. Enable the option Use the following DNS server addresses.

7. In the Preferred DNS server and Alternate DNS server fields, enter the IP addresses of the DNS servers that you selected.

1. Click Start → Control Panel → Network Connections.

   

2. Right-click your network connection, then select Properties.

   

3. Click Internet Protocol (TCP/IP) → Properties.

   

4. Enable the option Use the following DNS server addresses.

   

5. In the Preferred DNS server and Alternate DNS server fields, enter the IP addresses of the DNS servers that you selected.