Add DNS over HTTPS cmdlets documentation #4061

sruthytv1988 · 2026-01-02T21:03:30Z

PR Summary

This PR adds documentation for DNS over HTTPS (DoH) configuration cmdlets for Windows Server 2025.

These cmdlets enable administrators to configure encrypted DNS communications using the DoH protocol (RFC 8484), providing enhanced security for DNS queries. The documentation includes comprehensive examples, parameter descriptions, and RFC compliance notes.

This change is planned for public preview and GA.

Cmdlets Added/Updated

New: Get-DnsServerEncryptionProtocol - Retrieves DNS over HTTPS encryption settings
New: Set-DnsServerEncryptionProtocol - Configures DNS over HTTPS encryption settings

Validation Completed

All markdown files pass validation
Examples tested and verified on Windows Server 2025
Preview disclaimer added to all cmdlets
RFC 8484 (DoH) and RFC 3986 (URI) compliance documented
Parameter descriptions complete (no placeholders)
Cross-references between cmdlets verified
Help XML generated and tested locally with Get-Help

Testing Details

Tested On: Windows Server 2025 build
Verification:
- Get-Help Get-DnsServerEncryptionProtocol -Full displays all sections correctly
- Get-Help Set-DnsServerEncryptionProtocol -Examples shows all examples
- All cmdlet examples execute successfully
- URI template pipe-separated format works as documented
- DNS service restart behavior confirmed

sruthytv1988 · 2026-01-02T21:04:51Z

@sruthytv1988 please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

learn-build-service-prod · 2026-01-02T21:05:06Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

sruthytv1988 · 2026-01-02T21:06:41Z

@sruthytv1988 please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree company="Microsoft"

sruthytv1988 · 2026-01-02T21:06:49Z

@microsoft-github-policy-service agree company="Microsoft"

learn-build-service-prod · 2026-01-02T21:08:12Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-01-02T21:28:05Z

Learn Build status updates of commit dca945c:

⚠️ Validation status: warnings

File	Status	Preview URL	Details
docset/winserver2025-ps/DnsServer/DnsServer.md	⚠️Warning	View (WindowsServer2025-ps)	Details
docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)

docset/winserver2025-ps/DnsServer/DnsServer.md

Line 0, Column 0: [Warning: PSMD2Yaml_InconsistentCmdletsInModule] Inconsistent cmdlets found in module: DnsServer. 2 cmdlets in the module folder but not listed in the module file: Get-DnsServerEncryptionProtocol, Set-DnsServerEncryptionProtocol.

For more details, please refer to the build report.

Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them.

learn-build-service-prod · 2026-01-02T21:53:52Z

Learn Build status updates of commit dca945c:

⚠️ Validation status: warnings

File	Status	Preview URL	Details
docset/winserver2025-ps/DnsServer/DnsServer.md	⚠️Warning	View (WindowsServer2025-ps)	Details
docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)

docset/winserver2025-ps/DnsServer/DnsServer.md

Line 0, Column 0: [Warning: PSMD2Yaml_InconsistentCmdletsInModule] Inconsistent cmdlets found in module: DnsServer. 2 cmdlets in the module folder but not listed in the module file: Get-DnsServerEncryptionProtocol, Set-DnsServerEncryptionProtocol.

For more details, please refer to the build report.

Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them.

learn-build-service-prod · 2026-01-14T11:54:39Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-01-14T12:17:28Z

Learn Build status updates of commit 519e375:

✅ Validation status: passed

File	Status	Preview URL
docset/winserver2025-ps/DnsServer/DnsServer.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)

For more details, please refer to the build report.

learn-build-service-prod · 2026-01-16T09:25:49Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-01-16T09:27:20Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-01-16T09:49:07Z

Learn Build status updates of commit 2cab018:

✅ Validation status: passed

File	Status	Preview URL
docset/winserver2025-ps/DnsServer/DnsServer.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)

For more details, please refer to the build report.

learn-build-service-prod · 2026-01-16T10:15:34Z

Learn Build status updates of commit f48d997:

✅ Validation status: passed

File	Status	Preview URL
docset/winserver2025-ps/DnsServer/DnsServer.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)

For more details, please refer to the build report.

robinharwood

Looks good, thank you @sruthytv1988 for these great additions. I've made some minor changes and left comments or code suggestions for the rest. Let me know if you have any questions.

robinharwood · 2026-01-19T11:15:51Z

docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md

@@ -0,0 +1,148 @@
+---
+description: Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.


