We Measured Our Own Four Encrypted DNS Transports

DoH, DoH3, DoT and DoQ all run on this resolver, so the same query can go through each of them and be counted. We measured round trips to a first answer, bytes on the wire per cold lookup, latency percentiles at 2% packet loss, and what the post-quantum key exchange costs. DoQ answers a full round trip before DoT and DoH; DoH3 is also QUIC but spends that round trip setting up HTTP/3. Under loss the medians barely move while the tails separate completely: DoH's 95th percentile is eight times its own median, DoT's 99th is 1.2 seconds, and both QUIC transports stay under half a second.

Comparisons of encrypted DNS protocols are usually written from the specifications. We run all four transports on one resolver, so we could put the same query through each of them and count what came back.

The measurements were taken in an isolated network namespace on a veth pair with a 1500-byte MTU, with 20ms of delay injected in each direction so that one round trip costs exactly 40ms and round trips are visible in the timings rather than inferred. One client was used for every transport, so the differences are protocols rather than implementations. Production traffic was not involved.

DoQ reaches an answer a full round trip before DoT and DoH, which is QUIC combining the transport and TLS handshakes. DoH3 is also QUIC and yet lands with the TCP transports: the round trip QUIC saves is spent opening HTTP/3 control streams before the query can go out.

Under 2% packet loss the medians hardly move on any transport. The tails do not stay together. DoH's 95th percentile is eight times its own median and DoT's 99th percentile is 1205ms, because TCP waits out a retransmission timeout that starts at one second. The QUIC transports stay bounded at 376ms and 455ms. Plain DNS is fast in every sample that arrives, for the simple reason that it has no loss recovery at all: two of sixty lookups never returned.

The result we did not expect concerns the post-quantum key exchange. On DoQ the post-quantum handshake completes a full round trip faster than the classical one. A QUIC server may not send more than three times the bytes it has received from an address it has not validated. A classical ClientHello fits in one 1308-byte packet, so the server may send 3924 bytes; it has 4131 bytes to send, stops 207 bytes short of finishing, and has to wait for the client to speak again. The larger post-quantum ClientHello needs two packets, the budget doubles, and the whole flight goes out at once. The lever is handshake size rather than cryptography, so a shorter certificate chain removes the stall - which makes this our result rather than a general rule. Both packet traces are in the guide.

The full write-up carries the tables, the charts and the method, including its limits: one vantage point, one client stack, and no DNSCrypt endpoint here, so DNSCrypt stays out of the measured tables.

Highlights