One of the new features of Windows Server 2022 is the support of DNS over HTTPS.
When you enable DNS over HTTPS,
any communication over the DNS protocol that passes between
the server's DNS client and the DNS server would pass
across a secure HTTPS connection,
as opposed to being passed across in plain text.
This ultimately enhances your security,
because your DNS communication is protected from any type of
man‑in‑the‑middle attacks or interception.
Now there are two ways that we can configure the DNS client to support DNS
over HTTPS, so let's move on to configuring DNS over HTTPS.
The first way that we can do that is by actually
configuring it on the network interface itself.
So I have now navigated to my network interface via the Settings,
and I'll go ahead and select Ethernet.
I'm going to select my Ethernet adapter that's connected,
and I would need to make some modifications to my DNS server.
Right now my DNS setup is via DHCP,
so I'm going to go ahead and edit this and I'm going
to change it to a Manual setting.
I'll then go ahead and configure a DNS server.
I'm going to make use of a Cloudflare DNS server, which is a pretty
popular one, and now I've got some encryption options.
These encryption options are, of course, Unencrypted,
which means that all DNS traffic is unencrypted.
And then we have the option to encrypt only, and in brackets
this is DNS over HTTPS, so choosing this setting would
ultimately provide the best protection.
And then the last option that we have is Encrypted preferred,
unencrypted allowed.
This is more of a compatibility setting, because when it is chosen,
the DNS client will essentially attempt to use the DNS over
HTTPS, and if that is not possible, it will fall back to the
standard unencrypted DNS protocol.
So depending on your server that you are using,
if your server supports encrypted DNS, well, then I would suggest you hard
code your servers. If your DNS server does not encrypt it or you are not
sure about that, well, then you could probably choose the encrypted
preferred with the fallback to unencrypted DNS.
So I'm going to go ahead and select Encrypted only
and I'm going to click on Save.
Now you'll see that my DNS server has been assigned, and
in brackets it's listed as Encrypted.
But what if you wanted to configure this at a domain level using a group policy?
Well, that is possible, so let's switch to our domain controller and we will
create a new group policy where we will enforce DNS over HTTPS.
Alright, so within my domain controller,
I have now opened up the Group Policy Management.
I'm going to go ahead and create a new group policy, and I'll use the acronym
for DNS over HTTPS, and let's go ahead and edit this policy.
I'm just going to quickly resize the window so that it's easy to see.
And the setting that we are looking for specifically exists
under Computer Configuration, Policies,
Administrative Templates, Network, and the DNS Client.
Now the setting within this category is Configure
DNS over HTTPS name resolution.
So I'm going to go ahead and double‑click on the setting, and I'm going to go
and enable this configuration. Now under Configure DNS over HTTPS options, I
have a drop‑down box where I have three options.
The first option, which is Allow DNS over HTTPS, means that
queries will be performed using DNS over HTTPS.
However, if the destination DNS server does not support DNS over
HTTPS, then unencrypted queries will also be sent.
If I select Prohibit DNS over HTTPS, this will
essentially prevent the use of DNS over HTTPS.
This is not really a setting you would want to configure unless
you have a specific need to configure it.
And then the last option, which is Require DNS over HTTPS, means that the
server will require that queries sent between itself and the destination
DNS server is performed using DNS over HTTPS.
Now there's a catch with this configuration, because if
your destination DNS server does not support it, well, then
your name resolution will fail.
So depending on what destination DNS server you are using within
your enterprise, you can either select Require to enforce it or
Allow, where you have a backup which will fall back to
unencrypted DNS communication.
So in my case, I know my destination server does support DNS over HTTPS, so
I'm going to go ahead and select Require DNS over HTTPS.
I will then Apply and click on OK.
Now that I have my group policy configured,
I can go ahead and link it to a specific OU, ultimately enforcing the DNS
over HTTPS communication. Microsoft provides you with a list of servers
that are known to support DNS over HTTPS.
This list can actually be queried from PowerShell, so within a PowerShell
window, you can issue the command Get‑DnsClientDohServerAddress.
This will go ahead and then return a list of servers that
are known to support DNS over HTTPS.
You'll see that there are some common ones such as
the ones from Google, Cloudflare, Quad9, and so forth.
And you'll notice that DNS over HTTPS is not only limited to IPv4,
you can also make use of it with IPv6 DNS servers.
Now if you wanted to go and add your own server to this list,
you could do that using PowerShell.
The command to do that would be Add‑DnsClientDohServerAddress followed by
ServerAddress, where you would define your DNS server's IP address. From
here, you would need to define your DohTemplate, and you can also go ahead
and configure a fallback action.
So this concludes the configuration for DNS over HTTPS. As
you can see, it's pretty straightforward, and it is really easy to enforce on your servers.