Suggested change

description: Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

description: Learn how to retrieve DNS over HTTPS (DoH) settings using the Get-DnsServerEncryptionProtocol cmdlet in Windows PowerShell for Windows Server 2025 and later.

robinharwood · 2026-01-19T11:24:21Z

docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md

+# Get-DnsServerEncryptionProtocol
+
+## SYNOPSIS
+Retrieves DNS server encryption protocol settings. This cmdlet is available on Windows Server 2025 or later.


Suggested change

Retrieves DNS server encryption protocol settings. This cmdlet is available on Windows Server 2025 or later.

Retrieves DNS server encryption protocol settings for DNS over HTTPS (DoH) on Windows Server 2025 or later.

robinharwood · 2026-01-19T12:51:48Z

docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md

+```
+
+## DESCRIPTION
+The **Get-DnsServerEncryptionProtocol** cmdlet retrieves Domain Name System (DNS) server DNS over HTTPS (DoH) settings: **EnableDoh** and **UriTemplate**.


Suggested change

The **Get-DnsServerEncryptionProtocol** cmdlet retrieves Domain Name System (DNS) server DNS over HTTPS (DoH) settings: **EnableDoh** and **UriTemplate**.

The `Get-DnsServerEncryptionProtocol` cmdlet can be used to verify the current DoH configuration

on a DNS server. The cmdlet retrieves the current settings as an object with the properties

**EnableDoh** and **UriTemplate** to indicate whether DoH is enabled and the configured URI

templates for DNS queries over HTTPS.

> [!IMPORTANT]

> The `Get-DnsServerEncryptionProtocol` cmdlet is available on Windows Server 2025 or

> later beginning with 2026-02 Security Update.

robinharwood · 2026-01-19T12:56:23Z

docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md

+
+## EXAMPLES
+
+### Example 1: Retrieve encryption settings from local DNS server


I couldn't do a code suggestion for this due to it having inline code so I committed a change to your branch. Please make sure to pull your branch before making any more edits.

robinharwood · 2026-01-19T13:03:04Z

docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md

+
+This command retrieves the current encryption settings from the local DNS server. The output shows that DNS over HTTPS (DoH) is enabled with a configured URI template.
+
+### Example 2: Retrieve encryption settings from remote DNS server


I couldn't do a code suggestion for this due to it having inline code so I committed a change to your branch. Please make sure to pull your branch before making any more edits.

robinharwood · 2026-01-19T14:03:50Z

docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md

+```
+
+### -EnableDoh
+Specifies whether to enable or disable DNS over HTTPS (DoH) on the DNS server. Set to `$true` to enable DoH, or `$false` to disable it. When disabled, any configured URI templates are cleared.


Suggested change

Specifies whether to enable or disable DNS over HTTPS (DoH) on the DNS server. Set to `$true` to enable DoH, or `$false` to disable it. When disabled, any configured URI templates are cleared.

Specifies whether to enable or disable DNS over HTTPS (DoH) on the DNS server. Set the value to `$true` to

enable DoH, or `$false` to disable it. When disabled, any configured URI templates are also cleared.

robinharwood · 2026-01-19T14:29:42Z

docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md

+Specifies one or more URI templates for DNS over HTTPS (DoH) queries. If not specified when **EnableDoh** is set to `$true`, the DNS server uses a default URI template with the `/dns-query` path based on the server's fully qualified domain name (FQDN).
+
+For a single URI template, specify `"https://dnsserver.example.net/dns-query"`. To provide multiple URI templates for redundancy and load balancing, specify them as **a single string** with templates separated by the pipe character (|): `"https://dnsserver.example.net/dns-query|https://dnsserver2.example.net/dns-query"`. A maximum of three URI templates can be specified.
+
+URI templates must be valid HTTPS URIs compliant with [RFC 3986, Uniform Resource Identifier (URI): Generic Syntax](https://datatracker.ietf.org/doc/html/rfc3986). Ensure that a valid SSL/TLS certificate is configured for the DNS server with the hostname(s) specified in the URI template(s).
+


A suggestion and a couple of questions 😄

What is the default URI template? Would that just be https://<LocalServerName.fqdn>/dns-query?

