can't encrypt secondary dns server

Windows does not let the secondary DNS server use encrypted DNS unless that server is recognized as a secure resolver.

What to check:

1. Open Settings > Network & Internet.
2. Select the active Wi-Fi or Ethernet connection.
3. Go to DNS settings and select Edit.
4. Switch DNS configuration to Manual.
5. Enter the preferred and alternate DNS server IP addresses.
6. Check whether the Preferred DNS encryption option becomes available.

Important behavior:

• The DNS client can only be configured to use DoH if the primary or secondary DNS server is on the list of known DoH servers.
• If the server is not on that list, the encryption dropdown is not enabled in Settings.
• In netsh, encrypted DNS must be configured as a secure resolver entry for a specific server IP before it can be used.

netsh options that are relevant:

• netsh dnsclient show encryption server=<IP address> shows whether an encrypted DNS server configuration exists for that server.
• netsh dnsclient set encryption server=<IP address> dohtemplate=<string> dothost=<hostname>:<port> autoupgrade=<yes | no> udpfallback=<yes | no> configures encrypted DNS settings for a specific server.
• netsh dnsclient set global doh=<yes | no | auto> dot=<yes | no> ddr=<yes | no> controls whether DoH is allowed globally.

If the alternate DNS server is not a known DoH server and no secure resolver configuration exists for it, it will stay unencrypted or fall back depending on configuration.

If the goal is to prevent fallback to plain DNS, avoid configurations that allow fallback such as:

• Encrypted preferred, unencrypted allowed in Settings
• udpfallback=yes in netsh
• ddrfallback=yes on the interface

• Secure DNS Client over HTTPS (DoH)
• netsh dnsclient