DNS over QUIC (DoQ)
Was ist DNS over QUIC (DoQ)?
DNS over QUIC (DoQ)A DNS transport (RFC 9250, 2022) that runs DNS queries over QUIC, providing the confidentiality and integrity of DoT/DoH with lower handshake latency, better connection migration, and head-of-line blocking immunity from QUIC.
DNS over QUIC (DoQ), standardized as RFC 9250 in May 2022, is a third privacy-preserving DNS transport alongside DoT (RFC 7858, 2016) and DoH (RFC 8484, 2018). DoQ multiplexes DNS queries over a single QUIC connection, using QUIC's 1-RTT or 0-RTT handshake and its built-in TLS 1.3 encryption. Compared to DoT, DoQ avoids head-of-line blocking by carrying each DNS query in a separate QUIC stream; compared to DoH, it avoids HTTP/2 framing overhead and stays closer to the wire-format DNS that operators are used to. Connection migration (QUIC's ability to survive a client IP change) makes DoQ particularly attractive for mobile clients. Adoption is still mixed — Android resolvers, AdGuard DNS, NextDNS, and several enterprise resolvers support DoQ — but it is part of the broader move to encrypt all DNS traffic. From a security perspective DoQ provides the same confidentiality/integrity properties as DoT/DoH: protects DNS metadata from on-path observers, defeats DNS-injection by ISPs or rogue networks, and pairs with DNSSEC for end-to-end integrity.
● Beispiele
- 01
An Android 11+ device uses DoQ to its configured Private DNS resolver, benefiting from 0-RTT lookups on already-known servers.
- 02
A privacy-focused resolver such as AdGuard or NextDNS publishes a DoT, DoH, and DoQ endpoint, letting clients pick whichever transport their OS supports.
● Häufige Fragen
Was ist DNS over QUIC (DoQ)?
A DNS transport (RFC 9250, 2022) that runs DNS queries over QUIC, providing the confidentiality and integrity of DoT/DoH with lower handshake latency, better connection migration, and head-of-line blocking immunity from QUIC. Es gehört zur Kategorie Netzwerksicherheit der Cybersicherheit.
Was bedeutet DNS over QUIC (DoQ)?
A DNS transport (RFC 9250, 2022) that runs DNS queries over QUIC, providing the confidentiality and integrity of DoT/DoH with lower handshake latency, better connection migration, and head-of-line blocking immunity from QUIC.
Wie funktioniert DNS over QUIC (DoQ)?
DNS over QUIC (DoQ), standardized as RFC 9250 in May 2022, is a third privacy-preserving DNS transport alongside DoT (RFC 7858, 2016) and DoH (RFC 8484, 2018). DoQ multiplexes DNS queries over a single QUIC connection, using QUIC's 1-RTT or 0-RTT handshake and its built-in TLS 1.3 encryption. Compared to DoT, DoQ avoids head-of-line blocking by carrying each DNS query in a separate QUIC stream; compared to DoH, it avoids HTTP/2 framing overhead and stays closer to the wire-format DNS that operators are used to. Connection migration (QUIC's ability to survive a client IP change) makes DoQ particularly attractive for mobile clients. Adoption is still mixed — Android resolvers, AdGuard DNS, NextDNS, and several enterprise resolvers support DoQ — but it is part of the broader move to encrypt all DNS traffic. From a security perspective DoQ provides the same confidentiality/integrity properties as DoT/DoH: protects DNS metadata from on-path observers, defeats DNS-injection by ISPs or rogue networks, and pairs with DNSSEC for end-to-end integrity.
Wie schützt man sich gegen DNS over QUIC (DoQ)?
Schutzmaßnahmen gegen DNS over QUIC (DoQ) kombinieren typischerweise technische Kontrollen und operative Praktiken, wie in der Definition oben beschrieben.
Welche anderen Bezeichnungen gibt es für DNS over QUIC (DoQ)?
Übliche alternative Bezeichnungen: DoQ, RFC 9250.
● Verwandte Begriffe
- network-security№ 374
DNS over HTTPS (DoH)
Protokoll, das DNS-Anfragen verschlüsselt, indem es sie über HTTPS transportiert und so verhindert, dass On-Path-Beobachter sie lesen oder manipulieren.
- network-security№ 376
DNS over TLS (DoT)
Protokoll, das DNS-Anfragen in einer dedizierten TLS-Sitzung verschlüsselt und so vor Abhören und Manipulation auf der Leitung schützt.
- network-security№ 841
Oblivious HTTP (OHTTP)
An IETF-standardized HTTP-over-HPKE relay protocol (RFC 9458) that decouples client identity from request content by splitting trust between a relay (sees IP, not content) and a gateway (sees content, not IP).
- network-security№ 555
HTTP/3 / QUIC
HTTP/3 (RFC 9114) ist die HTTP-Abbildung auf QUIC (RFC 9000), einen UDP-basierten, verschlusselten Transport mit integriertem TLS 1.3 und Stream-Multiplexing ohne Head-of-Line-Blocking.
- network-security№ 380
DNSSEC
Eine Reihe von DNS-Erweiterungen, die digitale Signaturen verwenden, damit Resolver die Echtheit und Integrität von DNS-Einträgen überprüfen können.
- network-security№ 1279
TLS (Transport Layer Security)
Das von der IETF standardisierte Kryptoprotokoll, das Vertraulichkeit, Integrität und Authentizität für den Verkehr zwischen zwei Netzwerkanwendungen liefert.