Set up dnsdome on Windows 10 and 11

Windows 11 with DNS-over-HTTPS

Windows 11 can encrypt DNS natively. It needs both an IP address and a DoH template, and it will only use the template if the IP matches a known DoH server, so register the template first.

1. In the panel open your profile's Encrypted DNS card and copy the DNS-over-HTTPS address, https://dns.dnsdome.com/dns-query/<token>.
2. Open Terminal or Command Prompt as administrator and register the template for the dnsdome IP:

   netsh dns add encryption server=87.244.198.165 dohtemplate=https://dns.dnsdome.com/dns-query/<token> autoupgrade=yes udpfallback=no

3. Open Settings → Network & internet, select your active Wi-Fi or Ethernet connection, then under DNS server assignment click Edit.
4. Switch to Manual, turn IPv4 on, set Preferred DNS to 87.244.198.165, and set DNS over HTTPS to On (manual template) with the same address as in step 1. Leave the alternate DNS empty.
5. Leave IPv6 off unless you need it, so no query slips out through another resolver. Click Save.
6. Flush the cache and test:

   ipconfig /flushdns
   nslookup doubleclick.net

   With the Ads & Tracking category enabled the answer is the block response, and the query shows as blocked in your log.

With DoH the token identifies your profile, so the PC keeps working on any network, and its public IP does not need to be on the allowlist.

Windows 10, or Windows 11 with plain DNS

1. Add your network's public IP to the profile's allowlist in the panel.
2. Open Settings → Network & Internet, choose your connection, and click Edit under IP settings (Windows 10) or DNS server assignment (Windows 11).
3. Switch from Automatic (DHCP) to Manual, turn IPv4 on, set Preferred DNS to 87.244.198.165 and leave the alternate blank.
4. Save, then run ipconfig /flushdns in Command Prompt.

Things that bite on Windows

• Smart Multi-Homed Name Resolution sends queries to every adapter's DNS in parallel. If you also have a VPN adapter or a second NIC with its own DNS, clear those or set them to dnsdome too.
• Browsers have their own DoH. Chrome and Edge default to upgrading whatever resolver the OS uses, which is fine here. Firefox uses Cloudflare by default unless you point it at dnsdome; see browsers.
• Alternate DNS is not a backup, it is a leak. Windows will happily use it when the primary is slower to answer. Leave it empty or set it to the same address.