Blog / IP & privacy

DNS over HTTPS Setup Guide for Browsers, Windows and macOS

2026-10-17cdnping editors7 min read

DNS over HTTPS (DoH) wraps domain lookups in HTTPS requests to a resolver, so devices along the path can neither see nor alter which domains you query. In a browser it is a single toggle. To send the whole machine's DNS over DoH, Windows 11 has a system setting, while macOS needs an installed configuration profile. Once it is set up, open cdnping's IP and environment check and look at the DNS leak result to confirm it is actually working.

#What DoH protects against, and what it doesn't

Traditional DNS uses UDP port 53 and travels in plaintext. Routers and ISP equipment on the same network can read the queries and forge answers, which is what people mean by DNS hijacking and DNS poisoning. DoH puts the query inside an HTTPS connection on port 443, which changes three things:

• The query is encrypted, so middleboxes can't see which domain you looked up.
• The answer is protected by TLS and can't be tampered with in transit.
• You choose the resolver, instead of using whichever one DHCP hands you by default.

Several common misconceptions lead people to overestimate DoH:

The last point matters most for developers in mainland China. Cloudflare has publicly stated that 1.1.1.1 does not send EDNS Client Subnet (ECS) to authoritative servers, so Chinese CDNs can only judge your location from the resolver's egress, and the result can be slower access to Chinese sites. When choosing a DoH provider, think first about which sites you mainly visit.

#Common public DoH endpoints

Alibaba also accepts the IP form https://223.5.5.5/dns-query. The advantage of the IP form is that connecting to the DoH server itself doesn't require a plaintext lookup first.

Before configuring anything, you can use curl to check that your machine can reach these DoH services (curl 7.62 and later support --doh-url):

# Resolve the domain through the given DoH service, then make the request; success returns an HTTP status line
curl --doh-url https://dns.alidns.com/dns-query -sI https://cdnping.org | head -1
curl --doh-url https://cloudflare-dns.com/dns-query -sI https://cdnping.org | head -1

# View Cloudflare's JSON-format answer to compare resolution results
curl -s -H 'accept: application/dns-json' \
  'https://cloudflare-dns.com/dns-query?name=cdnping.org&type=A'

If an endpoint times out or fails, your current network can't reach it. Try another one rather than forcing the configuration.

#Enabling DoH in Chrome, Edge and Firefox

Browser-level DoH is the fastest to change and the easiest to undo, so it is a good place to start.

#Chrome

1. Open chrome://settings/security in the address bar.
2. Under "Advanced", find "Use secure DNS" and turn it on.
3. Choose "Custom" and enter a template URL, for example https://dns.alidns.com/dns-query.

If the toggle is greyed out with a "managed by your organization" notice, the device has an enterprise policy, or Chrome has detected something like parental controls. Contact your administrator rather than trying to work around it.

#Edge

1. Open edge://settings/privacy and, in the "Security" section, find "Use secure DNS to specify how to look up the network address for websites".
2. Turn it on and choose "Choose a service provider".
3. Pick one from the dropdown, or type in a template URL directly.

Menu names differ slightly between Edge versions. Searching for "DNS" at the top of the settings page is the quickest route.

#Firefox

1. Open about:preferences#privacy and scroll to "DNS over HTTPS".
2. There are three levels: Default Protection, Increased Protection, and Max Protection.
   • Increased Protection: falls back to system DNS if DoH fails.
   • Max Protection: DoH only. If it fails you get an error, with no fallback.
3. Under "Choose provider", select "Custom" and enter a template URL.

For clean troubleshooting, choose Max Protection so that no query silently falls back to plaintext. For everyday use, Increased Protection is enough, and internal company domains still resolve normally.

#Configuring system-wide DoH on Windows 11

DoH in Windows 11 is bound to a DNS server IP: enter the IP first, then assign a DoH template to that IP.

#Graphical interface

1. Settings → Network & internet → Wi-Fi (or Ethernet) → click your current connection → Hardware properties.
2. Find "DNS server assignment", click "Edit", switch it to "Manual", and turn on IPv4.
3. Enter 223.5.5.5 as the preferred DNS, set "DNS over HTTPS" to "On (manual template)", and enter https://dns.alidns.com/dns-query as the template.
4. Enter 223.6.6.6 as the alternate DNS the same way. If you use IPv6, configure the IPv6 section too, otherwise IPv6 queries are still plaintext.
5. After saving, the connection details show "(Encrypted)" next to the DNS servers.

Addresses such as 1.1.1.1 and 8.8.8.8 are in Windows' built-in list of known servers, so you can pick "On (automatic template)". For Alibaba and Tencent addresses you generally need to enter the template manually, or register them first with the commands below.

