Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise DNS Over HTTPS
Transcript
- Lucas: So there is a change coming in Windows 11 that a lot of enterprise IT teams are going to trip over, and it is the quiet shift to DNS over HTTPS by default. Luna: DNS over HTTPS — DoH. That is the thing that encrypts your DNS lookups so your ISP or whoever is on the network can not see what sites you are hitting. Lucas: Exactly. And for years, Microsoft has left it off by default on enterprise editions, because companies rely on being able to see that traffic for security monitoring and content filtering. But starting with the 2025 feature update, Windows 11 Enterprise and Education devices will have DoH enabled by default if the DNS server supports it. Luna: If the DNS server supports it — that is a key detail. So if your internal DNS server does not speak DoH, nothing changes. But if you are using a public resolver like Cloudflare or Google, or if you have upgraded your Windows Server DNS to support DoH, the client will just flip the switch on its own. Lucas: Right. And Microsoft is not making a huge announcement about this. It is buried in the Windows 11 release health documentation. But the effect is real — IT admins are going to see DNS query volume drop to zero on their network monitoring tools for Windows 11 devices, because those queries are now encrypted and going directly to the resolver over HTTPS, not plaintext UDP. Luna: And that breaks a lot of things. I mean, dns layer security — blocking malicious domains, filtering adult content, catching C2 callbacks — all of that relies on seeing the DNS request. If the request never hits your server, you can not block it. Lucas: That is the core tension. Microsoft is doing this for user privacy — encrypting DNS prevents on-path attackers from snooping on which websites you visit. But in an enterprise context, that same privacy feature blinds the security tools the company has deliberately put in place. Luna: Yeah. And if today was actually useful to you, the way these stays ad-free is listener support — buy me a coffee dot com slash fexingo. Lucas: It really does help. And we appreciate everyone who throws a couple bucks in the jar. Keeps us independent and focused on the details that matter. Luna: Exactly. So back to the DoH mandate — how is Microsoft actually enforcing this? Lucas: They are using a combination of Group Policy and MDM settings. There is a policy called 'Enable DNS over HTTPS' that can be set to 'Automatic' or 'Manual' or 'Off'. In the new default, Automatic means the client will try DoH if the DNS server advertises support via the DNR or DANE records. If the server does not, it falls back to plaintext. Luna: So it is not a hard block. But the client becomes opportunistic — it will encrypt whenever possible. And that means inconsistent behavior across your fleet depending on which DNS server each device is using. Lucas: Exactly. If a user is on VPN and their home-office DNS supports DoH, their queries are encrypted. If they are in the office and the corporate DNS does not support DoH, they are plaintext. So security monitoring gets a patchy picture. Luna: What about the Windows DNS Server role itself? Does the server-side support DoH now? Lucas: Yes. Since Windows Server 2022, the DNS Server role can act as a DoH resolver. So if you have an internal DNS server, you can enable DoH on it, and Windows 11 clients will automatically start using encrypted queries. Microsoft is essentially pushing the whole ecosystem toward encryption by default. Luna: And if you want to keep the status quo — plaintext DNS — you have to explicitly set the policy to 'Off' or configure your DNS servers to not advertise DoH support. That is a change from before, where the default was off. Lucas: Right. And the tricky part is that many IT teams do not even know this policy exists. They are going to update their Windows 11 images to the 2025 feature update, deploy it, and suddenly their SIEM is showing zero DNS logs from endpoints. That is going to generate a lot of helpdesk tickets. Luna: And the fix is not complicated. You just set the policy to 'Off' or configure your DNS server to not support DoH. But you have to know that you need to do it. Microsoft should really be surfacing this in the Windows 11 readiness assessments. Lucas: They do have a note in the Windows 11 release health dashboard, but it is easy to miss. And if you are using third-party DNS filtering like Cisco Umbrella or Zscaler, those services actually support DoH themselves, so the traffic is still encrypted but it goes to their resolvers — and they can still do filtering because they are the ones resolving. So it is not all bad. Luna: That is a good point. If your security stack includes a cloud-delivered DNS security service that supports DoH, then the encrypted traffic still passes through their filters. You just lose the on-premises visibility. Lucas: Exactly. So the real issue is for companies that rely on their own internal DNS servers for both resolution and security. They either need to upgrade their DNS to support DoH and then re-architect their monitoring, or they need to override the Windows default and force plaintext. Luna: And there is another wrinkle — some endpoint detection and response tools also hook into DNS to detect threats. If the traffic is encrypted, those hooks might not see the queries. So the EDR might miss a dns based indicator. Lucas: Right. Microsoft Defender for Endpoint, for example, has DNS inspection capabilities. If DoH is enabled, that inspection is bypassed. Microsoft does have a way to capture DoH traffic on the endpoint via their network protection service, but it is not as deep as plaintext inspection. Luna: So the recommendation for enterprise IT is to assess your DNS architecture before you roll out the 2025 update. Decide if you want to embrace DoH and upgrade your servers, or lock it down via policy. Either way, have a plan. Lucas: And test it in a pilot group. Do not just flip the update on for everyone. Because once those DNS logs disappear, your security team is going to have a bad day. Luna: One more thing — this only applies to Windows 11. Windows 10 will continue with the old default. So if you are still on Windows 10, this change is not hitting you yet. But eventually it will. Lucas: Right. Microsoft has been clear that Windows 10 is in its final years, and they are not backporting this behavior. So organizations still on 10 have a little more runway, but the clock is ticking. Luna: And for those who want to enable DoH but keep some visibility, Microsoft does provide a way to log DoH queries via event logs. It is under 'microsoft windows dns client/Operational'. So you can still collect them centrally if you set up log forwarding. Lucas: That is a good workaround. It is not as real-time as SIEM integration, but it gives you an audit trail. And you can use PowerShell to query those events. Luna: So overall, this is a privacy-driven change that has real operational implications for enterprise IT. It is not a bug — it is a feature. But it is one that requires proactive management. Lucas: And that is the theme of so many Windows 11 enterprise changes. Microsoft is shifting defaults toward security and privacy, and IT teams need to stay on top of the documentation to avoid surprises. Luna: At least this one is fairly straightforward to manage once you know about it. A single Group Policy setting and you are back in control. Lucas: Exactly. And if you want to embrace DoH, upgrading your DNS servers is a solid long-term move anyway. It is better security for everyone. Luna: Alright. That is the DoH mandate. Next time, maybe we talk about how Windows 11 is quietly mandating something else — there is always something. Lucas: There is always something. We will keep you posted.