doq

README

doqd

DNS over QUIC implementation in Go (draft-ietf-dprive-dnsoquic-02)

This repo contains a client and server in conformance with draft-ietf-dprive-dnsoquic-02. Each acts as a proxy for queries from DoQ to plain DNS and vice versa.

Quickstart

Start the server proxy

doqd server --cert cert.pem --key key.pem --upstream localhost:53 --listen localhost:8853
INFO[0000] starting QUIC listener on localhost:8853

Start the client proxy

doqd client --listen localhost:53 --upstream localhost:8853
INFO[0000] starting UDP listener on localhost:53

Query with dig through the client proxy

dig +short natesales.net @localhost
23.141.112.33

Query directly with the q DNS client:

q A natesales.net @quic://localhost:8853
natesales.net. 9h40m58s A 23.141.112.33

Interoperability

This DoQ implementation is designed to be in conformance with draft-ietf-dprive-dnsoquic-02, and therefore only offers the doq-i02 TLS ALPN token. For experimental interop testing, doq.Server and doq.Client can be created with the compat parameter set to true to enable compatibility of other ALPN tokens.

Tuning

As per the quic-go wiki, quic-go recommends increasing the maximum UDP receive buffer size and will show a warning if this value is too small. For DNS queries where the packet sizes are small to begin with, increasing the value won't yield a performance improvement so this is up to the operator.

Local TLS

QUIC requires a TLS certificate. OpenSSL can be used to generate a self-signed local development cert:

openssl req -x509 -newkey rsa:4096 -sha256 -days 356 -nodes -keyout /tmp/key.pem -out /tmp/cert.pem -subj "/CN=localhost"

Documentation

Index

• Constants
• Variables

Constants

const (
	NoError       = 0x00 // No error. This is used when the connection or stream needs to be closed, but there is no error to signal.
	InternalError = 0x01 // The DoQ implementation encountered an internal error and is incapable of pursuing the transaction or the connection
)

Errors

Variables

var TlsProtos = []string{"doq-i02"}

TlsProtos stores the dnsoquic draft version for TLS protocol announcement

var TlsProtosCompat = []string{"doq-i02", "doq-i01", "doq-i00", "doq", "dq"}

TlsProtosCompat stores alternative TLS protocols for experimental interoperability