Network and Internet Enable DNS over TLS (DoT) in Windows 11

Cliff S · May 31, 2023

I used Cloudflares secure DNS against malware, not just set in windows, but also on my Fritz!box router:

Code:

Use other DNSv4 servers

Preferred DNSv4 server
1.1.1.2
Alternative DNSv4 server
1.0.0.2


Use other DNSv6 servers

Preferred DNSv6 server
2606:4700:4700::1112
Alternative DNSv6 server
2606:4700:4700::1002


DNS over TLS (DoT)

√ Encrypted name resolution in the internet (DNS over TLS)
√ Force a certificate check for encrypted name resolution in the internet
Only allow servers that are fully validated.
This setting should be disabled only if the identity of the server is known.

√ Allow fallback to non-encrypted name resolution in the internet
   Allow a fallback to non-encrypted DNS traffic if all encrypted servers fail.

   Attention: If this setting is disabled, a complete DNS failure can result.


Resolved Names of the DNS Server
security.cloudflare-dns.com

@Brink, my question is, do I need to set it up in windows when I have it on my router already(even though I did do that for all my PCs)

Brink · May 31, 2023

Cliff S said:
@Brink, my question is, do I need to set it up in windows when I have it on my router already(even though I did do that for all my PCs)

Hey Cliff,

You shouldn't need to since the source router is already set to use that DNS.

You could set the DNS for Windows just to make sure though.

Cliff S · May 31, 2023

Thanks Shawn

Cliff S · Feb 16, 2024

Some information I found regarding DoT versus DoH: Understanding DoT and DoH (DNS over TLS vs. DNS over HTTPS) - ClouDNS Blog

Which is better, DoT or DoH?
The answer to this depends on the company or even each IT security professional’s specific needs. However, there are a few facts that can be pointed out:

From a network security standpoint, DoT is often preferred because it allows network administrators to monitor and block DNS queries. This helps them identify and stop potential malicious traffic.

From a privacy perspective, DoH might be preferable since DNS queries are hidden within the larger flow of HTTPS traffic. This provides users with more privacy but makes it harder for network administrators to block malicious traffic, as doing so would require blocking all other HTTPS traffic as well.