DNS over QUIC (DoQ)
Qu'est-ce que DNS over QUIC (DoQ) ?
DNS over QUIC (DoQ)A DNS transport (RFC 9250, 2022) that runs DNS queries over QUIC, providing the confidentiality and integrity of DoT/DoH with lower handshake latency, better connection migration, and head-of-line blocking immunity from QUIC.
DNS over QUIC (DoQ), standardized as RFC 9250 in May 2022, is a third privacy-preserving DNS transport alongside DoT (RFC 7858, 2016) and DoH (RFC 8484, 2018). DoQ multiplexes DNS queries over a single QUIC connection, using QUIC's 1-RTT or 0-RTT handshake and its built-in TLS 1.3 encryption. Compared to DoT, DoQ avoids head-of-line blocking by carrying each DNS query in a separate QUIC stream; compared to DoH, it avoids HTTP/2 framing overhead and stays closer to the wire-format DNS that operators are used to. Connection migration (QUIC's ability to survive a client IP change) makes DoQ particularly attractive for mobile clients. Adoption is still mixed — Android resolvers, AdGuard DNS, NextDNS, and several enterprise resolvers support DoQ — but it is part of the broader move to encrypt all DNS traffic. From a security perspective DoQ provides the same confidentiality/integrity properties as DoT/DoH: protects DNS metadata from on-path observers, defeats DNS-injection by ISPs or rogue networks, and pairs with DNSSEC for end-to-end integrity.
● Exemples
- 01
An Android 11+ device uses DoQ to its configured Private DNS resolver, benefiting from 0-RTT lookups on already-known servers.
- 02
A privacy-focused resolver such as AdGuard or NextDNS publishes a DoT, DoH, and DoQ endpoint, letting clients pick whichever transport their OS supports.
● Questions fréquentes
Qu'est-ce que DNS over QUIC (DoQ) ?
A DNS transport (RFC 9250, 2022) that runs DNS queries over QUIC, providing the confidentiality and integrity of DoT/DoH with lower handshake latency, better connection migration, and head-of-line blocking immunity from QUIC. Cette notion relève de la catégorie Sécurité réseau en cybersécurité.
Que signifie DNS over QUIC (DoQ) ?
A DNS transport (RFC 9250, 2022) that runs DNS queries over QUIC, providing the confidentiality and integrity of DoT/DoH with lower handshake latency, better connection migration, and head-of-line blocking immunity from QUIC.
Comment fonctionne DNS over QUIC (DoQ) ?
DNS over QUIC (DoQ), standardized as RFC 9250 in May 2022, is a third privacy-preserving DNS transport alongside DoT (RFC 7858, 2016) and DoH (RFC 8484, 2018). DoQ multiplexes DNS queries over a single QUIC connection, using QUIC's 1-RTT or 0-RTT handshake and its built-in TLS 1.3 encryption. Compared to DoT, DoQ avoids head-of-line blocking by carrying each DNS query in a separate QUIC stream; compared to DoH, it avoids HTTP/2 framing overhead and stays closer to the wire-format DNS that operators are used to. Connection migration (QUIC's ability to survive a client IP change) makes DoQ particularly attractive for mobile clients. Adoption is still mixed — Android resolvers, AdGuard DNS, NextDNS, and several enterprise resolvers support DoQ — but it is part of the broader move to encrypt all DNS traffic. From a security perspective DoQ provides the same confidentiality/integrity properties as DoT/DoH: protects DNS metadata from on-path observers, defeats DNS-injection by ISPs or rogue networks, and pairs with DNSSEC for end-to-end integrity.
Comment se défendre contre DNS over QUIC (DoQ) ?
Les défenses contre DNS over QUIC (DoQ) combinent habituellement des contrôles techniques et des pratiques opérationnelles, comme détaillé dans la définition ci-dessus.
Quels sont les autres noms de DNS over QUIC (DoQ) ?
Noms alternatifs courants : DoQ, RFC 9250.
● Termes liés
- network-security№ 374
DNS over HTTPS (DoH)
Protocole qui chiffre les requêtes DNS en les transportant à l'intérieur de HTTPS, empêchant un observateur en chemin de les lire ou de les modifier.
- network-security№ 376
DNS over TLS (DoT)
Protocole qui chiffre les requêtes DNS dans une session TLS dédiée, les protégeant de l'écoute et de la manipulation sur le réseau.
- network-security№ 841
Oblivious HTTP (OHTTP)
An IETF-standardized HTTP-over-HPKE relay protocol (RFC 9458) that decouples client identity from request content by splitting trust between a relay (sees IP, not content) and a gateway (sees content, not IP).
- network-security№ 555
HTTP/3 / QUIC
HTTP/3 (RFC 9114) est la projection d'HTTP sur QUIC (RFC 9000), un transport chiffre base sur UDP qui integre TLS 1.3 et offre un multiplexage par flux sans head-of-line blocking.
- network-security№ 380
DNSSEC
Ensemble d'extensions du DNS qui utilise des signatures numériques pour permettre aux résolveurs de vérifier l'authenticité et l'intégrité des enregistrements DNS.
- network-security№ 1279
TLS (Transport Layer Security)
Protocole cryptographique standardisé par l'IETF qui fournit confidentialité, intégrité et authentification au trafic entre deux applications en réseau.