#Command line (PowerShell as administrator)

# Register AliDNS DoH and forbid fallback to plaintext UDP
Add-DnsClientDohServerAddress -ServerAddress 223.5.5.5 `
  -DohTemplate https://dns.alidns.com/dns-query `
  -AllowFallbackToUdp $False -AutoUpgrade $True
Add-DnsClientDohServerAddress -ServerAddress 223.6.6.6 `
  -DohTemplate https://dns.alidns.com/dns-query `
  -AllowFallbackToUdp $False -AutoUpgrade $True

# List the registered DoH servers
Get-DnsClientDohServerAddress

# Set the current adapter's DNS to these two addresses (replace "WLAN" with your adapter name; use Get-NetAdapter to look it up)
Set-DnsClientServerAddress -InterfaceAlias "WLAN" -ServerAddresses 223.5.5.5,223.6.6.6

# Flush the cache so the new configuration takes effect immediately
Clear-DnsClientCache

-AutoUpgrade $True means that whenever the system DNS is this IP, queries automatically go over DoH. You can also run netsh dns show encryption to see the same information.

#Enabling DoH on macOS with a configuration profile

macOS has supported encrypted DNS since version 11, but there is no toggle in Settings. You have to install a .mobileconfig profile. The template below works as-is; save it as alidns-doh.mobileconfig:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>DNSSettings</key>
      <dict>
        <key>DNSProtocol</key>
        <string>HTTPS</string>
        <key>ServerURL</key>
        <string>https://dns.alidns.com/dns-query</string>
        <key>ServerAddresses</key>
        <array>
          <string>223.5.5.5</string>
          <string>223.6.6.6</string>
        </array>
      </dict>
      <key>PayloadDisplayName</key>
      <string>AliDNS DoH</string>
      <key>PayloadIdentifier</key>
      <string>local.doh.alidns.dns</string>
      <key>PayloadType</key>
      <string>com.apple.dnsSettings.managed</string>
      <key>PayloadUUID</key>
      <string>8C1A6C55-3B7E-4F4B-9E0A-2D6B1F0C7A11</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
    </dict>
  </array>
  <key>PayloadDisplayName</key>
  <string>AliDNS DoH</string>
  <key>PayloadIdentifier</key>
  <string>local.doh.alidns</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>4E2D9B70-6A1F-4C83-B5D2-91F0E3A7C428</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

Installation steps:

1. In Terminal, run plutil -lint alidns-doh.mobileconfig. An output of OK means the format is valid. You can replace the two PayloadUUID values with your own using uuidgen.
2. Double-click the file. The system will show a "Profile Downloaded" prompt.
3. Open "System Settings → Privacy & Security → Profiles" (on some versions, "General → Device Management") and click Install.
4. Go to "System Settings → Network → Filters" or "VPN & Filters" and confirm the DNS entry is enabled.

To switch to Cloudflare or Google, change only ServerURL and ServerAddresses. Removing the profile restores the original state. Don't install profiles from unknown sources: they can change far more than DNS.

#Confirming DoH works: check for DNS leaks with /ip

A settings page showing DoH as enabled doesn't mean every query goes through it. You need to see which resolvers are actually answering for you. Check in this order:

1. Open the cdnping IP and environment check, wait for it to finish, and look at the DNS leak item.
2. Look at who owns the listed resolvers. If you configured Alibaba, you should see Alibaba nodes; if you configured Cloudflare, you should see Cloudflare. If a local ISP resolver appears, some queries are bypassing DoH.
3. Compare against the WebRTC leak and multi-egress checks. If you use a proxy, the DNS, WebRTC and per-site egress results should all agree with each other. For the underlying mechanics, see DNS leaks and WebRTC leaks.
4. If you enabled DoH only in the browser, test again in another browser that doesn't have DoH on. The difference shows you browser-level versus system-level behavior.
5. To send results to a colleague or paste them into an issue, use the "Generate result image" feature on /ip to export a watermarked image. Turn on "Hide IP" before exporting so your egress address doesn't appear in the image. The fingerprint on /ip is computed locally and is not uploaded.

Common inconsistencies and their causes:

#Did switching to DoH change your access speed?

Changing DoH providers affects CDN routing, so which node you end up on and how fast it is has to be measured. The cdnping home page speed test runs in your browser and measures "first connect" (including DNS and the TLS handshake) and "round trip" for 15 AI model APIs and 9 public frontend CDNs. The targets also include AGI Plan (AGI Plan is a commercial partner of cdnping). Run it once before and once after switching DoH, and look mainly at the change in "first connect". For help choosing a frontend CDN, see the CDN speed ranking and how to choose a public CDN in China.

A suggested order: enable DoH in one browser first and confirm with /ip that nothing leaks; then decide whether to set it up system-wide; finally, use the home page speed test to compare how Chinese and overseas DoH providers affect the sites you use most.