iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To enable Secure DNS in Microsoft Edge on Windows 11, open Settings and more (⋯) > Settings > Privacy, search, and services, scroll to Security, and switch on Use secure DNS to specify how to lookup the network address for websites. Keep Use current service provider selected unless you have a trusted DNS-over-HTTPS (DoH) resolver URI and a reason to use it. Secure DNS encrypts DNS lookups between Edge and the resolver, but it does not encrypt every part of your web traffic or make the resolver unable to see your requests.
What Secure DNS changes in Edge
When you enter a web address, Edge first needs to translate the hostname, such as example.com, into an IP address. That translation is a DNS lookup. Without encryption, the DNS request can be observed or altered by a network operator, Wi‑Fi attacker, or other intermediary that can inspect your connection.
Edge’s Secure DNS feature uses DNS over HTTPS (DoH). Instead of sending the DNS message as ordinary DNS traffic, Edge sends it to a DNS service through an HTTPS connection. HTTPS supplies TLS confidentiality and integrity for the lookup while it travels between Edge and the resolver. Microsoft describes the behavior this way: “Secure DNS performs this lookup using a service over an HTTPS connection to the DNS service provider.”
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →DoH protects the lookup itself. It does not turn Edge into a full-device VPN, encrypt unrelated applications, conceal the destination from every network observer, or prevent the selected DNS provider from processing the query. Once a website connection is established, the site’s own HTTPS protection is still responsible for protecting page traffic. Secure DNS is therefore a focused privacy and tamper-resistance control, not an all-purpose anonymity feature.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Before you enable it
- Use a supported desktop Edge installation. The setting is in the Windows browser interface, not in a website account.
- Know which layer you are changing. This procedure changes Edge’s browser-level resolver behavior. Windows 11 also has an operating-system encrypted-DNS setting, and the two controls are separate.
- Expect network or policy restrictions. A workplace, school, or other managed computer may hide, lock, or automatically set the option.
- Have a resolver URI only if you need a custom provider. The resolver’s documentation must provide a valid DoH endpoint. Do not paste a normal DNS server address or an unverified URL into the custom field.
How to turn on Secure DNS in Edge
- Open Microsoft Edge.
- Select Settings and more, shown as the three-dot button in the upper-right corner, and choose Settings.
- In the left navigation, open Privacy, search, and services.
- Scroll down to the Security section.
- Turn on Use secure DNS to specify how to lookup the network address for websites.
- Leave Use current service provider selected for the normal default, or choose the custom-provider option if you have a resolver URI you trust.
You can open the same settings page directly by entering edge://settings/privacy in Edge’s address bar. If the page opens but the control is absent or cannot be changed, skip to the managed-device and troubleshooting sections below rather than assuming the browser is malfunctioning.
Current provider or a custom DoH provider?
After the toggle is enabled, Edge offers a choice between using the DNS service already supplied by the network and specifying a particular secure resolver. The right choice depends on whether you prioritize a simple setup, control over the resolver operator, or predictable behavior when secure resolution fails.
| Decision point | Use current service provider | Specify a custom provider |
|---|---|---|
| Resolver operator | The provider associated with the current network or connection. | The organization operating the resolver URI you enter. |
| Required information | No URI is needed. | A valid DoH resolver URI supplied by the provider. |
| Failure behavior | If the secure connection fails, Edge may retry through the current provider with ordinary, unencrypted DNS. | According to Microsoft’s documentation, Edge does not fall back to a regular DNS lookup when a specific secure provider is selected and secure resolution fails. |
| Administrative compatibility | Usually easiest for a personal, unmanaged browser, subject to local network behavior. | May be constrained by organization policy or by a policy-defined resolver template. |
| Privacy decision | You accept the current provider’s published handling and logging practices. | You choose a provider and should read its current privacy and logging policy before using it. |
The current-provider choice is the least complicated starting point because it requires no endpoint research. It is not equivalent to guaranteed encrypted DNS in every failure condition: the documented retry behavior can send a later lookup as plaintext if the secure attempt cannot be completed. Selecting a specific provider removes that documented plaintext fallback, but it also means a resolver outage can prevent name resolution instead of quietly reverting to ordinary DNS.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
How to enter a custom resolver safely
A custom setting is useful when an administrator has mandated a particular DoH service, when you have evaluated a resolver’s privacy policy, or when you need behavior that is independent of the DNS server advertised by a particular Wi‑Fi network. The URI is the critical value: it tells Edge where to send HTTPS DNS requests.
