How do I enable DNS over TLS in Microsoft Windows 11 version 24H2?

wonder woman · Dec 12, 2024

Hi

Could someone show me how to enable DNS over TLS?

The guide, entitled Enable DNS over TLS (DoT) in Windows 11, by @Brink was based on a preview release.

Thanks for your help.

XxXxX · Dec 12, 2024

is this of any help.

How to Enable DNS Over HTTPS on Windows 11

Keep your DNS requests private for a more secure browsing experience.

www.howtogeek.com

i use Cloudflare Warp which does a little bit more then secure DNS.

Download WARP · Cloudflare Zero Trust docs

You can download the WARP client from Zero Trust. To do that, go to Settings > Resources and scroll down to Download the WARP client.

developers.cloudflare.com

best of luck, Steve ..

wonder woman · Dec 12, 2024

Hi Steve

What a coincidence that you and someone I once knew a long time ago shared the same first name. His surname was Trevor.

XxXxX said:
is this of any help.

How to Enable DNS Over HTTPS on Windows 11

Keep your DNS requests private for a more secure browsing experience.

www.howtogeek.com

Thanks for your tip but no thanks.

DNS over TLS is entirely different from DNS over HTTPS. It's like comparing apples and oranges.

The former can only be used in Windows builds of at least 25000.

XxXxX said:
i use Cloudflare Warp which does a little bit more then secure DNS.

Download WARP · Cloudflare Zero Trust docs

You can download the WARP client from Zero Trust. To do that, go to Settings > Resources and scroll down to Download the WARP client.

developers.cloudflare.com

Word of caution

Do NOT download stuff from websites and run them on your device unless the apps are open-source.

Cloudflare is a US company.

Remember what Edward Snowden said about the "Five Eyes".

Best wishes.

Diana Prince

Brink · Dec 12, 2024

Hello, and welcome @wonder woman

The steps in the tutorial are still the same for DNS over TLS (DoT) in current releases.

What are you seeing different?

Enable DNS over TLS (DoT) in Windows 11

This tutorial will show you how to change your DNS Server address and enable DNS over TLS (DoT) in Windows 11. A DNS (Domain Name System) server is the service that makes it possible for you to open a web browser, type a domain name and load your favorite websites. DNS over HTTPS (DoH) is a...

www.elevenforum.com

wonder woman · Dec 12, 2024

Brink said:
Hello, and welcome @wonder woman

Hello dear,

Your avatar reminds me of a friend who came from that planet many eons ago.

Brink said:
The steps in the tutorial are still the same for DNS over TLS (DoT) in current releases.

Thanks for confirming it.

When I first read your guide, I was wondering what you meant by (and I quote below)

Starting with Windows 11 build 25158 (24H2), DNS over TLS (DoT) testing is now available for Windows DNS client query protection.

To the best of my knowledge, the build of Windows 11 that was first released as stable (non-preview, non-insiders) to the public in October 2024 was 261000.

However your tutorial mentioned build 25158 which was a preview/insider release.

Secondly, I don't know what you meant by DNS over TLS testing.

Brink said:
What are you seeing different?

I'm unable to answer your question because the results of Google Search gave me guides that were based on preview/insiders builds of Windows 11. Some of them were written two years ago (such as yours). A lot of stuff might have changed in Windows 11's programming code since two years ago.

Best regards.

Diana Prince

Brink · Dec 12, 2024

The starting with build number is just when it was first available, but is available in current releases.

Testing is just a word Microsoft used when DNS over TLS (DoT) was in preview.

You can use steps 12 to 20 to confirm if you have DNS over TLS (DoT) available and enabled or not.

Enable DNS over TLS (DoT) in Windows 11

This tutorial will show you how to change your DNS Server address and enable DNS over TLS (DoT) in Windows 11. A DNS (Domain Name System) server is the service that makes it possible for you to open a web browser, type a domain name and load your favorite websites. DNS over HTTPS (DoH) is a...

www.elevenforum.com

abactuon · Dec 12, 2024

But why just Windows?
It can be done in a modern router.

I have an old router.

Waiting DoQ
DNS-over-HTTP/3 (DNS-over-QUIC)

wonder woman · Dec 12, 2024

abactuon said:
But why just Windows?
It can be done in a modern router.

I don't own the router, my dear, that's why I need to do it in Microsoft Windows.

abactuon said:
DNS-over-HTTP/3 (DNS-over-QUIC)

My topic is about DNS over TLS.....

wonder woman · Dec 16, 2024

Dearie

Brink said:
The starting with build number is just when it was first available, but is available in current releases.

