Will QUIC protocol be added?

[Calvin]

Do you have plans to add QUIC protocol to DNS Benchmark v2?

 

[Calvin]

Oh, I see it's already there as Doq. I haven't purchased yet and there was no mention of QUIC anywhere.

 

[Calvin]

Let me Google that for me ... reading ... oh, summry:

QUIC = UDP TLS 1,3, and UDP = IPv4 and IPv6

Q: Google, what is QUIC DNS?

A: QUIC DNS (DNS over QUIC or DoQ) is an encrypted, faster, and more efficient way to send DNS queries using the modern QUIC transport protocol, reducing latency and avoiding head-of-line blocking compared to older methods like DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH). [1, 2, 3]

How QUIC DNS (DoQ) Works

1. Transport Protocol: It replaces older TCP-based DNS (DoT/DoH) with QUIC, a transport protocol designed by Google (and later standardized) that runs over UDP.
2. Encryption: Uses TLS 1.3 encryption by default, securing DNS queries from eavesdropping.
3. Efficiency: QUIC establishes connections faster and handles packet loss better via independent streams, preventing stalls (head-of-line blocking). [1, 2, 4, 5, 6]

Key Benefits of DoQ

• Faster Connection Establishment: Reduced latency for resolving domain names.
• Improved Performance: Independent stream processing minimizes performance impacts from packet loss.
• Enhanced Privacy: Encrypted queries protect user activity. [1, 2, 5]

Current Status

• DoQ (RFC 9250) became a proposed standard in 2022 but is still in early stages of broad adoption compared to DoH/DoT. [3, 5, 7]

DoQ vs. DoH/DoT

• DoT: Runs over a single TCP/TLS connection (susceptible to head-of-line blocking).
• DoH: Runs over HTTP/2 or HTTP/3, adding web-like overhead (cookies/headers).
• DoQ: A more direct, lightweight mapping of DNS messages to QUIC streams, often considered more natural for DNS. [2, 8]

[1] https://controld.com/blog/dns-security-protocols/
[2] https://help.nextdns.io/t/x2hmvas/w...dns-over-quic-doq-and-dns-over-https-doh-doh3
[3] https://adguard-dns.io/en/blog/dns-over-quic-official-standard.html
[4] https://arxiv.org/abs/1801.05168
[5] https://dnsprivacy.org.uk/docs/how-it-works/encryption_methods/doq.html
[6] https://www.catchpoint.com/http2-vs-http3/dns-over-quic
[7] https://blog.nlnetlabs.nl/dns-over-quic-in-unbound/
[8] https://www.rfc-editor.org/rfc/rfc9250.html

- - - - -

Q: Well; gosh darn, then Google, does QUIC DNS run over standard IPv4 and IPv6?

A: Yes, QUIC DNS (DoQ) runs over both IPv4 and IPv6, as the underlying QUIC protocol supports both network layers.

QUIC DNS (DNS over QUIC or DoQ) is an encrypted, faster, and more reliable protocol for sending DNS queries, using the modern QUIC transport layer (built on UDP) instead of traditional TCP/UDP. [1, 2, 3, 4]

What is QUIC DNS (DoQ)?

• A privacy-focused DNS protocol that encrypts DNS traffic by default using QUIC (which integrates TLS 1.3).
• Offers improved performance, faster connection setup (0-RTT), and reliability over older encrypted DNS methods (like DoT/DoH).
• Standardized in RFC 9250 (May 2022). [2, 3, 5, 6]

Does it use IPv4 and IPv6?

