My Windows 11 laptop sends its DNS requests to Cloudflare's 1.1.1.1 with DNS over HTTPS switched on, and the plaintext fallback switched off. DoH wraps the request your PC makes to look up a website's address in the same encryption that protects a normal HTTPS page, so your ISP can't read it along the way.