DoQ (DNS-over-QUIC)
DoQ (DNS-over-QUIC), defined in RFC 9250, encrypts DNS queries and responses using QUIC instead of TLS-over-TCP (DoT) or HTTPS (DoH), while reusing the same UDP port 853 that DoT reserved. Because QUIC builds the TLS 1.3 handshake into its own connection setup and carries each DNS message on an independent stream, a single lost packet only stalls the query riding that one stream, rather than blocking every other in-flight query the way a single stalled TCP connection can under DoT. QUIC's connection migration also lets an established DoQ session survive a client switching networks -- moving from WiFi to mobile data -- without restarting the handshake. DoQ is newer and less widely deployed than DoH or DoT: support exists in some recursive resolvers and client libraries, but it is not yet a default option in mainstream operating systems or browsers the way DoH is. The privacy goal is identical to DoH and DoT -- stopping an on-path observer from reading or tampering with DNS traffic -- the difference is purely which transport carries the encrypted query.
By AdminKit team, Netbase JSC · Updated