• Yes. QUIC itself is a general-purpose transport protocol designed to operate over standard IPv4 and IPv6 network layers. DNS over QUIC inherits this compatibility. [1, 8]

[1] https://blog.lacnic.net/en/a-practical-improvement-in-dns-transport-over-udp-over-ipv6/
[2] https://blog.apnic.net/2022/03/29/a-first-look-at-dns-over-quic/
[3] https://adguard-dns.io/en/blog/dns-over-quic-official-standard.html
[4]

https://www.reddit.com/r/crypto/comments/daoint/the_quic_compromise_opinion

[5] https://www.rfc-editor.org/rfc/rfc9250.html
[6] https://www.cloudns.net/blog/quic-protocol-explained-what-it-is-and-how-it-works/
[7] https://blog.apnic.net/2020/07/17/ipv6-and-the-dns-2/
[8] https://www.f5.com/glossary/quic-http3

- - - - -

So, I imagine, in response to to the opening question:

@Calvin: "... Will QUIC protocol be added? Do you have plans to add QUIC protocol to DNS Benchmark v2? ..."

... the answer is most probably "yes", as a byproduct of DNSBench 2
testing IPv4 and IPv6, I guess.

Even DNSBench 1 tests IPv4, so there's that.

Good exploration - thanks.

No need for the snark. I know what QUIC is. I searched the forum and QUIC did not turn up. I even replied prior to your snarky reply that I did see Doq was indeed supported. Not that it matters but Google and Gemini is for chumps.

 

[Scott]

Steve decided back in February not to support DNS over QUIC, saying he might add it in the future if there's greater industry adoption. So that would make it years down the road, if ever:

https://www.grc.com/groups/dns.dev:729

 

[Calvin]

Steve decided back in February not to support DNS over QUIC, saying he might add it in the future if there's greater industry adoption. So that would make it years down the road, if ever:

https://www.grc.com/groups/dns.dev:729

Intersting. The screenshot here https://forums.grc.com/threads/milestone-tls-protocols-loading-and-parsing.1946/ shows DOQ though it's not clear if it actually works. I haven't yet purchased benchmark v2 as I wanted to first make sure I could make it work on Apple Silicon using Wine. I managed to get the old version working, so I think the new one should work too.

I'm not sure why steve thinks DOQ won't be adopted. I am using it with upstream providers with AdGuard Home and its stats show DOQ to be faster than any DOH server. Here are some public quic servers I am currently using.


quic://unfiltered.adguard-dns.com
quic://p1.freedns.controld.com
quic://p0.freedns.controld.com
Quic://dns.nextdns.io/

 

[PHolder]

The screenshot here

That screenshot is development release 4. The current release to the public is equivalent to development release 75 I believe. A lot of features and capabilities came and went over the year of development, and Steve decided to shelve some of them (there was originally going to be two paid versions, one with more features, but that idea too got shelved.) There is no QUIC support in this version of DNSB and so far as I know there are no plans to pursue it further for now.

 

[Steve]

I haven't yet purchased benchmark v2 as I wanted to first make sure I could make it work on Apple Silicon using Wine. I managed to get the old version working, so I think the new one should work too.

There are people over in the development newsgroup who have been successfully running DNSBv2 on Apple (ARM) silicon under WINE.

Earlier today someone else asked about the apparently missing DoQ from our previously posted plans for v2. I'll share my reply since it provides a more fulsome picture:

You're 100% correct that DoQ was on the original plan, but Windows offers zero support for the protocol so adding it outside of Windows would have been a significant undertaking. Like you, I love DoQ. It is the right solution for authenticating and encrypting DNS -- far superior to the TLS-based protocols. But it is not the protocol that the industry has chosen. For better or for worse it appears that we're going to be stuck with the ridiculous overhead of TLS. I'm not happy about it, but when I was faced with the prospect of investing heavily in the support for DoQ which almost no one was going to actually be able to use, it made no sense for a $9.95 product.

I DO have a bunch of preliminary support for DoQ written and currently disabled in my code. I left it in there in case DoQ might have a future... though I'm not hopeful.

I'll likely revisit this in the future. But adding it would have been a significant task that would have delayed the release of what we have. If DoQ grows rather than shrinks then it would clearly be something that DNSB needs to offer.