Windows 10: How to enable and test DNS over HTTPS on Windows 10 devices

GHacks · May 19, 2020

Microsoft revealed plans to integrate DNS over HTTPS in Windows 10 in November 2019. DNS over HTTPS encrypts DNS lookups to improve privacy, security and reliability of the connection.

Most devices that are connected to the Internet rely on plain text DNS lookups. These lookups "translate" domain names, e.g. ghacks.net, to IP addresses that devices use to establish connections. Anyone listening on the network, including the ISP, knows exactly which sites and services are opened on the device because of this.

Browser makers such as Mozilla, Google, and Opera announced support for DNS over HTTPS and have started to integrate the feature into browsers. The solutions would allow users of these browsers to make use of the feature but it would only apply to the browser.

Microsoft's plan to introduce support for DNS over HTTPS in the operating system would enable support for all programs (including browsers) on that system.

The company decided to enable or disable the functionality based on the selected provider. If the DNS provider supports DNS over HTTPS, it would be used and otherwise, it would not. In other words: many users will see the privacy and security of DNS lookups improved once the feature lands in Windows without even noticing that this happened.

Microsoft has integrated DNS over HTTPs in recent Insider versions of Windows 10. Note that the feature has not yet been implemented in stable versions of Windows 10. It is not clear when this will be the case as Microsoft provides no schedule for that.

Note: The build number needs to be at least 19628. You can check the build number by loading winver from the Start menu.

How to enable DNS over HTTPS on Windows 10

Only Insider builds require that DNS over HTTPS is enabled in the Registry. Microsoft notes that this won't be necessary once the feature lands in stable versions of Windows 10.

Tap on Start.

Type regedit.exe and hit Enter to load the Registry Editor.

Confirm the UAC prompt if it is displayed.

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters.

Right-click on Parameters and select New > Dword (32-bit) Value.

Name it EnableAutoDOH.

Set its value to 2.

Restart the Windows system.

You need to make sure that a provider that supports DNS over HTTPS is selected. Microsoft highlights three providers on its Tech Community website:

Server Owner Server IP addresses
Cloudflare 1.1.1.1
1.0.0.1

2606:4700:4700::1111

2606:4700:4700::1001
Google 8.8.8.8
8.8.4.4

2001:4860:4860::8888

2001:4860:4860::8844
Quad9 9.9.9.9
149.112.112.112

2620:fe::fe

2620:fe::fe:9

These servers need to be set as the DNS server addresses on the system as these are the servers that get auto-promoted.

Administrators may add other DNS over HTTPS capable servers to the system so that these may be used as well.

The following commands need to be run with elevated privileges to add DNS over HTTPS capable servers to the system:

netsh dns add encryption server=<your-server’s-IP-address> dohtemplate=<your-server’s-DoH-URI-template>

To verify the template, run the following command:

netsh dns show encryption server=<your-server’s-IP-address>

Here is how you change DNS settings:

Select Start > Settings > Network & Internet > Change adapter settings.

Right-click on the adapter that is used and select Properties.

Double-click on either Internet Protocol Version 4 or 6 (or both one after the other) to set a new DNS provider.

Select "Use the following DNS server addresses".

Enter the addresses listed above.

Click ok to apply the changes.

Note that you can revert the changes at any time by switching to the "automatically" option or editing DNS servers.

How to test DNS over HTTPS on Windows 10

Windows 10 comes with built-in functionality to test whether DNS over HTTPS is working.

Open a PowerShell window.

Run the following commands one after the other:

pktmon filter remove // removes any existing filters.

pktmon filter add -p 53 // adds traffic filter for port 53, the port that classic DNS uses.

pktmon start --etw -m real-time // start real-time logging of traffic.

If DNS over HTTPS is used, it show "little to no traffic".

Now You: What is your take on DNS over HTTPS? Will you use it?

Thank you for being a Ghacks reader. The post How to enable and test DNS over HTTPS on Windows 10 devices appeared first on gHacks Technology News.

read more...

Brink · May 19, 2020

Windows 10 Insiders can now test DNS over HTTPS

If you have been waiting to try DNS over HTTPS (DoH) on Windows 10, you're in luck: the first testable version is now available to Windows Insiders! If you haven’t been waiting for it, and are wondering what DoH is all about, then be aware this feature will change how your device connects to the Internet and is in an early testing stage so only proceed if you’re sure you’re ready. Having said that, if you want to see the Windows DoH client in action and help us create a more private Internet experience for our customers, here is what you need to do:

First, make sure your Microsoft account is part of the Windows Insider Program. If you know you are already a Windows Insider, make sure you are in the Fast ring and go to Step 2. If not, go here and follow the instructions for the Fast ring so you can get the latest Insider Preview build.

