Why your broadband router's default DNS is leaking your company's traffic (and how to fix it)
- security
- dns
- networking
- windows-11
When you plug in the standard broadband hub supplied by BT, Virgin Media, Sky, or TalkTalk, every laptop, phone, and office printer on your network defaults to using that provider’s internal DNS resolvers. Most business owners and home workers assume DNS is just an invisible piece of network plumbing. It is plumbing, but it is completely unencrypted plumbing that broadcasts every domain your staff visit directly to your telecom provider and anyone listening on the local wire.
When I inspect a home office on my £10 a month Home Device Security Plan or carry out a Windows security audit for a London business, leaving default ISP DNS in place is one of the quietest risks I find. Changing two numbers in your router or turning on encrypted DNS in Windows 11 takes two minutes, cuts out commercial telemetry, and puts an automatic threat-blocking filter in front of every device in the building.
Plain-text queries and typo hijacking
Domain Name System (DNS) is the internet’s address book. When you type an address into your browser or your accounting software connects to its API, your computer asks a DNS server to convert that human name into an IP address.
By default, traditional DNS traffic travels in clear, unencrypted text over UDP port 53. Even if every website you visit uses HTTPS to encrypt the actual page content, your broadband provider still sees a plain-text log of every single domain you look up, twenty-four hours a day. Under the UK Investigatory Powers Act, internet service providers are required to retain internet connection records for twelve months.
Worse, standard consumer hubs frequently manipulate failed lookups. If someone in your office makes a typo in a banking URL, rather than returning a standard error code that stops the browser in its tracks, several major UK consumer ISPs intercept the request and redirect the user to a search landing page filled with third-party advertising links.
Why upstream malware filtering beats local antivirus alone
An antivirus program on your laptop only reacts once a file hits your hard drive or malicious code begins executing in memory. Upstream DNS filtering stops the connection before the malicious server can send a single byte.
When you switch your resolver from an ISP default to an independent privacy-focused provider with built-in threat intelligence (like Quad9 or Cloudflare 1.1.1.2), the resolver checks every domain lookup against a live database of confirmed phishing campaigns, command-and-control servers, and newly registered scam sites. If an employee accidentally clicks a link in a convincing spear-phishing email, the DNS server simply refuses to resolve the domain, keeping the browser safely stranded before the fake login form loads.
| DNS Setup | Encryption (DoH / DoT) | Malware & Phishing Blocking | ISP Connection Logging |
|---|---|---|---|
| Default ISP Hub (BT / Virgin / Sky) | No (Plain text UDP 53) | Minimal or none | Yes (Retained under UK regulations) |
| Cloudflare (1.1.1.2 / 1.0.0.2) | Yes (DNS over HTTPS / TLS) | Automated malware blocking | No (24-hour debug logs only, never sold) |
| Quad9 (9.9.9.9 / 149.112.112.112) | Yes (DNS over HTTPS / TLS) | Aggregated threat intelligence | No (Swiss non-profit privacy mandate) |
Turning on encrypted DNS in Windows 11
Until recently, forcing encrypted DNS meant installing third-party proxy utilities or configuring complex local forwarding daemons. Windows 11 has full native support for DNS over HTTPS (DoH) built straight into the operating system.
To turn it on for your office laptop or desktop, open Windows Settings, go to Network & internet, and click either Wi-Fi or Ethernet depending on how you connect. Click Hardware properties, find the DNS server assignment line, and click Edit.
Change the dropdown from Automatic to Manual, switch on IPv4, and enter 9.9.9.9 (or 1.1.1.2) as the Preferred DNS, and 149.112.112.112 (or 1.0.0.2) as the Alternate DNS. Set the DNS encryption dropdown to Encrypted only (DNS over HTTPS). The moment you save those settings, Windows wraps every single DNS query from that machine in an encrypted HTTPS tunnel that neither your broadband provider nor anyone on the local Wi-Fi can inspect or redirect.
Sorting the whole office at the router level
Locking down Windows 11 laptops individually is a great start, but it leaves your office printers, smart TVs, Wi-Fi security cameras, and mobile phones querying whatever the router tells them to use. Many consumer IoT devices have notoriously weak DNS handling that leaves them vulnerable to DNS rebinding attacks on the local network.
If you have administrative access to your office router or use a dedicated firewall (such as OPNsense or an enterprise router behind your ISP modem), configure the DHCP server to broadcast these secure resolvers directly to every device on the subnet. That way, a guest connecting to your office Wi-Fi or a home worker using their personal tablet gets the exact same layer of malware filtering without needing manual configuration.
Common questions
Does changing DNS make my internet connection slower?
Almost never. In practice, independent anycast DNS resolvers like Cloudflare and Quad9 maintain massive server clusters in London and across Europe that often answer queries several milliseconds faster than consumer ISP gateway resolvers.
Can my ISP still see which websites I visit if I use encrypted DNS?
Encrypted DNS hides the domain lookup query. However, unless you also use Encrypted Client Hello (ECH) or a VPN, an ISP can still observe the IP addresses your computer connects to and the Server Name Indication (SNI) during the initial TLS handshake. Using encrypted DNS with threat blocking eliminates the plain-text query log and prevents malicious redirect tampering.
Do I need to change IPv6 DNS settings as well?
Yes, if your broadband provider assigns IPv6 addresses. If you enable IPv4 DNS over HTTPS but leave IPv6 on automatic, Windows will often query your router’s IPv6 DNS resolver over plain text first, bypassing your security settings. Either configure encrypted IPv6 resolvers (such as Quad9’s 2620:fe::fe) or disable IPv6 on the network adapter if you do not use it.
If you want your office network or home PC audited for DNS leaks, unpatched firmware, and exposed ports, have a look at my Windows Security Audits or the £10 a month Home Device Security Plan, or drop me a message to get your network locked down.
