Your router has been narrating your browsing habits to your internet provider this whole time. And to anyone else on the same Wi-Fi. And depending on the coffee shop, hotel, or airport to a few opportunistic strangers too.
Most people don't realize this is happening because the leak isn't in the websites themselves (HTTPS handles that), it's in the DNS lookups that happen BEFORE the connection. Twenty years of 'use HTTPS' advice left a huge gap most users never closed. Good news: Windows 11 has a single setting that fixes it for every app on your computer, takes about five minutes, and requires zero command-line typing.
Why your DNS queries are leaking
Every time you visit a website, your computer asks a Domain Name System (DNS) server to translate that domain into an IP address basically, asking directory assistance for the building number before driving over. By default, that question goes out in plain text, completely unencrypted.
Your internet service provider sees every domain you request. So does anyone else on the same Wi-Fi. The DNS request precedes the HTTPS connection, so even when the website itself is encrypted, the destination is broadcast in the clear before any of that protection kicks in.
Who's actually watching?
A few realistic scenarios:
- Your ISP. Since 2017, U.S. broadband providers (Spectrum, AT&T, Frontier the providers most Orlando-area homes use) have had wide latitude to collect and use customer browsing data. Even when not sold directly, 'anonymized' datasets sold to ad networks tend to be de-anonymized within minutes by anyone motivated enough.
- Public Wi-Fi snoops. Most network attacks aren't movie villains in basements; they're someone bored at the next table at Foxtail or Drunken Monkey running a simple packet sniffer to see what domains the laptops in the shop are loading. Free tools, no skill required.
- DNS spoofers. Worse than passive watchers: attackers who intercept your DNS request and answer with their own IP, sending you to a fake banking site that looks identical to the real one. Plaintext DNS makes this trivially easy.
This isn't a paranoid edge case. It's the default behavior of every Windows PC sold in the last decade.
The 5-minute fix DNS over HTTPS on Windows 11
DNS over HTTPS (DoH) is exactly what it sounds like: your DNS lookups travel inside the same encrypted HTTPS tunnel as everything else, indistinguishable from any other secure web request. Windows 11 supports it natively. Here's how to turn it on:
- Open Settings → Network & Internet
- Click Wi-Fi (or Ethernet if you're plugged in)
- Click Hardware properties
- Scroll to DNS server assignment and click Edit
- Switch the dropdown from Automatic (DHCP) to Manual
- Toggle on IPv4 and enter a DoH-compatible DNS pair (we'll pick one in a sec)
- Under each DNS field, find the DNS over HTTPS dropdown and set to On (Automatic Template)
- Find the Fallback to plaintext toggle and turn it OFF (more on why in a minute)
- If your IPv6 toggle isn't already on, turn it on and add the matching IPv6 addresses for the same provider
- Click Save
To confirm it worked, scroll back to Hardware properties. Next to your DNS addresses you should now see the word Encrypted. That label is the entire point.
Which DNS provider should you actually pick?
Three good free options, each with a different focus:
- Cloudflare (1.1.1.1 / 1.0.0.1). Fastest globally, strong privacy commitments (third-party audited), doesn't log identifying queries. IPv6: 2606:4700:4700::1111 and 2606:4700:4700::1001. Our pick for most people.
- Quad9 (9.9.9.9 / 149.112.112.112). Swiss-based, automatically blocks connections to known malicious domains. Slightly slower than Cloudflare but adds a layer of malware protection that's especially nice on family computers. IPv6: 2620:fe::fe and 2620:fe::9.
- Google (8.8.8.8 / 8.8.4.4). Extremely reliable, well known. Worth noting Google retains some query data for 24–48 hours for diagnostic purposes, which matters if you're already trying to reduce your Google footprint.
Pick Cloudflare unless you have a specific reason to choose otherwise. Speed plus privacy in one package is hard to beat.
The single most missed step: 'Fallback to plaintext'
If you take one thing away from this article, take this: the Fallback to plaintext toggle needs to be OFF. With it on, Windows will silently drop back to unencrypted DNS the moment your DoH connection hiccups a slow handshake, a hotel network that interferes, anything. You'll have no idea it happened. Your queries leak again, your ISP starts collecting again, and you'll think the setting is doing its job. It isn't.
Don't forget IPv6
Most modern internet connections including most Orlando-area Spectrum and AT&T Fiber installs use IPv6 by default. If you secure IPv4 with DoH but leave IPv6 still sending plaintext queries (which it does by default), you've built a privacy fence with one side completely missing. Every modern DNS provider gives you a matching IPv6 pair. Use it.
Why this beats browser-level DNS settings
Chrome, Firefox, and Edge all let you turn on DoH inside the browser itself. That's worth doing, but it only covers the browser. Your email client still leaks. Your Steam launcher still leaks. Spotify checking for updates leaks. Windows Update leaks. Your antivirus phoning home leaks. System-level DoH on Windows 11 handles every DNS query the machine makes, regardless of which app made it. Set it once, and the foundation is fixed.
When to call us
If the Encrypted label doesn't appear, certain apps stop connecting, or your VPN starts misbehaving after this change, there's usually a router-level or firewall conflict. Older routers can block DoH ports, some corporate or guest networks force plaintext DNS, and a few VPN clients have their own DNS settings that override Windows. Tech Forge does this kind of network and privacy tune-up across the Orlando area as part of a regular mobile computer service DoH setup, browser hardening, password manager rollout, and a sanity check on your existing antivirus and backup tools. About 30 minutes per machine.
The DNS leak is the kind of privacy problem that's invisible by default and stays that way until someone tells you. Once you know about it, the fix is five minutes. Once you don't, your ISP, your coffee shop neighbors, and the occasional opportunistic stranger get to keep reading.