Using AdGuard DNS over HTTPS (DoH) on Windows 11

README.md

Why

You may want to use AdGuard's DNS over HTTPS¹ service if you

1. Want to make it harder for your ISP to know what websites you are requesting
2. Want to block most traditional ads from your web browsing experience across your entire PC

Setup instructions

1. Open PowerShell
2. Add the primary and secondary AdGuard DNS IPv4 and IPv6 addresses²

   netsh dns add encryption server=94.140.14.14 dohtemplate=https://dns.adguard.com/dns-query autoupgrade=yes udpfallback=no
   netsh dns add encryption server=94.140.15.15 dohtemplate=https://dns.adguard.com/dns-query autoupgrade=yes udpfallback=no
   netsh dns add encryption server=2a10:50c0::ad1:ff dohtemplate=https://dns.adguard.com/dns-query autoupgrade=yes udpfallback=no
   netsh dns add encryption server=2a10:50c0::ad2:ff dohtemplate=https://dns.adguard.com/dns-query autoupgrade=yes udpfallback=no
   

3. Verify addition of DNS options netsh dns show encryption

   Encryption settings for 94.140.15.15
   ----------------------------------------------------------------------
   DNS-over-HTTPS template     : https://dns.adguard.com/dns-query
   Auto-upgrade                : yes
   UDP-fallback                : no
   
   Encryption settings for 94.140.14.14
   ----------------------------------------------------------------------
   DNS-over-HTTPS template     : https://dns.adguard.com/dns-query
   Auto-upgrade                : yes
   UDP-fallback                : no
   
   Encryption settings for 2a10:50c0::ad1:ff
   ----------------------------------------------------------------------
   DNS-over-HTTPS template     : https://dns.adguard.com/dns-query
   Auto-upgrade                : yes
   UDP-fallback                : no
   
   Encryption settings for 2a10:50c0::ad2:ff
   ----------------------------------------------------------------------
   DNS-over-HTTPS template     : https://dns.adguard.com/dns-query
   Auto-upgrade                : yes
   UDP-fallback                : no
   

   • If you don't see the new DNS options, you may need to run PowerShell with administrator priviledges
4. Open Settings > Network & internet > Wi-Fi > Hardware properties
5. Click the "Edit" button in the DNS servers block
6. Change the dropdown setting from "Automatic (DHCP)" to "Manual"
7. Ensure both IPv4 and IPv6 are toggled on
8. Under IPv4, enter 94.140.14.14 for the Preferred DNS, and 94.140.15.15 for the Alternate DNS
9. Under IPv6, enter 2a10:50c0::ad1:ff for the Preferred DNS, and 2a10:50c0::ad2:ff for the Alternate DNS
10. Ensure all of the DNS encryption dropdowns are set to "Encrypted only (DNS over HTTPS)"
11. Click "Save"

Footnotes

1. https://en.wikipedia.org/wiki/DNS_over_HTTPS ↩

2. https://kb.adguard.com/en/general/dns-providers#adguard-dns ↩

thanks

Hi I have only go option in DNS over HTTPS
1.ON (automatic template)
2.ON (manual template)
3.OFF

They updated their address to dns.adguard-dns.com to avoid blockage last year. If you encounter any issue, give it a try.

I selected for ON(automatic template) it fills the address and everything is working fine as of now

They updated their address to dns.adguard-dns.com to avoid blockage last year. If you encounter any issue, give it a try.

they did change addresses for ipv4 and ipv6 as from this blog post by adguard themselves. however the hostnames are still the same. the you have referred to here is the former that still works and the latest is the one from the author of this gist.

can u update this change?, i think its not work on windows 10

can u update this change?, i think its not work on windows 10

@hideandseekstheorder use the "COMMAND PROMPT" app, not the "power shell" app, then it will work in "command prompt".

Hello y'all. Here is as 1 command instead of doing it one by one. Run as administrator PowerShell or CMD.
netsh dns add encryption server=94.140.14.14 dohtemplate=https://dns.adguard.com/dns-query autoupgrade=yes udpfallback=no && netsh dns add encryption server=94.140.15.15 dohtemplate=https://dns.adguard.com/dns-query autoupgrade=yes udpfallback=no && netsh dns add encryption server=2a10:50c0::ad1:ff dohtemplate=https://dns.adguard.com/dns-query autoupgrade=yes udpfallback=no && netsh dns add encryption server=2a10:50c0::ad2:ff dohtemplate=https://dns.adguard.com/dns-query autoupgrade=yes udpfallback=no

This can be done with PowerShell commands exclusively.

