Configure encrypted name resolution
Verified with Windows 11 25H2 — updated on July 12, 2026
Supported on: At least Windows Server 20H2, Windows 10 Version 20H2
Path in the GPO console
Computer Configuration\Administrative Templates\Network\DNS Client Description
Specifies if the DNS client will perform name resolution over encrypted protocols. By default, the DNS client will do classic DNS name resolution (over UDP or TCP port 53). This setting can enhance the DNS client to use encrypted protocols to resolve domain names. To use this policy setting, click Enabled, and then select one of the following options from the drop-down list: Prohibit encryption: no encrypted name resolution will be performed. Allow encryption: Use encrypted name resolution if the configured servers support it. If they don't support it, try classic name resolution. Require encryption: Allow only encrypted name resolution. If there are no configured DNS servers that handle encryption, name resolution will fail. In addition to the generic encryption policy, additional policies can be configured at the individual protocol level. For example, in order to force DoT name resolution only, a combination of "Require encryption" and "Block DoH" would be needed (vice versa to force DoH). For the example above, it is the admin's responsibility to ensure that if DoT is forced, there are valid DoT servers configured on the machine (vice versa for DoH). If you disable this policy setting, or if you do not configure this policy setting, the DNS client will use locally configured settings. DDR (Discovery of Designated Resolvers) plaintext traffic will be allowed as it is necessary for auto-discovering encryption settings.
Registry
Software\Policies\Microsoft\Windows NT\DNSClient Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure encrypted name resolution
; State: Enabled
; Supported on: At least Windows Server 20H2, Windows 10 Version 20H2
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient]
"DoHPolicy"=dword:00000003
"DohPolicySetting"=dword:00000000
"DotPolicySetting"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure encrypted name resolution
# State: Enabled
# Supported on: At least Windows Server 20H2, Windows 10 Version 20H2
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoHPolicy' -Value 3 -Type DWord
Set-ItemProperty -Path $path -Name 'DohPolicySetting' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'DotPolicySetting' -Value 0 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure encrypted name resolution
# State: Enabled
# Supported on: At least Windows Server 20H2, Windows 10 Version 20H2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'DoHPolicy' -Expected 3 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'DohPolicySetting' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'DotPolicySetting' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure encrypted name resolution
# State: Enabled
# Supported on: At least Windows Server 20H2, Windows 10 Version 20H2
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoHPolicy' -Value 3 -Type DWord
Set-ItemProperty -Path $path -Name 'DohPolicySetting' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'DotPolicySetting' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure encrypted name resolution
# State: Enabled
# Supported on: At least Windows Server 20H2, Windows 10 Version 20H2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure encrypted name resolution
# State: Enabled
# Supported on: At least Windows Server 20H2, Windows 10 Version 20H2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'DoHPolicy' -Expected 3 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'DohPolicySetting' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient' -Name 'DotPolicySetting' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure encrypted name resolution
# State: Enabled
# Supported on: At least Windows Server 20H2, Windows 10 Version 20H2
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoHPolicy' -Value 3 -Type DWord
Set-ItemProperty -Path $path -Name 'DohPolicySetting' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'DotPolicySetting' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.