- Open
edge://settings/privacy, or follow the menu path described above. - Under Security, enable Use secure DNS to specify how to lookup the network address for websites if it is not already on.
- Select the option to choose a service provider or enter a custom provider, according to the labels shown by your Edge build.
- Paste the complete DoH resolver URI exactly as supplied by the resolver operator. Preserve its scheme, host, path, and any required template syntax.
- Apply or leave the page after Edge accepts the value, then open a new tab and test several sites.
- A conventional address such as
192.0.2.1is a DNS server address, not a DoH URI, and is not the value this field requests. - Do not invent a path by changing a provider’s URL. A resolver can require a specific endpoint format.
- Review the provider’s privacy, retention, jurisdiction, availability, and terms before directing browser lookups to it.
- If the endpoint is unavailable, the custom-provider mode can leave sites unresolved because Microsoft says it does not fall back to regular DNS in that mode.
What happens when secure resolution fails
Fallback behavior is the most important practical difference between the two provider modes. With Use current service provider, Edge attempts to use DoH through the current provider. If that secure connection fails, Edge may retry the lookup through the current provider using unencrypted DNS. This can preserve connectivity, but the retry no longer has the confidentiality and integrity benefits of DoH.
When you explicitly select a secure provider, Microsoft documents that Edge does not perform a regular DNS lookup if secure resolution fails. The result can be a page that cannot be found until the resolver or the network path is working again. This stricter behavior is useful when avoiding plaintext DNS is more important than automatic recovery.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
A failed secure attempt can be caused by a temporary resolver outage, a captive portal, a firewall that blocks the HTTPS DNS endpoint, an enterprise inspection system, or an invalid custom URI. Changing providers repeatedly without identifying the cause can make diagnosis harder, so note which mode is selected before troubleshooting.
Edge Secure DNS versus Windows 11 encrypted DNS
Windows 11 can configure encrypted DNS in its network settings at the operating-system client layer. Edge’s Secure DNS setting operates inside the browser. They can coexist, but enabling one does not document or prove the state of the other.
| Characteristic | Edge Secure DNS | Windows 11 encrypted DNS |
|---|---|---|
| Scope | DNS lookups made by Microsoft Edge. | DNS behavior for supported Windows networking and applications using the system resolver. |
| Where it is configured | Edge Settings > Privacy, search, and services > Security. | Windows network settings for the relevant adapter or connection. |
| Independence | Can use its own current or custom DoH provider. | Uses the operating-system configuration and its selected network resolver settings. |
| What changing it affects | Browser hostname resolution. | Other system components and applications that rely on Windows DNS resolution. |
If your goal is to protect DNS requests from a single browser, configure Edge. If you need encrypted DNS for multiple applications, examine Windows 11’s network-level setting as a separate task. Document both settings when diagnosing a mixed result, such as Edge resolving a site while another application does not.
Rank #4
- Tri-Band WiFi 6E Router - Up to 5400 Mbps WiFi for faster browsing, streaming, gaming and downloading, all at the same time(6 GHz: 2402 Mbps;5 GHz: 2402 Mbps;2.4 GHz: 574 Mbps)
- WiFi 6E Unleashed – The 6 GHz band brings more bandwidth, faster speeds, and near-zero latency; Enables more responsive gaming and video chatting
- Connect More Devices—True Tri-Band and OFDMA technology increase capacity by 4 times to enable simultaneous transmission to more devices
- Unique Design, More RAM, Better Processing - A unique housing design provides optimal heat dissipation, combined with a 1.0 GHz dual-core CPU and 512 MB High-Speed Memory, the AXE75 is designed for long-term reliability and performance.
- EasyMesh-compatible - Extend network range even more by adding EasyMesh-compatible routers, extenders, or wireless powerline adapters for a seamless, whole-home connection. Eliminate dead zones, drops, and lag as you move across your home.
Why the Secure DNS option is missing, locked, or keeps changing
Organization policy controls the browser
On organization-managed computers, Secure DNS can be disabled by default, enforced, or made unavailable for personal changes. A missing toggle, a greyed-out control, or a setting that returns to an earlier value after restart is consistent with administrative control. Contact the administrator rather than attempting to bypass the policy; the organization may require its own resolver, inspection path, or compliance configuration.
Resolver policies require a valid template
Microsoft provides Edge policies named DnsOverHttpsTemplates and DnsOverHttpsMode. The template policy accepts one or more resolver URI templates. When DnsOverHttpsMode is set to secure, Microsoft requires a non-empty template. Microsoft lists support for these policies in Windows Edge from version 83 onward.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →If a managed browser has secure mode enforced but no valid template, the configuration can be unusable even though the policy is present. An administrator should verify that the template is complete, reachable from the organization’s networks, and appropriate for the required mode.
