Cybersecurity glossary
What is DNS over QUIC (DoQ)?
Learn what DNS over QUIC (DoQ) is, how it encrypts DNS on the QUIC transport, how it compares with DoT and DoH, and when operators consider deploying it.
Definition
DNS over QUIC (DoQ) is a protocol that carries DNS messages over the QUIC transport, providing encrypted, multiplexed client-to-resolver communication with TLS 1.3 security properties built into QUIC.
Why DoQ exists
Encrypted DNS needed options beyond TCP+TLS and HTTPS wrapping. DNS over QUIC (DoQ) maps DNS onto QUIC so clients get confidentiality, integrity, and modern loss-recovery behavior without HTTP overhead.
It sits in the same privacy family as DoT and DoH: protect the stub-to-resolver path, then still trust the resolver for recursive discovery.
How DoQ carries DNS
Client knows a DoQ endpoint
Configuration points to a resolver that advertises DoQ service.
Establish a QUIC connection
The client opens a QUIC session to the resolver, typically on UDP/853.
Send DNS messages on streams
Queries are framed on QUIC streams according to the DoQ mapping.
Multiplex concurrent lookups
Multiple DNS exchanges can proceed without head-of-line blocking typical of one TCP stream.
Receive encrypted answers
Responses return on the QUIC connection with TLS 1.3 protections.
Fall back if needed
Clients may try DoT, DoH, or classic DNS when DoQ is blocked or unsupported.
DoQ vs DoT vs DoH
| Topic | DoQ | DoT | DoH |
|---|---|---|---|
| Transport base | QUIC (UDP) | TLS over TCP | HTTPS over TCP or QUIC |
| HTTP required | No | No | Yes |
| Typical port | 853/UDP | 853/TCP | 443/TCP or 443/UDP |
| Main appeal | Encrypted DNS with QUIC performance traits | Simple encrypted DNS channel | Works where HTTPS is least restricted |
Operational considerations
Middlebox behavior
Some networks mishandle QUIC; DoQ may need measured fallbacks.
Certificate identity
Clients must authenticate the DoQ resolver like any TLS server.
Logging and policy
Enterprises still need a strategy for which resolvers endpoints may use.
Complementary controls
DoQ does not replace DNSSEC validation of zone data.
Checklist for evaluators
- Confirm client and resolver support for RFC 9250 DoQ before relying on it.
- Verify certificate validation and pinning policies for the DoQ endpoint.
- Test performance and success rates across restrictive networks versus DoH/DoT.
- Define fallback order so resolution continues if QUIC is blocked.
- Review resolver privacy statements—encryption does not equal no logging.
- Monitor UDP/853 reachability separately from TCP/853 DoT.
- Keep abuse controls on public DoQ resolvers comparable to other recursive services.
- Document DoQ as one encrypted DNS option in your architecture decision record.
The practical takeaway
DNS over QUIC (DoQ) encrypts DNS on the QUIC transport, offering a dedicated alternative to DoT and DoH with modern multiplexing characteristics. It improves path privacy to a trusted resolver without turning DNS into HTTP.
Evaluate DoQ where QUIC is reliable and clients support it, and treat resolver choice, fallbacks, and DNSSEC as separate decisions that still matter.
Related security terms
QUIC
The UDP-based multiplexed transport that DoQ uses.
DNS over TLS (DoT)
Encrypted DNS over TLS on TCP, often compared with DoQ.
DNS over HTTPS (DoH)
Encrypted DNS multiplexed inside HTTPS rather than raw QUIC DNS framing.
HTTP/3
HTTP mapped onto QUIC; related ecosystem but distinct from DoQ.
DNS Resolver
The endpoint that terminates DoQ sessions and answers queries.
Frequently asked questions
What is DoQ in simple terms?
DoQ sends DNS queries over QUIC, an encrypted modern transport, so the path to your resolver is confidential and resistant to simple tampering.
How does DoQ differ from DoH?
DoH embeds DNS in HTTPS. DoQ carries DNS directly over QUIC without HTTP semantics, which can be leaner for pure DNS workloads.
How does DoQ differ from DoT?
DoT uses TLS over TCP. DoQ uses QUIC over UDP, gaining multiplexing and typically faster connection establishment with TLS 1.3.
Which port does DoQ use?
The reserved port for DoQ is 853/UDP, the same number DoT uses on TCP, which helps operators reason about encrypted DNS services.
Is DoQ widely deployed yet?
Support is growing among privacy-focused resolvers and experimental clients, but DoH and DoT remain more common in mainstream consumer software.
Does DoQ provide anonymity?
No. It encrypts the client-to-resolver path. The resolver still sees query names unless additional privacy techniques are used.
Which RFC defines DoQ?
RFC 9250 specifies DNS over Dedicated QUIC Connections.
References
Explore authoritative guidance and frameworks related to dns over quic (doq).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.