Blog Post

Networking Blog
3 MIN READ

DNS over TLS available to Windows Insiders

tojens's avatar
tojens
Icon for Microsoft rankMicrosoft
Jul 13, 2022
Credit and thanks to Alex Jercaianu, Matthew Cox, Miguel Reyes Badilla, and Milan Justel for implementation work   DNS over TLS (DoT) is an alternative encrypted DNS protocol to DNS over HTTPS (D...
Updated Jul 11, 2022
Version 1.0
DNS
DoT
tojens's avatar
Icon for Microsoft rankMicrosoft
Technical PM for the Windows native HTTP stacks, IPv6 transition tech, and various IETF engagements
View Profile
Networking Blog
The Official Blog Site of the Windows Core Networking Team at Microsoft
JonathanKay's avatar
JonathanKay
Iron Contributor
Jul 14, 2022

Is this supposed to work on IPv6?  As soon as I trigger "netsh dns add encryption..." on a v6 address, ping/mstsc/et al. all stop being able to resolve.  Wireshark shows no network activity to the v6 DoT IP I've entered.

 

Example:

C:\Users\TReKiE>ping google.com
Pinging google.com [2607:f8b0:400b:803::200e] with 32 bytes of data:
Reply from 2607:f8b0:400b:803::200e: time=15ms
Reply from 2607:f8b0:400b:803::200e: time=23ms

Ping statistics for 2607:f8b0:400b:803::200e:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 15ms, Maximum = 23ms, Average = 19ms
Control-C
^C
C:\Users\TReKiE>netsh dns add encryption server=2001:4860:4860::8888 dothost=: autoupgrade=yes

C:\Users\TReKiE>ipconfig /flushdns
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.

C:\Users\TReKiE>ping google.com
Ping request could not find host google.com. Please check the name and try again.

I've tried with Google (2001:4860:4860::8888), Cloudflare (2606:4700:4700::1111), and CIRA (2620:10A:80BB::10) servers, all with identical results.  Wireshark shows plenty of traffic over port 853 going to the v4 IP address however.  "netsh dns show encryption" shows the v6 addresses as DNS-over-TLS hosts, the same as the v4 one.