DNS over QUIC

DNS over QUIC (DoQ) carries DNS messages over QUIC and encrypts the transport between client and resolver. QUIC can establish protected connections with stream-based delivery and connection features suited to modern networks. Like DoT and DoH, DoQ protects a link; the resolver still receives and processes the query.

DoQ is not a DNS record type and does not sign zone data. DNSSEC validation remains a separate check on the authenticity and integrity of DNS answers. A deployment also depends on client and resolver support, configuration, and network policy.

Reference: RFC 9250 — DNS over Dedicated QUIC Connections

Check your understanding

Choose the best answer. The examples use training names and do not send real DNS queries.

Quiz#dns.m14.l1.e1

Which statement about DoQ is correct?

It is encrypted DNS over QUIC, but the resolver still receives the queryIt automatically signs every DNS recordIt is a record in the zone