DNS over QUIC implementation in Go (draft-ietf-dprive-dnsoquic-02)
This repo contains a client and server in conformance with draft-ietf-dprive-dnsoquic-02. Each acts as a proxy for queries from DoQ to plain DNS and vice versa.
Start the server proxy
doqd server --cert cert.pem --key key.pem --upstream localhost:53 --listen localhost:8853
INFO[0000] starting QUIC listener on localhost:8853Start the client proxy
doqd client --listen localhost:53 --upstream localhost:8853
INFO[0000] starting UDP listener on localhost:53Query with dig through the client proxy
dig +short natesales.net @localhost
23.141.112.33Query directly with the q DNS client:
q A natesales.net @quic://localhost:8853
natesales.net. 9h40m58s A 23.141.112.33This DoQ implementation is designed to be in conformance with draft-ietf-dprive-dnsoquic-02, and therefore only offers the doq-i02 TLS ALPN token. For experimental interop testing, doq.Server and doq.Client can be created with the compat parameter set to true to enable compatibility of other ALPN tokens.
As per the quic-go wiki, quic-go recommends increasing the maximum UDP receive buffer size and will show a warning if this value is too small. For DNS queries where the packet sizes are small to begin with, increasing the value won't yield a performance improvement so this is up to the operator.
QUIC requires a TLS certificate. OpenSSL can be used to generate a self-signed local development cert:
openssl req -x509 -newkey rsa:4096 -sha256 -days 356 -nodes -keyout /tmp/key.pem -out /tmp/cert.pem -subj "/CN=localhost"