DNS over QUIC

DoQ

DNS over QUIC (DoQ) is a protocol that provides encrypted DNS resolution by leveraging

QUIC's built-in security and performance features. It addresses limitations found in earlier encrypted DNS protocols while offering improved efficiency and connection management.

Enhanced Security: DoQ encrypts DNS queries using QUIC's native TLS 1.3 encryption, protecting against eavesdropping and tampering.

Improved Performance: QUIC's multiplexing capabilities allow multiple DNS queries over a single connection without head-of-line blocking.

Reduced Latency: 0-RTT connection establishment enables faster DNS resolution for subsequent queries.

Better Connection Migration: QUIC supports seamless connection migration across network changes, maintaining DNS service continuity.

Comparison with Other Encrypted DNS Protocols

DNS over HTTPS (DoH): While DoH uses HTTP/2 or HTTP/3, DoQ operates directly over QUIC with dedicated connections, potentially offering lower overhead and better performance.

DNS over TLS (DoT): DoT relies on TCP, which suffers from head-of-line blocking. DoQ's use of QUIC eliminates this issue and provides faster connection establishment.

Technical Implementation

DoQ operates on UDP port 853 and uses dedicated QUIC connections for DNS traffic. The protocol is standardized in RFC 9250, which defines the specifications for DNS over Dedicated QUIC Connections. This standardization ensures interoperability between different implementations and promotes widespread adoption.

Adoption and Future Outlook

As DoQ becomes an official standard, more DNS providers and client applications are beginning to support it. The protocol represents a significant step forward in DNS privacy and performance, combining the security benefits of encryption with QUIC's modern transport features.

RFC 9250: DNS over Dedicated QUIC Connections

This document describes the use of QUIC to provide transport confidentiality for DNS. The encryption provided by QUIC has similar properties to those provided by TLS, while QUIC transport eliminates the head-of-line blocking issues inherent with TCP and provides more efficient packet-loss recovery than UDP. DNS over QUIC (DoQ) has privacy properties similar to DNS over TLS (DoT) specified in RFC 7858, and latency characteristics similar to classic DNS over UDP. This specification describes the use of DoQ as a general-purpose transport for DNS and includes the use of DoQ for stub to recursive, recursive to authoritative, and zone transfer scenarios.