Get-DnsClientDohServerAddress
Add-DnsClientDohServerAddress -ServerAddress '94.140.14.14' -DohTemplate 'https://dns.adguard.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True
Add-DnsClientDohServerAddress -ServerAddress '94.140.15.15' -DohTemplate 'https://dns.adguard.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True
Add-DnsClientDohServerAddress -ServerAddress '2a10:50c0::ad1:ff' -DohTemplate 'https://dns.adguard.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True
Add-DnsClientDohServerAddress -ServerAddress '2a10:50c0::ad2:ff' -DohTemplate 'https://dns.adguard.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True
Get-DnsClientDohServerAddress

Set-DnsClientServerAddress -InterfaceAlias "Wi-fi" -ResetServerAddresses
Set-DnsClientServerAddress -InterfaceAlias "Wi-fi" -ServerAddresses ("94.140.14.14","94.140.15.15")
Set-DnsClientServerAddress -InterfaceAlias "Wi-fi" –ServerAddresses ("2a10:50c0::ad1:ff","2a10:50c0::ad2:ff")

Invoke-Expression "New-Item -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh\94.140.14.14' -Force"
Invoke-Expression "New-ItemProperty -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh\94.140.14.14' -Name 'DohFlags' -Value 1 -PropertyType QWORD -Force"
Invoke-Expression "New-Item -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh\94.140.15.15' -Force"
Invoke-Expression "New-ItemProperty -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh\94.140.15.15' -Name 'DohFlags' -Value 1 -PropertyType QWORD -Force"

Invoke-Expression "New-Item -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh6\2a10:50c0::ad1:ff' -Force"
Invoke-Expression "New-ItemProperty -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh6\2a10:50c0::ad1:ff' -Name 'DohFlags' -Value 1 -PropertyType QWORD -Force"
Invoke-Expression "New-Item -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh6\2a10:50c0::ad2:ff' -Force"
Invoke-Expression "New-ItemProperty -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh6\2a10:50c0::ad2:ff' -Name 'DohFlags' -Value 1 -PropertyType QWORD -Force"

I ran into issues when trying to write to registry using New-Item command, so here's an alternative to @yecarrillo's answer.

Get-DnsClientDohServerAddress
Add-DnsClientDohServerAddress -ServerAddress '94.140.14.14' -DohTemplate 'https://dns.adguard.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True
Add-DnsClientDohServerAddress -ServerAddress '94.140.15.15' -DohTemplate 'https://dns.adguard.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True
Add-DnsClientDohServerAddress -ServerAddress '2a10:50c0::ad1:ff' -DohTemplate 'https://dns.adguard.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True
Add-DnsClientDohServerAddress -ServerAddress '2a10:50c0::ad2:ff' -DohTemplate 'https://dns.adguard.com/dns-query' -AllowFallbackToUdp $False -AutoUpgrade $True
Get-DnsClientDohServerAddress

Set-DnsClientServerAddress -InterfaceAlias "Wi-fi" -ResetServerAddresses
Set-DnsClientServerAddress -InterfaceAlias "Wi-fi" -ServerAddresses ("94.140.14.14","94.140.15.15")
Set-DnsClientServerAddress -InterfaceAlias "Wi-fi" –ServerAddresses ("2a10:50c0::ad1:ff","2a10:50c0::ad2:ff")

# Create registry entries for 94.140.14.14
$interfaceGuid = (Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower()
New-Item -Path "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh" -Name "94.140.14.14" -Force
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh\94.140.14.14" -Name "DohFlags" -Value 1 -PropertyType QWord -Force

# Create registry entries for 94.140.15.15
New-Item -Path "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh" -Name "94.140.15.15" -Force
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh\94.140.15.15" -Name "DohFlags" -Value 1 -PropertyType QWord -Force

# Create registry entries for 2a10:50c0::ad1:ff (IPv6)
New-Item -Path "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh6" -Name "2a10:50c0::ad1:ff" -Force
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh6\2a10:50c0::ad1:ff" -Name "DohFlags" -Value 1 -PropertyType QWord -Force

# Create registry entries for 2a10:50c0::ad2:ff (IPv6)
New-Item -Path "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh6" -Name "2a10:50c0::ad2:ff" -Force
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$interfaceGuid\DohInterfaceSettings\Doh6\2a10:50c0::ad2:ff" -Name "DohFlags" -Value 1 -PropertyType QWord -Force

For those wondering what was the error

When I tried to run this:

Invoke-Expression "New-Item -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dnscache\InterfaceSpecificParameters\$((Get-Netadapter -Name 'Wi-Fi').InterfaceGuid.ToLower())\DohInterfaceSettings\Doh\94.140.14.14' -Force"

I got this error:

New-Item : Cannot process argument because the value of argument "path" is not valid. Change the value of the "path"
argument and run the operation again.
At line:1 char:1
+ New-Item -Path 'Registry::HKLM:\System\CurrentControlSet\Services\Dns ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (HKLM:\System\Cu...oh\94.140.14.14:String) [New-Item], PSArgumentException
    + FullyQualifiedErrorId : System.Management.Automation.PSArgumentException,Microsoft.PowerShell.Commands.NewItemCo
   mmand

I didn't realize how good we had it with uBlock Origin until Google removed the extension. Even with AdGuard's DNS over HTTPS, ads are still getting through (example).