Once this is done, run Windows Update, reboot, and verify you’re running Build 19628 or higher. You can do this by clicking here or by going to the Settings app -> System -> About.

Once you know your Windows install has our DoH client, we need to activate it. You can do that by:

Opening the Registry Editor

Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters registry key

Create a new DWORD value named “EnableAutoDoh”

Set its value to 2

Please note: the registry keys and values described here are only for enabling DoH client testing on Insider builds. When the DoH client is made available in general release builds, registry configuration of DoH will not be supported.

Now that the DoH client is active, Windows will start using DoH if you already have one of these servers configured:

[table][tr][td]Server Owner[/td] [td]Server IP addresses[/td] [/tr] [tr][td]Cloudflare[/td] [td]1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001[/td] [/tr] [tr][td]Google[/td] [td]8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844[/td] [/tr] [tr][td]Quad9[/td] [td]9.9.9.9 149.112.112.112 2620:fe::fe 2620:fe::fe:9[/td] [/tr] [/table]

You can configure Windows to use any of these IP addresses as a DNS server through the Control Panel or the Settings app. The next time the DNS service restarts, we’ll start using DoH to talk to these servers instead of classic DNS over port 53. The easiest way to trigger a DNS service restart is by rebooting the computer.

To add a DNS server in the Control Panel:

Go to Network and Internet -> Network and Sharing Center -> Change adapter settings.

Right click on the connection you want to add a DNS server to and select Properties.

Select either “Internet Protocol Version 4 (TCP/IPv4)” or “Internet Protocol Version 6 (TCP/IPv6)” and click Properties.

Ensure the “Use the following DNS server addresses” radio button is selected and add the DNS server address into the fields below.

Now that you have Windows configured to use DoH, you should be able to verify it’s working by seeing no more plain text DNS traffic from your device. You can do this by using Packetmon, a network traffic analyzer included with Windows.

Start by opening a new Command Prompt or PowerShell window. Run the following command to reset any network traffic filters PacketMon may already have in place.

pktmon filter remove

Run the following command to add a traffic filter for port 53, the port classic DNS uses (and which should now be silent since we’re only using DoH).

pktmon filter add -p 53

Run the following command to start a real-time logging of traffic. All port 53 packets will be printed to the command line. If your device is only configured with DoH servers, this should show little to no traffic.

pktmon start --etw -l real-time

If you’re trying to test a DoH server that isn’t already on our auto-promotion list, such as your ISP’s DoH servers, you can add it to our list manually using the command line. First, identify the IP address and the DoH URI template for the server you want to add. Then, run the following command as an administrator:

netsh dns add encryption server=<your-server’s-IP-address> dohtemplate=<your-server’s-DoH-URI-template>

You can verify the template was applied to the well-known DoH server list by running this command, which should show you the template being used for a given IP address:

netsh dns show encryption server=<your-server’s-IP-address>

Now when Windows is configured to use that IP address as a DNS server, it will use DoH instead of classic DNS.
Click to expand...

Source: https://techcommunity.microsoft.com/...s/ba-p/1381282

Change IPv4 and IPv6 DNS Server Address in Windows

How to Enable or Disable DNS over HTTPS (DoH) in Google Chrome

How to Enable or Disable DNS over HTTPS (DoH) in Firefox

Brink · May 19, 2020

Firefox DNS over HTTPS rollout begins for US users

@: you may want to update the pix in Step 5 enable, of: How to Enable or Disable DNS over HTTPS (DoH) in Firefox It's missing the listing for NextDNS in the drop down, the post / thread in News (here) is okay.
Click to expand...

Thank you Steve. *Smile

I'll look at updating it now.

EDIT: Now updated. *Wink

the54thvoid · May 19, 2020

Windows 10 DNS leak

Did you just manually set your DNS server to google DNS or similar?
Click to expand...

No, went with a different 3rd party suggestion. Works better. I'm reliant on others for my tech needs that way.

Windows 10: How to enable and test DNS over HTTPS on Windows 10 devices

How to enable and test DNS over HTTPS on Windows 10 devices

How to enable and test DNS over HTTPS on Windows 10 devices

How to enable and test DNS over HTTPS on Windows 10 devices

How to enable and test DNS over HTTPS on Windows 10 devices - Similar Threads - enable test DNS

How to enable DNS over HTTPS DoH in group policy?

How to enable DNS over HTTPS DoH in group policy?

I cannot enable DNS over HTTPS

I cannot enable DNS over HTTPS

DNS over HTTPS on Windows 10

Enabling DNS over https in Edge

How to enable and test DNS over HTTPS in Windows 10

Windows 10 Insiders can now test DNS over HTTPS

DNS over HTTPS?