Windows Server DNS encryption has officially arrived — and for enterprise IT teams, it’s one of the most meaningful network security upgrades in decades. Microsoft has made DNS over HTTPS (DoH) generally available on Windows Server 2025 via the June 2026 cumulative update (KB5094125), closing a vulnerability that has existed since DNS was first standardised in 1985. If your organisation relies on Windows DNS Server for internal name resolution, here’s everything you need to know about what changed, why it matters, and how to turn it on.
What Is DNS — and Why Has It Been a Security Risk for 40 Years?
The Domain Name System (DNS) is often described as the phonebook of the internet. Every time a user types a web address, a DNS query runs in the background to translate that human-readable name into an IP address the network can route to. It happens thousands of times a day per device, usually invisibly.
The problem is that since its creation in 1985, traditional DNS has transmitted those queries in plain text. That means anyone with access to the network path between a client and its DNS server — whether an attacker on a compromised network switch, a malicious insider, or a rogue access point — can read exactly which domains are being queried. Worse, they can intercept and falsify the responses, a technique known as DNS spoofing or cache poisoning, redirecting users to fraudulent servers without any visible warning.
For consumer devices, encrypted DNS options like DoH and DNS over TLS (DoT) have existed in browsers and client operating systems for several years. But the server side of the equation — the Windows DNS Server role that corporate environments rely on to handle internal name resolution — has historically been left out of that protection. That gap has now been closed.
DNS over HTTPS: How Encrypted DNS Actually Works
DNS over HTTPS, or DoH, resolves DNS queries over an HTTPS connection protected by TLS certificates rather than sending them as unencrypted UDP or TCP packets. Because the traffic is wrapped inside standard HTTPS — the same protocol used for secure web browsing — it is indistinguishable from regular web traffic on the wire, making it very difficult for an attacker to identify, intercept, or tamper with.
Specifically, DoH delivers three concrete protections:
- Confidentiality: DNS queries and responses are encrypted in transit, so a network observer cannot read which domains are being resolved.
- Integrity: TLS ensures the response has not been modified in transit, blocking DNS spoofing and cache-poisoning attacks.
- Authentication: The client can verify the identity of the DNS server via its TLS certificate, confirming it is talking to a legitimate server rather than an imposter.
It is worth noting an important limitation: DoH encrypts the communication between client and DNS server. It does not encrypt DNS traffic exchanged between two DNS servers (for example, during recursive resolution between an authoritative server and a resolver). Microsoft’s implementation is explicit about this scope — protection is at the client-to-server hop.
DoH Windows Server: What Microsoft Has Actually Released
Starting with the 2026-06 Security Update (KB5094125) for Windows Server 2025, the Windows DNS Server role gains full DoH support. This is a generally available (GA) release — not a preview — meaning Microsoft considers it production-ready for enterprise deployments.
The feature had been in public preview since a February 2026 update, giving administrators time to evaluate it in test environments before Microsoft declared it ready for production use. After months of real-world testing, the company confirmed that DoH is stable, compatible with existing DNS infrastructure including the Windows DNS Server service, and does not introduce significant administrative overhead.
Key characteristics of the GA release include:
- DoH is disabled by default — organisations opt in on their own schedule, preserving backwards compatibility.
- Traditional unencrypted DNS can run in parallel alongside DoH during a phased migration, so legacy clients are not broken overnight.
- The feature is fully compatible with existing Windows DNS Server deployments, including those integrated with Active Directory.
- Microsoft has published detailed official documentation for enabling and verifying DoH on Windows Server, including PowerShell commands and TLS certificate requirements.
Enabling Windows Server DNS Encryption: Where to Start
Before you can enable DoH on your Windows DNS Server, your server must be running Windows Server 2025 with the June 2026 cumulative update (KB5094125) or later applied. Once that prerequisite is confirmed, the high-level steps are:
- Obtain or configure a TLS certificate for the DNS server. This can be an internal PKI certificate or a publicly trusted certificate, depending on your environment’s trust model.
- Enable the DoH listener on the DNS Server service using PowerShell or DNS Manager. The server will then accept encrypted queries on port 443 in addition to traditional queries on port 53.
- Configure clients (Windows endpoints, Group Policy, or Intune-managed devices) to send DNS queries to the server’s DoH endpoint URI rather than its plain-text address.
- Verify connectivity using built-in DNS diagnostic tools or packet capture to confirm traffic is flowing over HTTPS and that unencrypted queries are resolving as expected for legacy clients.
- Harden progressively — once the majority of clients are sending encrypted DNS, you can restrict the plain-text DNS listener or enforce DoH-only policies for sensitive segments.
The Microsoft Learn guide to DNS encryption using DNS over HTTPS provides step-by-step PowerShell commands and verification procedures. Following that guide is the fastest way to get a working DoH configuration in a lab before you roll out to production.
DoH Windows Server and the Zero Trust Security Model
Microsoft has framed DNS over HTTPS in Windows Server 2025 as a direct extension of its broader Zero Trust strategy. Zero Trust operates on the principle that no user, device, or service should be trusted automatically — regardless of whether it sits inside or outside the corporate perimeter. Every communication must be authenticated and verified.