When you say multiple URI templates can used for load balancing, is this round-robin load balancing? Is there any health checking? Is this part of the RFC?

Suggested change

Specifies one or more URI templates for DNS over HTTPS (DoH) queries. If not specified when **EnableDoh** is set to `$true`, the DNS server uses a default URI template with the `/dns-query` path based on the server's fully qualified domain name (FQDN).

For a single URI template, specify `"https://dnsserver.example.net/dns-query"`. To provide multiple URI templates for redundancy and load balancing, specify them as **a single string** with templates separated by the pipe character (|): `"https://dnsserver.example.net/dns-query|https://dnsserver2.example.net/dns-query"`. A maximum of three URI templates can be specified.

URI templates must be valid HTTPS URIs compliant with [RFC 3986, Uniform Resource Identifier (URI): Generic Syntax](https://datatracker.ietf.org/doc/html/rfc3986). Ensure that a valid SSL/TLS certificate is configured for the DNS server with the hostname(s) specified in the URI template(s).

Specifies one or more URI templates for DNS over HTTPS (DoH) queries. If you don't specify a value when

**EnableDoh** is set to `$true`, the DNS server uses a default URI template with the `/dns-query` path

based on the server's fully qualified domain name (FQDN).

For a single URI template, specify `"https://dnsserver.example.net/dns-query"`. To provide multiple URI

templates for redundancy and load balancing, specify them as a single string with templates separated

by the pipe character `|`. For example,

`"https://dnsserver.example.net/dns-query|https://dnsserver2.example.net/dns-query"`. A maximum of three

URI templates can be specified.

URI templates must be valid HTTPS URIs compliant with [RFC 3986, Uniform Resource Identifier (URI):

Generic Syntax](https://datatracker.ietf.org/doc/html/rfc3986). Ensure that a valid SSL/TLS certificate is

configured for the DNS server with the hostname(s) specified in the URI template(s).

robinharwood · 2026-01-19T14:30:05Z

docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md

+Shows what would happen if the cmdlet runs.
+The cmdlet is not run.


Suggested change

Shows what would happen if the cmdlet runs.

The cmdlet is not run.

Shows what would happen if the cmdlet runs. The cmdlet isn't run.

robinharwood · 2026-01-19T14:33:36Z

docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md

+```
+
+### -PassThru
+Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.


Given the cmdlet doesn't generate an output, I've left some comments in the output section for you to review.

robinharwood · 2026-01-19T14:34:44Z

docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md

+## INPUTS
+
+## OUTPUTS
+
+### Microsoft.Management.Infrastructure.CimInstance#DnsServerEncryptionProtocol
+


Suggested change

## INPUTS

## OUTPUTS

### Microsoft.Management.Infrastructure.CimInstance#DnsServerEncryptionProtocol

## INPUTS

### None

You cannot pipe objects to this cmdlet.

## OUTPUTS

### None

By default, this cmdlet does not generate any output.

### Microsoft.Management.Infrastructure.CimInstance#DnsServerEncryptionProtocol

When you specify the **PassThru** parameter, this cmdlet returns a `DnsServerEncryptionProtocol`

object that represents the updated encryption protocol settings on the DNS server.

learn-build-service-prod · 2026-01-19T14:36:32Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-01-19T14:55:05Z

Learn Build status updates of commit 1c9af45:

✅ Validation status: passed

File	Status	Preview URL
docset/winserver2025-ps/DnsServer/DnsServer.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Get-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)
docset/winserver2025-ps/DnsServer/Set-DnsServerEncryptionProtocol.md	✅Succeeded	View (WindowsServer2025-ps)

For more details, please refer to the build report.

