Key Points
- DNS-over-HTTPS (DoH) encrypts your browser’s DNS queries for privacy, but it can conflict with corporate network filters and internal resources.
- Individual users can enable or disable DoH directly in Microsoft Edge’s settings under Privacy, search, and services > Security.
- IT administrators enforce DoH settings across an organization using the ConfigureSecureDnsLookup Group Policy or Microsoft Intune.
- If your DoH setting keeps reverting, it is being controlled by a mandatory enterprise policy set by your IT department.
- Website loading failures after enabling DoH often indicate that your network is blocking the encrypted DNS protocol.
Secure DNS, or DNS-over-HTTPS (DoH), encrypts your DNS requests to shield your browsing from prying eyes, yet managing your Microsoft Edge DNS settings is crucial when this privacy feature clashes with workplace networks or security tools.
This guide will show you how to enable, disable, and control DoH, whether you’re tweaking a single browser or rolling out a company-wide policy.
Methods to turn DNS (DoH) on/off in Microsoft Edge
Managing DNS-over-HTTPS (DoH) settings in Microsoft Edge is essential for aligning browser security with your network’s operational requirements.
📌Use case: Configure DoH settings primarily for:
- Network management: Disable DoH to ensure compatibility with corporate web filters, firewalls, and monitoring tools.
- Internal resources: Turn it off when accessing local servers or sites with private domain names that require specific internal DNS.
- Troubleshooting: Disable it as a diagnostic step when resolving persistent website connectivity issues.
📌Prerequisites: Before you begin, confirm:
- You are using Microsoft Edge on Windows 11.
- You have admin awareness of your organization’s DNS policy (for managed devices).
- For IT admins: The optional Edge ADMX/administrative templates are loaded for group policy deployment.
Method 1: Configure via Edge settings (For Individual Users)
Adjust Secure DNS directly in your Microsoft Edge browser for quick personal configuration.
Step-by-step procedure:
- Open Microsoft Edge.
- Type edge://settings/privacy into the address bar
- Or navigate via Settings > Privacy, search, and services.
- Scroll down to the Security section.
- Find the toggle for “Use secure DNS to specify how to lookup the network address for websites.”
- Toggle it On to enable encryption or Off to disable it and use your system’s standard DNS.
- Choosing a provider: If enabled, click “Choose a service provider” to select a preset (like Cloudflare or Google) or enter a custom DoH template URL.
- Validation: To confirm the setting is active, you can use a DNS leak test website or check the network activity details in edge://net-export logs.
The change takes effect immediately. For a full reset, clear Edge’s DNS cache by navigating to edge://net-internals/#dns.
Method 2: Enforce via enterprise policy (For IT Administrators)
Deploy a standardized Secure DNS configuration across your Windows fleet using centralized management tools.
Use Group Policy (with the msedge.admx templates) or Microsoft Intune to enforce the ConfigureSecureDnsLookup policy.
Step-by-step procedure:
- Locate the policy:
- Navigate to Computer/User Configuration > Policies > Administrative Templates > Microsoft Edge.
- Configure the policy:
- Enable the “Configure Secure DNS Lookup” policy.
- Set the mode: Select your desired enforcement level:
- Off: Disables DoH.
- Automatic (Default): Uses DoH if the system’s DNS server supports it.
- Specified: Forces the use of a specific DoH provider by entering its URI template.
Once the policy is applied and the client machine refreshes (via gpupdate /force or a reboot), the setting is locked for all users. Individual users cannot modify it through the Edge settings UI, guaranteeing enterprise-wide DNS policy compliance.
Supporting method: Troubleshooting and advanced validation
Validate your Secure DNS configuration and resolve conflicts using these diagnostic steps.
Step-by-step procedure:
If websites fail to load after changing DoH settings, follow this sequence:
- Clear caches:
- Clear the browser’s DNS cache at edge://net-internals/#dns and the Windows DNS cache (run ipconfig /flushdns in Command Prompt as admin).
- Verify the active setting:
- In Edge, revisit edge://settings/privacy to confirm the toggle is in the intended state (On/Off).
- Use diagnostic tools:
- Check edge://net-internals/#dns to see which DNS resolver Edge is actively using.
- Use the Network tab in Developer Tools (F12) to see if specific requests are failing with DNS-related errors.
- Check for Conflicts:
- Ensure DoH configuration aligns with your system’s proxy and firewall settings. A web filter or firewall blocking HTTPS traffic to port 443 can prevent DoH from working.
After systematic troubleshooting, you will identify the root cause. This allows you to either correct your DoH settings or conclusively determine that disabling DoH is necessary for your specific network environment.
Troubleshooting common secure DNS issues
Resolve typical problems when managing DNS-over-HTTPS (DoH) with these direct solutions.
DoH only works in Edge
This is normal. Edge’s setting only encrypts browser traffic. For full-system encryption, configure DoH/DoT in Windows network settings.
Sites fail to load on certain networks
Managed networks often block external DoH. Disable Edge’s Secure DNS or switch to your organization’s approved resolver.
Security filters are bypassed
Public DoH can bypass internal DNS filtering. Coordinate with security teams to use a company-approved DoH endpoint that maintains logging.
Settings keep resetting
A centralized enterprise policy is enforcing the configuration. Only an administrator can change the deployed Group Policy or Intune setting.
Performance is slow
Test by disabling DoH as a baseline. Try a different provider or, for enterprises, deploy a local DoH resolver to reduce latency.
Configuring Edge DNS for security and compatibility
Effectively managing Edge DNS through Secure DNS gives you control over browser privacy while maintaining network compliance.
Whether you toggle it on for personal use or enforce it enterprise-wide via policy, the key is aligning this setting with your Windows configuration and existing security tools. This ensures your encrypted browsing works seamlessly without disrupting essential filters, logs, or internal resources.
Related topics
