DNS over QUIC (DoQ) explained and when to use it

DNS over QUIC (DoQ) is an encrypted-DNS transport standardised in RFC 9250 (May 2022). It sends DNS queries and responses over the QUIC transport rather than TCP or plain UDP. This guide explains how it works, how it differs from DNS over TLS (DoT) and DNS over HTTPS (DoH), and where it fits today.

Know the protocol

• Transport. DoQ runs DNS over QUIC, which itself tunnels TLS 1.3. It listens by default on UDP port 853 and is negotiated with the ALPN token doq.
• Privacy and performance. Because QUIC multiplexes streams inside one connection, DoQ avoids the head-of-line blocking that TCP and DoT can suffer, has latency similar to plain UDP, and recovers from packet loss efficiently.
• Reuses a familiar wire format. The DNS message uses the same 2-byte length prefix as DNS over TCP, but carried on QUIC streams.

Compare transports

• DNS over TLS (DoT). Layered DNS over TCP plus TLS on port 853. Widely supported by operating systems and enterprise resolvers, but one connection handles one query at a time and can block. See the DoT and DoH comparison.
• DNS over HTTPS (DoH). Sends DNS inside HTTP(S) requests on port 443, so it blends with ordinary web traffic and is the default encrypted-DNS mode in many browsers. See DNS over HTTPS.
• DNS over QUIC (DoQ). The family equivalent of DoT's privacy with QUIC's performance: it stays on port 853 for clear visibility to network operators, but removes TCP head-of-line blocking and supports fast connection setup with QUIC's 0-RTT resumption.

Check adoption

• Standard. Established RFC 9250, so the protocol definition is stable.
• Public resolvers. Support exists in privacy-focused public resolvers and in DNS server software like Unbound and PowerDNS; Quad9 added DoQ alongside DoH3, and consumers such as AdGuard have offered DoQ endpoints for some time.
• Operating systems. As of mid-2026 no major OS runs DoQ in its system resolver by default, unlike DoT and DoH which have native support. Adoption today is mostly in dedicated privacy tools, VPNs and manually configured resolvers.
• Rule of thumb. If you need encrypted DNS now and broad device support matters, prefer DoT or DoH. If you are building a resolver or a client for technically managed environments where port 853 stays routable, DoQ's multiplexing and fast handshake make it a strong choice. Most deployments still warrant a fallback to another transport.