Testing is just a word Microsoft used when DNS over TLS (DoT) was in preview.

Thanks for your clarification.

It'd be good to update said guide to reflect the stable release. What do you think?

Brink said:
You can use steps 12 to 20 to confirm if you have DNS over TLS (DoT) available and enabled or not.

I confirm that my Windows 11 build 26100.2605 has DNS over TLS (DoT) now. Thanks.

You know what? I found out that my web pages load faster by at least 5 seconds compared to when I was using DoH (DNS over Https).

There's something that you probably already knew.

In a command prompt with admin privilege, when I typed the following commands

Code:

netsh dns add encryption server=149.112.112.112 dothost=: autoupgrade=yes

netsh dns add encryption server=2620:fe:::9 dothost=: autoupgrade=yes

The error message was

Code:

Element not found

I simply ignored it.

Would you know what "Element not found" mean?

Best wishes

Diana Prince

Brink · Dec 16, 2024

wonder woman said:
Dearie

Thanks for your clarification.

It'd be good to update said guide to reflect the stable release. What do you think?

I confirm that my Windows 11 build 26100.2605 has DNS over TLS (DoT) now. Thanks.

You know what? I found out that my web pages load faster by at least 5 seconds compared to when I was using DoH (DNS over Https).

There's something that you probably already knew.

In a command prompt with admin privilege, when I typed the following commands

Code:

netsh dns add encryption server=149.112.112.112 dothost=: autoupgrade=yes netsh dns add encryption server=2620:fe:::9 dothost=: autoupgrade=yes

The error message was

Code:

Element not found

I simply ignored it.

Would you know what "Element not found" mean?

Best wishes

Diana Prince

Hello Diana, :shawn:

The tutorial does indeed state it's available starting with 24H2.

"Element not found" could be from an error in the command. Possible extra space, or IP address.

The main thing is if you see this below at step 19 to confirm each DNS IP address shows DNS-over-TLS host with Auto-upgrade set to Yes.

wonder woman · Dec 18, 2024

Brink said:
Hello Diana,

Dearie

Brink said:
The tutorial does indeed state it's available starting with 24H2.

There's a good excuse for you to update said tutorial.

Why?

The alternate IPv6 address for Quad9 has an extra colon.

Brink said:
"Element not found" could be from an error in the command. Possible extra space, or IP address.

Per your suggestion, I did everything from scratch. This time round, there was no "Element not found" error message.

Brink said:
The main thing is if you see this below at step 19 to confirm each DNS IP address shows DNS-over-TLS host with Auto-upgrade set to Yes.

After completing all the steps as described in said tutorial, I rebooted my computer and it was connected to the router via WiFi.

However, I have no DNS resolution because I can't even access sites like google.com, yahoo.com, microsoft.com, etc....

I repeated the steps from Step #1 to Step #20 for Google, Cloudflare and Quad9 and the result is the same: I'm unable to access websites.

Could you help me to troubleshoot please, dearie?

After all, you wrote the tutorial and so I assume you know much more than me.

Thanks for your help.

Brink · Dec 18, 2024

@wonder woman,

Let's start off with the basics to see if this below may sort it.

Right click on the Network icon on the taskbar system tray, and click on Diagnose network problems.

Next, click on the Run network tests button in the "Get Help" app, and follow any diagnostics questions/steps to see what it may find and fix.

wonder woman · Dec 18, 2024

Brink said:
@wonder woman,

Dearie

Thanks for your reply.

Brink said:
Let's start off with the basics to see if this below may sort it.

Right click on the Network icon on the taskbar system tray, and click on Diagnose network problems.

Next, click on the Run network tests button in the "Get Help" app, and follow any diagnostics questions/steps to see what it may find and fix.

I guess I didn't explain well in my preceding post.

Just to let you know that my computer is able to connect to the router via WiFi.

However, my operating system build 26100.2605, is unable to resolve hostnames such as google.com. yahoo.com, microsoft.com etc.

P.S.: I hope I didn't give you much work (if only Batman or Cyborg were with me right now. Those two are the really brainy ones)

Brink · Dec 18, 2024

wonder woman said:
Dearie

Thanks for your reply.

I guess I didn't explain well in my preceding post.

Just to let you know that my computer is able to connect to the router via WiFi.

However, my operating system build 26100.2605, is unable to resolve hostnames such as google.com. yahoo.com, microsoft.com etc.

