u/dtallee

Source - https://upload.wikimedia.org/wikipedia/commons/3/33/Japanese_peppermint.jpg

US-based Cloudflare has malware-blocking DNS servers deployed globally, and Swiss-based Quad9's DNS servers block malware by default. Use either one of these services to bypass your ISP's very not-private DNS servers.

There's an article about this here - https://www.makeuseof.com/your-isp-watching-your-browsing-whole-time-heres-windows-11-fix/ - but it doesn't give instructions on using Cloudflare's malware-blocking DNS servers. Turns out Windows does not configure the Cloudflare template properly when using Cloudflare's 1.1.1.2 & 1.0.0.2 servers - https://techcommunity.microsoft.com/discussions/windows11/windows-not-respecting-dns-over-https-templates/4116430

To use encrypted, malware-blocking public DNS servers in Windows 11:

Go to Settings.

Select Network & internet.

Select Wi-Fi or/and Ethernet, depending on how you're connected to the internet.

Select Hardware properties.

In the DNS server assignment field, select Edit.

Underneath Edit DNS settings, switch from Automatic (DHCP) to Manual in the dropdown box.

Switch on IPv4.

In Preferred DNS, type or copy/paste 1.1.1.2 for Cloudflare, or 9.9.9.9 for Quad9.

If using Cloudflare, select 'On (manual template)' in DNS over HTTPS, and then type or copy/paste:
https://security.cloudflare-dns.com/dns-query
in the DNS over HTTPS template field.

If using Quad9, select 'On (automatic template)' in the DNS over HTTPS template dropdown.

Turn 'Fallback to plaintext' Off.

In Alternate DNS, type or copy/paste 1.0.0.2 for Cloudflare, or 149.112.112.112 for Quad9.

If using Cloudflare, select 'On (manual template)' in DNS over HTTPS, and then type or copy/paste:
https://security.cloudflare-dns.com/dns-query
in the DNS over HTTPS template field.

If using Quad9, select 'On (automatic template)' in the DNS over HTTPS template dropdown.

Turn 'Fallback to plaintext' Off.

If you have an IPv6 address from your ISP, switch on IPv6. If you're unsure about this, you can check here - https://test-ipv6.com/

In Preferred DNS, type or copy/paste 2606:4700:4700::1112 for Cloudflare, or 2620:fe::fe for Quad9.

If using Cloudflare, select 'On (manual template)' in DNS over HTTPS, and then type or copy/paste:
https://security.cloudflare-dns.com/dns-query
in the DNS over HTTPS template field.

If using Quad9, select 'On (automatic template)' in the DNS over HTTPS template dropdown.

Turn 'Fallback to plaintext' Off.

In Alternate DNS, type or copy/paste 2606:4700:4700::1001 for Cloudflare, or 2620:fe::9 for Quad9.

If using Cloudflare, select 'On (manual template)' in DNS over HTTPS, and then type or copy/paste:
https://security.cloudflare-dns.com/dns-query
in the DNS over HTTPS template field.

If using Quad9, select 'On (automatic template)' in the DNS over HTTPS template dropdown.

Turn 'Fallback to plaintext' Off.

Select Save.

If you want to use malware-blocking DNS servers in your browser(s) only, go to your browser settings, locate the DNS over HTTPS section, select Custom and enter https://security.cloudflare-dns.com/dns-query for Cloudflare or https://dns.quad9.net/dns-query for Quad9.