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
The browser is not managed, but the network interferes
A hotel, airport, school, or workplace network may require a sign-in page before allowing normal HTTPS traffic. Secure DNS can fail until the captive portal is completed. Connect to the network, finish its sign-in process in a normal browser tab, and then test the setting again. If an inspection gateway blocks the resolver endpoint, use the resolver and network configuration approved by the network operator.
The custom URI is invalid
Check the endpoint character for character against the resolver’s own documentation. A typo in the hostname or path, an omitted scheme, or an unsupported template format can prevent secure lookups. Temporarily return to Use current service provider to determine whether ordinary Edge resolution works, then correct the URI before trying custom mode again.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting checklist
- Sites stop loading immediately after enabling Secure DNS: Reopen the Security section and identify whether you selected a custom provider. If so, verify the URI and whether the endpoint is reachable on the current network.
- Only some networks fail: Compare behavior on a different connection. A network firewall, captive portal, or policy may be blocking the HTTPS resolver path.
- The setting turns itself off: Treat this as a possible management policy, profile synchronization issue, or browser configuration reset. Check with the device administrator before changing other network settings.
- Edge works, but another application does not: Remember that Edge’s setting is browser-specific. Configure Windows 11 encrypted DNS separately if system-wide coverage is required.
- You expected a VPN-like result: Secure DNS only protects hostname lookups between Edge and the resolver. It does not replace HTTPS for web content or encrypt traffic from other applications.
- You are unsure whether a resolver is trustworthy: Do not choose it solely because it is listed in a guide. Read its current privacy and logging policy, confirm the endpoint comes from the operator, and consider whether its jurisdiction and availability fit your needs.
Security and privacy limits to understand
DNS visibility moves to the resolver
DoH prevents ordinary network observers from reading or modifying the DNS message in transit to the resolver. The resolver still receives the lookup and may associate it with an address, account, or other metadata according to its own policies. Choosing a custom provider changes who operates that point; it does not eliminate the point.
Website traffic has separate protection
After DNS resolution, Edge connects to the destination. Secure DNS does not encrypt non-DNS traffic, hide the destination from every party that can observe the connection, or guarantee that a website is safe. Use the site’s HTTPS connection and normal security practices for the content and credentials exchanged after lookup.
Fallback can change the privacy result
In current-provider mode, a secure failure may trigger an ordinary DNS retry. That behavior preserves access but can expose that particular lookup to plaintext DNS. A specifically selected provider avoids that documented fallback, with the trade-off that an outage can produce a resolution failure instead.
How to change or disable the setting
- Open
edge://settings/privacyor navigate through Settings and more > Settings > Privacy, search, and services. - Scroll to Security.
- To stop Edge from using DoH, switch off Use secure DNS to specify how to lookup the network address for websites.
- To keep Secure DNS but change the resolver, leave the toggle on and select a different current or custom provider.
If the switch cannot be changed or immediately returns to its previous state, the browser is probably receiving an administrative setting. Only the organization that manages the device or Edge profile can reliably change an enforced value.
Quick Recap
Choosing the right configuration
- Personal computer, no special requirement: Enable Secure DNS and start with Use current service provider. This avoids entering an endpoint you have not evaluated.
- You have a documented resolver and want consistent operator control: Use the custom option with the exact DoH URI published by that provider.
- You must avoid plaintext fallback: Select a specific provider, then accept that resolver failure can stop hostname resolution until the secure path is restored.
- Managed work or school device: Follow the organization’s policy. A local change may be unavailable, overwritten, or contrary to the approved network design.
- You need protection beyond Edge: Configure Windows 11 encrypted DNS separately and verify each application’s resolver behavior; Edge’s setting alone is not system-wide.
Key points
- Edge’s path is Settings and more > Settings > Privacy, search, and services > Security.
- Use secure DNS to specify how to lookup the network address for websites enables DNS over HTTPS for Edge lookups.
- Use current service provider is the simplest choice but may fall back to plaintext DNS after a secure failure.
- A selected custom provider requires a valid DoH resolver URI and, according to Microsoft, does not fall back to ordinary DNS when secure resolution fails.
- Edge Secure DNS and Windows 11 system encrypted DNS are separate layers.
- Missing or locked controls commonly indicate management policy; the
DnsOverHttpsTemplatesandDnsOverHttpsModepolicies can define or enforce the resolver behavior.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