Add DNS over HTTPS cmdlets documentation

dca945c

github-actions bot added the windows-11/svc label Jan 2, 2026

github-actions bot assigned robinharwood Jan 2, 2026

github-actions bot added the Microsoft submitter label Jan 2, 2026

sruthytv1988 closed this Jan 2, 2026

sruthytv1988 reopened this Jan 2, 2026

updated new cmdlets

519e375

updated get help files of doh

2cab018

Merge branch 'main' into dohgethelp

f48d997

Minor editorial changes

1c9af45

robinharwood requested changes Jan 19, 2026

View reviewed changes

		@@ -0,0 +1,148 @@
		---
		description: Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

	description: Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.
	description: Learn how to retrieve DNS over HTTPS (DoH) settings using the Get-DnsServerEncryptionProtocol cmdlet in Windows PowerShell for Windows Server 2025 and later.

	Retrieves DNS server encryption protocol settings. This cmdlet is available on Windows Server 2025 or later.
	Retrieves DNS server encryption protocol settings for DNS over HTTPS (DoH) on Windows Server 2025 or later.

-The **Get-DnsServerEncryptionProtocol** cmdlet retrieves Domain Name System (DNS) server DNS over HTTPS (DoH) settings: **EnableDoh** and **UriTemplate**.
+The `Get-DnsServerEncryptionProtocol` cmdlet can be used to verify the current DoH configuration
+on a DNS server. The cmdlet retrieves the current settings as an object with the properties
+**EnableDoh** and **UriTemplate** to indicate whether DoH is enabled and the configured URI
+templates for DNS queries over HTTPS.
+> [!IMPORTANT]
+> The `Get-DnsServerEncryptionProtocol` cmdlet is available on Windows Server 2025 or
+> later beginning with 2026-02 Security Update.


		## EXAMPLES

		### Example 1: Retrieve encryption settings from local DNS server


		This command retrieves the current encryption settings from the local DNS server. The output shows that DNS over HTTPS (DoH) is enabled with a configured URI template.

		### Example 2: Retrieve encryption settings from remote DNS server

	Specifies whether to enable or disable DNS over HTTPS (DoH) on the DNS server. Set to `$true` to enable DoH, or `$false` to disable it. When disabled, any configured URI templates are cleared.
	Specifies whether to enable or disable DNS over HTTPS (DoH) on the DNS server. Set the value to `$true` to
	enable DoH, or `$false` to disable it. When disabled, any configured URI templates are also cleared.

		Shows what would happen if the cmdlet runs.
		The cmdlet is not run.

Add DNS over HTTPS cmdlets documentation #4061

Are you sure you want to change the base?

Add DNS over HTTPS cmdlets documentation #4061

Conversation

sruthytv1988 commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Cmdlets Added/Updated

Validation Completed

Testing Details

Uh oh!

sruthytv1988 commented Jan 2, 2026

Uh oh!

learn-build-service-prod bot commented Jan 2, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

sruthytv1988 commented Jan 2, 2026

Uh oh!

sruthytv1988 commented Jan 2, 2026

Uh oh!

learn-build-service-prod bot commented Jan 2, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod bot commented Jan 2, 2026

⚠️ Validation status: warnings

Uh oh!

learn-build-service-prod bot commented Jan 2, 2026

⚠️ Validation status: warnings

Uh oh!

learn-build-service-prod bot commented Jan 14, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod bot commented Jan 14, 2026

✅ Validation status: passed

Uh oh!

learn-build-service-prod bot commented Jan 16, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod bot commented Jan 16, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod bot commented Jan 16, 2026

✅ Validation status: passed

Uh oh!

learn-build-service-prod bot commented Jan 16, 2026

✅ Validation status: passed

Uh oh!

robinharwood left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sruthytv1988 commented Jan 2, 2026 •

edited

Loading