Most people assume their browsing is private once they lock their computer or use HTTPS, but your ISP can still see the websites you visit unless you change a key Windows 11 privacy setting. Enabling the built-in Encrypted DNS (DNS over HTTPS) in Windows 11 helps prevent your internet provider from logging the domains you type into your browser.

Why your ISP can see your browsing activity

When you type a website address, your device normally asks a DNS server to translate that domain into an IP address. Those DNS queries have traditionally been sent unencrypted, giving ISPs a clear record of the sites you look up.

As a result, your ISP can build a history of visited domains and use or sell that metadata. To stop that visibility, you need to encrypt DNS queries or hide them entirely with other tools.

What is Encrypted DNS and how it protects privacy

Encrypted DNS (commonly called DNS over HTTPS, or DoH) sends your DNS requests through an encrypted channel to a resolver you choose. This prevents third parties, including your ISP, from easily reading which domain names you request.

It’s important to note that encrypted DNS hides domain lookup data but doesn’t anonymize everything. Your ISP may still see the IP addresses you connect to and some traffic metadata unless additional protections are used.

How to enable Encrypted DNS in Windows 11

Fortunately, Windows 11 includes a native option to use encrypted DNS without installing extra software. First, open Settings and go to Network & Internet.

Next, select your active connection (Wi-Fi or Ethernet), find DNS settings, and choose Edit. Switch to Manual DNS and toggle the option for encrypted DNS providers. Finally, enter a provider such as Cloudflare, Google, or Quad9 and save the changes.

Step-by-step checklist

1. Open Settings > Network & Internet. 2. Click your connection (Wi‑Fi or Ethernet). 3. Select DNS settings and press Edit. 4. Choose Manual, enable Encrypted DNS and add a provider. 5. Save and restart your browser if needed.

Following these steps routes your DNS queries through a secure resolver and greatly reduces the chances your ISP can log the domains you visit.

What encrypted DNS does and doesn’t do

Encrypted DNS prevents easy snooping of DNS queries, which blocks ISPs from collecting a tidy list of domains you type. It’s a strong privacy improvement for everyday browsing.

However, encrypted DNS does not hide the destination IP addresses, and some legacy server-side features like SNI (Server Name Indication) could still expose domain names. For stronger protection, consider combining encrypted DNS with other tools.

Combine encrypted DNS with a VPN or private browser

For broader privacy, using a reputable VPN routes all your traffic through an encrypted tunnel, masking IP addresses from your ISP. A VPN plus encrypted DNS gives layered protection against both DNS logging and IP-level visibility.

Additionally, privacy-focused browsers and extensions can limit tracking, block third-party cookies, and reduce fingerprinting — all useful complements to the Windows 11 setting.

Choosing a trusted DNS provider

Select a reliable resolver that supports DoH and has a clear privacy policy. Popular choices include Cloudflare (1.1.1.1), Google (8.8.8.8 with DoH endpoints), and Quad9 (9.9.9.9).

Look for providers that commit to not logging identifiable user data and that publish transparency reports. Performance and geographic proximity can also affect speed, so test a few options if needed.

Troubleshooting common issues

If sites stop resolving after switching to encrypted DNS, double-check the provider’s address and ensure Manual DNS was saved. Restarting your device or toggling the connection off and on can also clear residual settings.

Some corporate or school networks enforce DNS settings, which may prevent changes. In those cases, consider a VPN or speak with your network administrator.

Encrypted DNS in Windows 11 offers an easy, built-in privacy boost that most users overlook. By enabling this single setting and pairing it with a trusted resolver — and optionally a VPN — you can significantly reduce the amount of browsing data your ISP can see. Take a few minutes to update your DNS settings today and reclaim a higher level of online privacy.