Traditional plaintext DNS is fundamentally at odds with that principle. A Zero Trust environment cannot claim to verify every connection if the very first step — resolving a domain name — leaks information in the clear and cannot prove the resolver is who it claims to be. Encrypted DNS closes that logical gap, making name resolution a cryptographically verified, confidential step rather than an open broadcast.
For IT administrators who are building or extending a Zero Trust network architecture, DoH on Windows DNS Server is not optional in the long term — it’s a foundational layer. Alongside other controls such as network segmentation, certificate-based authentication, and endpoint compliance checks, encrypted DNS forms part of a defence-in-depth approach where no single layer is relied upon to carry the entire security burden.
If your team manages Windows Server infrastructure and you haven’t reviewed your server credentials policy recently, our guide to the Windows Server admin credentials character limit and domain strategy covers another often-overlooked layer of hardening that pairs well with a DoH rollout.
Why Encrypted DNS Matters Even for Internal Networks
A common misconception is that DNS encryption is only relevant for traffic leaving the corporate perimeter — that internal DNS is somehow safe by virtue of being on a trusted LAN. That assumption has been consistently disproven by real-world attacks. Lateral movement after an initial breach often relies on DNS reconnaissance: querying internal names to map the network, locate domain controllers, or identify sensitive services. All of that activity is trivially visible in plaintext DNS logs — or to any attacker who has already gained a foothold inside the network.
Encrypting internal DNS traffic limits that reconnaissance capability. Even if an attacker successfully compromises a workstation or an internal switch, they cannot passively harvest DNS query data from the network path. That forces attackers to work harder and generate more detectable activity, giving defenders more time and more signal to respond.
Given that cyber attacks are growing in sophistication year over year, even incremental improvements to foundational protocols like DNS can have an outsized effect on the overall security posture of an organisation. Microsoft’s decision to bring DoH to the server side — not just the client side — reflects that reality.
Windows Server 2025 and the Broader Security Picture
DNS over HTTPS is one of several security-focused features that Microsoft has shipped in Windows Server 2025. The platform also includes improvements to SMB security, enhanced Credential Guard, and tighter integration with Microsoft Defender for servers — all aimed at raising the baseline for enterprise environments without requiring organisations to rip and replace their existing infrastructure.
For businesses running Windows Server 2025 who want to ensure their endpoints are equally up to date, a properly licensed and activated copy of Windows 11 Pro on workstations pairs well with a hardened server infrastructure. Keeping both the server and desktop tiers on supported, actively updated platforms is the single most effective way to stay ahead of known vulnerabilities.
If you’re looking to upgrade desktop licensing across your organisation alongside your server security refresh, explore the Microsoft Windows 11 Pro OEM key available from ShopKeyOnline — instant email delivery, fully genuine, and compatible with the latest security features including Windows Defender and Secure Boot.
FAQ
What Windows Server version supports DNS over HTTPS?
DoH support for the Windows DNS Server role is available on Windows Server 2025 with the June 2026 cumulative update (KB5094125) or later applied. Earlier versions of Windows Server, including Windows Server 2022 and 2019, do not have built-in DoH support for the server-side DNS role. Client-side DoH (in the Windows DNS resolver) has been available in Windows 11 and Windows 10 for some time, but the server role is new territory.
Does enabling DoH break existing DNS clients?
No — not immediately. The feature is disabled by default, and when you do enable it, the traditional plaintext DNS listener on port 53 continues to function alongside the new DoH listener on port 443. This means legacy clients that don’t support DoH continue to work normally during a phased migration. Administrators set the pace of the transition themselves, moving clients to encrypted DNS gradually without creating downtime.
Is DoH the same as DNSSEC?
No, these are complementary but distinct technologies. DNSSEC (DNS Security Extensions) adds digital signatures to DNS records so a client can verify the data hasn’t been tampered with, but it doesn’t encrypt the queries themselves — they remain visible in plaintext on the network. DoH encrypts the entire DNS query and response, hiding them from network observers, but in its basic form does not validate the authenticity of DNS record data the way DNSSEC does. Ideally, a hardened environment uses both.
Does DNS over HTTPS protect all DNS traffic on the network?
DoH protects the communication between the DNS client and the DNS server — the first hop. It does not encrypt traffic between DNS servers themselves, such as when your internal DNS server forwards a query to an upstream resolver. Microsoft is explicit about this scope in its documentation. To protect the full chain, organisations should consider encrypted forwarders or DNS over TLS for server-to-server communication as a complementary measure.
How is DoH different from a VPN for DNS protection?
A VPN encrypts all traffic between an endpoint and a VPN gateway, including DNS. DoH encrypts specifically DNS traffic between the client and a specific DoH-capable resolver. VPNs add latency and route all traffic through a single point, whereas DoH is lightweight and doesn’t alter the path of non-DNS traffic. For corporate environments, DoH on an internal DNS server is a more targeted and lower-overhead solution for protecting name resolution, while VPNs serve a broader purpose for remote access scenarios.
