Skip to main content
← back to home FR

DNS over QUIC

Encrypted DNS over QUIC, where the client supports it

Endpoint

Port 8853 is intentional and must be supplied to clients that otherwise assume the RFC default port.

Test with kdig

A Knot DNS kdig build with QUIC support can query:

kdig +quic -p 8853 @ledns.eu example.com A

Client packaging and QUIC support vary by distribution. Check the installed kdig build rather than assuming the option exists.

Compatibility

dnscrypt-proxy is not a DoQ client; the earlier configuration claiming otherwise was wrong. It supports other encrypted DNS transports, including DoH.

DoQ can reduce connection-establishment overhead and behave well under packet loss, but it is not universally the lowest-latency choice. The v2 server disables 0-RTT, and connection migration depends on the client. If UDP 8853 is blocked, use DoH or DoT.