P.S.: I hope I didn't give you much work (if only Batman or Cyborg were with me right now. Those two are the really brainy ones)

That's ok. I was just wanting to start with the basic troubleshooter above to see if you may get lucky having it fix it for you. If not, it may provide more details to diagnose with.

If you set DNS to automatic or use DNS over HTTPS instead, are you able to connect to the Internet for now until we work through it not being able to with DNS over TLS?

wonder woman · Dec 19, 2024

Dearie

Brink said:
That's ok. I was just wanting to start with the basic troubleshooter above to see if you may get lucky having it fix it for you. If not, it may provide more details to diagnose with.

When I've some free time today, I shall start with the basic troubleshooting per your suggestion. I shall keep you informed of the results of the basic troubleshooting.

Brink said:
If you set DNS to automatic or use DNS over HTTPS instead, are you able to connect to the Internet for now until we work through it not being able to with DNS over TLS?

Your question has two parts. Allow me to answer your first part.

Based on your tutorial, I went through Steps 6 to 20.

DNS over HTTPS was set to OFF.

Please note that for

IP assignment: Automatic (DHCP)

I then rebooted my computer.

My computer could connect to the router via WiFi.

However, my OS couldn't resolve hostnames.

Now to answer the second part of your question.

I reverted to DNS over HTTPS and that was how I could feedback to you that DNS over TLS wasn't and still isn't working for me.

I am able to post this reply because I have switched back to DNS over HTTPS.

P.S. I noticed that in Step 9 of said tutorial, Quad9's DNS server address is wrong. You haven't corrected it.

TairikuOkami · Dec 19, 2024

wonder woman said:
However, my OS couldn't resolve hostnames.

Do you have TCP port 853 allowed in a firewall/router?

You can check via LiveTcpUdpWatch, whether PC makes DoT requests.
If they are sent, but not received, then something is blocking the port.

Windows settings does not show DoT, it shows as managed only.

What does this command report?

Code:

netsh dns show global

I got DoT working when I disabled DoH.

Code:

netsh dns set global doh=no
netsh dns add global dot=yes
netsh dns add encryption server=1.1.1.2 dothost=security.cloudflare-dns.com:853 autoupgrade=yes udpfallback=no
netsh dns add encryption server=1.0.0.2 dothost=security.cloudflare-dns.com:853 autoupgrade=yes udpfallback=no

abactuon said:
But why just Windows?

Malware/Apps can simply bypass the router: Browser > Windows > Router

wonder woman · Dec 19, 2024

Dearie

Brink said:
Right click on the Network icon on the taskbar system tray, and click on Diagnose network problems.

Per your suggestion, I click the "Diagnose network problems" and below is the screenshot of the result:

DNS over TLS - The DNS service couldn't process the DNS request.webp

Brink said:
Next, click on the Run network tests button in the "Get Help" app, and follow any diagnostics questions/steps to see what it may find and fix.

Where did you get the "Get Help" app please?

Brink · Dec 19, 2024

wonder woman said:
Dearie

Per your suggestion, I click the "Diagnose network problems" and below is the screenshot of the result:

View attachment 119785

Where did you get the "Get Help" app please?

The 'Get Help" app opens when you click on "Diagnose network problems". Your screenshot is of the "Get Help" app.

Go ahead and also do what TairikuOkami posted above. It'll help provide more diagnostic info to continue from.

wonder woman · Dec 19, 2024

Brink said:
The 'Get Help" app opens when you click on "Diagnose network problems". Your screenshot is of the "Get Help" app.

Thanks, dearie, for your clarification.

Brink said:
Go ahead and also do what TairikuOkami posted above. It'll help provide more diagnostic info to continue from.

My installed anti-virus software reported that LiveTcpUdpWatch suggested by @TairikuOkami is infected.

I wonder if there are open-source alternatives of LiveTcpUdpWatch.

abactuon · Dec 19, 2024

As written above, install Cloudflare WARP.
Let the professionals take care of your security.

How do I enable DNS over TLS in Microsoft Windows 11 version 24H2?

New member

My Computer

Well-known member

My Computers

New member

My Computer

Administrator

My Computers

New member

My Computer

Administrator

My Computers

Well-known member

My Computer

New member

My Computer

New member

My Computer

Administrator

My Computers

New member

My Computer

Administrator

My Computers

New member

My Computer

Administrator

My Computers

New member

My Computer

Microsoft 365 Basic

My Computer

New member

My Computer

Administrator

My Computers

New member

My Computer

Well-known member

My Computer

Similar threads