I turned on system DoH and my browser ignored it utterly

My Windows 11 laptop computer sends its DNS requests to Cloudflare’s 1.1.1.1 with DNS over HTTPS switched on, and the plaintext fallback switched off. DoH wraps the request your PC makes to lookup an internet site’s tackle in the identical encryption that protects a standard HTTPS web page, so your ISP cannot learn it alongside the way in which.

After turning on Windows 11’s DNS privacy feature, I assumed each app on the PC was coated. A packet seize and some browser exams mentioned in any other case, and Chrome was the primary to go its personal manner.

Windows encrypts solely what it handles

The setting is actual, however its attain is narrower than it appears

The change lives in Settings -> Network & web -> Wi-Fi, then your community’s properties. Click Edit subsequent to DNS server task, select Manual, and enter 1.1.1.1 and 1.0.0.1 as your servers.

Then set DNS over HTTPS to On (automated template) for each, and Windows fills in Cloudflare’s template for you. I additionally turned off Fallback to plaintext, which stops Windows from dropping again to unencrypted lookups when the safe connection fails.

It works. I ran Resolve-DnsName instance.web in PowerShell whereas recording visitors with pktmon, the packet monitor constructed into Windows, and never a single plain DNS request left the laptop computer for that lookup. Windows 11’s built-in DNS privacy setting does what it guarantees, so long as the request goes by Windows.

That final half is the catch. Windows can solely encrypt lookups that apps hand to its personal DNS Client service, and browsers do not at all times do this.

Chrome’s default skips the Windows resolver

OS default borrows your server tackle, not your encryption

Chrome retains its model of this setting below Settings -> Privacy and safety -> Security -> Use safe DNS. On my laptop computer, it was on, with the supplier set to OS default (when obtainable). That label suggests Chrome fingers DNS to Windows and follows no matter I configured there. Cloudflare’s take a look at web page at 1.1.1.1/help backed that up at first look. It reported DoH as energetic, which is precisely what I’d see if Windows have been doing the work.

The seize informed a distinct story. Right earlier than Chrome loaded a web page, it appeared up chrome.cloudflare-dns.com after which despatched encrypted visitors to that server over HTTP/3. Chrome learn 1.1.1.1 from Windows, acknowledged it as Cloudflare, and opened its personal DoH connection as an alternative. Chromium’s documentation calls this an autoupgrade to the identical supplier.

To be honest, the top end result appears nearly an identical. The lookups keep encrypted, and so they nonetheless land at Cloudflare. But Chrome’s requests by no means cross by the Windows setting I configured, so choices just like the plaintext fallback change don’t have any say over them, and nothing in Windows tells you that.

A customized supplier cuts Windows out

One dropdown, and 1.1.1.1 stopped seeing something

The bypass will get way more apparent while you decide a supplier your self. I switched Chrome’s Select DNS supplier dropdown to Google (Public DNS) whereas Windows stayed on Cloudflare.

Reloading 1.1.1.1/assist returned No for Connected to 1.1.1.1, and the AS Name modified to Google LLC.

Edge behaved the identical manner. Under Settings -> Privacy, search, and providers -> Security, I chosen Choose a service supplier and picked Google (Public DNS). Cloudflare’s web page once more confirmed No, with Google LLC because the community answering.

Firefox was the fairest of the three on my connection. On Default, its about:networking#dns web page listed each lookup with TRR, Mozilla’s identify for its DoH resolver, set to false. That means it handed every request to Windows. Firefox’s default can differ by area, although, so yours could behave in another way.

Once I switched to Custom and picked NextDNS, the take a look at web page reported No and named The Constant Company, LLC, the internet hosting community NextDNS runs on. It’s the identical change behind browser secure DNS settings that punch through network-wide DNS filtering, and it overrides your Windows selection simply as simply.

Desktop apps leaked plain DNS anyway

Fallback was off, but port 53 nonetheless carried visitors

The browsers have been solely half of it. I opened the pktmon recording in Wireshark and filtered for udp.port == 53, the port plain DNS makes use of. With DoH on and fallback off, that checklist ought to have been empty.

However, it wasn’t. Lookups for slackb.com, a website Slack makes use of, went out in plain textual content to 1.1.1.1 and 1.0.0.1. So did the browsers’ requests for their very own DoH servers, dns.google and chrome.cloudflare-dns.com, which they should resolve earlier than they’ll change to encryption.

Every leaked request got here as an A file question paired with an HTTPS file question, the sample Chromium’s built-in DNS shopper produces. My finest clarification is that Chromium-based desktop apps like Slack learn the server tackle from Windows and ship their very own unencrypted queries straight to it. I could not tie every packet to a course of, so deal with that as a powerful inference.

The impact is identical both manner. Anyone watching your community can nonetheless see among the providers you employ. Pointing Windows at a router that handles DoH upstream, or working a DNS supplier’s personal Windows app that catches each lookup on the PC, retains these plain requests from leaving your private home community.

Check each layer earlier than trusting the change

The Windows toggle is a primary step, not the entire job

I’m holding system DoH on. It covers PowerShell, Firefox on its default settings, and any app that asks Windows for an tackle. I simply now not deal with it as a assure for the entire PC. The quickest solution to see the place you stand is to load 1.1.1.1/assist in each browser you employ. If the solutions do not match what you set in Windows, the browser’s personal safe DNS setting is in cost, and you may resolve whether or not to maintain it that manner or decide the supplier your self.