I’ve spent the past few months testing all types of DNS. I’ve tested Quad9 against Cloudflare, Cloudflare WARP against my default ISP DNS, encrypted DNS against regular DNS from a coffee shop, and much more.

Throughout all of that time, one acronym kept popping up that I’d never encountered: DoQ.

DNS over QUIC is a new Domain Name System protocol that will be a game changer for online security and privacy — but almost no one has started using it so far.

You’re already using QUIC without realizing it

Modernizing the web one protocol at a time

QUIC is a protocol originally developed by Google, first standardized by the IETF as RFC 9000 in 2021. It mandates encryption at every level, has faster connection handshakes, massively decreases return connection handshakes, and is a core of the latest standard of the web, HTTP/3.

In a few words, QUIC solves many of the problems with older transport encryption protocols, like TCP, modernizing many of the core aspects of web communication. QUIC runs over UDP, but it isn’t simply “UDP with encryption.” It provides reliable, ordered streams, congestion control, connection management, and encryption. Importantly, its security is built around TLS 1.3 rather than being something bolted on afterward.

It’s also a core part of why new protocols such as DoQ, DoH3, and HTTP/3 can flourish; much of the older, slower tech is being overhauled and used as the foundations for newer, faster protocols (note: overhauled, not replaced).

Oh, and in case you were wondering, QUIC originally stood for Quick UDP Internet Connections, but that acronym was dropped when the protocol was standardized. However, at this point, none of this is DNS-specific, but it is underpinning what makes DoQ the next big thing in DNS.

What is DoQ, and what does it fix?

It’s more secure than DoT or DoH

Okay, so, right now, there are three main forms of DNS that most folks will use: plaintext (i.e., unsecured) DNS, DNS over TLS (DoT), and DNS over HTTPS (DoH).

• Unsecured DNS is just as it sounds. Your DNS requests are sent in plaintext over the internet for anyone to read.
• DNS over TLS encrypts your requests with TLS, adding security, but carries many of the issues of older internet protocols, such as TCP. For example, any data transmission issues can slow your whole connection.
• DNS over HTTPS uses HTTP/2 or HTTP/3 to send encrypted DNS requests in normal web traffic, but it carries more overhead than the older DoT standard.

DNS over QUIC (DoQ) takes a step forward by running DNS requests over the QUIC protocol. That means it effectively doesn’t require the slower and outdated TLS handling (because it’s directly integrated into QUIC), but also doesn’t carry the same overhead as the HTTP(S) wrapper on top, massively benefiting from the multiple streams and faster responses.

DoH3 is already doing something similar

But it’s all about layers

Now, the keen-eyed among you will note (or already know) that DoQ and HTTP/3 have similar attributes; QUIC is a core part of HTTP/3, after all.

It means that DNS over HTTPS (DoH) running over HTTP/3 connections also picks up the same benefits of QUIC’s transport layer goodies, making it a faster and more secure option. If you’re using DoH3, you’re already receiving some of those advantages, and have been since 2022.

So, why then, you may ask, does DNS over QUIC need to exist or be implemented at all? The answer comes down to layers.

• With DoH3, the process works as such: DNS → HTTP → QUIC → UDP.
• With DoQ, the process is: DNS → QUIC → UDP

That layer makes the difference. DoQ is a dedicated DNS protocol that doesn’t pretend to be anything else, which is exactly what you want in DNS infrastructure where HTTP was never adding much benefit to begin with.

You can’t use DoQ just yet

Unless you have a specific DNS configuration

Despite how good DoQ sounds, it has one problem: there aren’t really many consumer devices that currently support it. Windows, macOS, Linux, Android, and iOS don’t expose DoQ natively, which makes using what is a finished standard nearly impossible.

It’s also not an available option in your browser, either. For example, when you select secure DNS in your browser, you’re often given a list of DNS providers to choose from, or the option to add your own. You won’t find a DoQ resolver lurking there.

That’s because while QUIC underpins HTTP/3, it’s still not actually part of HTTPS itself, so there isn’t a standard toggle to just turn it on.

That leaves one configuration that can currently put DoQ to use: folks with a home DNS server setup. Tools such as Technitium, AdGuard Home, and dnsproxy support upstream DNS over QUIC. This means, if you use one of these tools on your DNS server, you can configure them to send and forward over DoQ instead.

However, I appreciate that’s not something everyone has access to, despite how easy it is to set up your own DNS server these days.

When will DoQ see a larger rollout?

It needs one of the bigger guns to get involved

Saying “big guns” when talking about AdGuard feels disingenuous; it’s one of the best options for anyone running a home DNS configuration. It was also the first public DNS resolver to implement DoQ support, too.

But really, it needs someone like Cloudflare to come out and add DoQ to its public-facing DNS resolver (1.1.1.1) to truly get the ball moving, or Google Chrome to list it as an option in its Secure DNS settings.

DoQ is a great idea, and it’s sitting there waiting to be used by more folks. It just needs that little push over the top, then it’ll see massive uptake across the board. Until that time, firing up your own DNS server at home is a great option, and one you won’t regret in the long term.