Privacy-Focused DNS over QUIC Setup

# Verify DoQ is listening
ss -ulnp | grep 784
# UNCONN  0  0  0.0.0.0:784  0.0.0.0:*  users:(("AdGuardHome",pid=1234))

# Install dnsproxy
wget https://github.com/AdguardTeam/dnsproxy/releases/latest/download/dnsproxy-linux-amd64-*.tar.gz
tar xzf dnsproxy-linux-amd64-*.tar.gz
sudo mv dnsproxy /usr/local/bin/

# Run with DoQ upstream, listen locally for all protocols
sudo dnsproxy \
  --listen=127.0.0.1 \
  --port=53 \
  --upstream="quic://dns.mullvad.net" \
  --fallback="https://9.9.9.9/dns-query" \
  --tls-port=853 \
  --tls-crt=/etc/letsencrypt/live/dns.yourdomain.com/fullchain.pem \
  --tls-key=/etc/letsencrypt/live/dns.yourdomain.com/privkey.pem \
  --quic-port=784 \
  --cache \
  --cache-size=2048

sudo systemctl enable --now dnsproxy

# Point local resolver to dnsproxy
sudo tee /etc/resolv.conf << 'EOF'
nameserver 127.0.0.1
options edns0 trust-ad
EOF

# Install q — a modern DNS client with DoQ support
go install github.com/natesales/q@latest

# Query over DoQ
q example.com A @quic://dns.mullvad.net
q example.com AAAA @quic://dns.adguard-dns.com

# Compare latency: DoQ vs DoT vs DoH vs plain DNS
time q example.com @quic://dns.mullvad.net
time q example.com @tls://dns.mullvad.net
time q example.com @https://dns.mullvad.net/dns-query
time q example.com @1.1.1.1

# Or use doggo (another modern DNS CLI)
brew install doggo   # macOS
# Linux: download from github.com/mr-karan/doggo/releases

doggo example.com --type A @quic://dns.mullvad.net

# Install knot-resolver on OpenWrt
opkg install knot-resolver knot-resolver-mod-dns64

# /etc/knot-resolver/kresd.conf
-- Use DoQ upstream
policy.add(policy.all(policy.TLS_FORWARD({
  {'193.138.218.74', hostname='dns.mullvad.net'},
})))

-- Local cache
cache.size = 10 * MB

-- Listen on all interfaces for local clients
net.listen('0.0.0.0', 53, { kind = 'dns' })

# Confirm DNS queries are not going out in plaintext
# Run tcpdump while making a DNS request
sudo tcpdump -i eth0 -n port 53 &
curl https://example.com
# If you see UDP port 53 traffic → plaintext DNS is leaking

# If using DoQ correctly: you should see UDP port 784 (DoQ) or 443 (DoH)
sudo tcpdump -i eth0 -n udp port 784 &
q example.com @quic://dns.mullvad.net
# Should see traffic on 784

# Online leak test
curl https://browserleaks.com/dns  # requires browser
# Or:
curl https://api.ipify.org   # then check what resolvers your ISP sees

# Install Knot Resolver (supports DoQ)
brew install knot-resolver

# Create configuration
mkdir -p ~/.knot-resolver
cat > ~/.knot-resolver/config << 'EOF'
-- Knot Resolver macOS configuration
modules = { 'hints' }

-- DoQ upstream
policy.add(policy.all(policy.TLS_FORWARD({
  {'45.76.113.31', 'quic://dns.mullvad.net'},  -- Mullvad DoQ server
})))

-- Cache
cache.size = 100 * MB
cache.min_ttl = 300

-- Listen on localhost only
net.listen('127.0.0.1', 53, { kind = 'dns' })
EOF

# Run Knot Resolver
kresd -c ~/.knot-resolver/config

# Configure system DNS to use local resolver
# System Preferences → Network → Advanced → DNS
# Add: 127.0.0.1

# Install dnscrypt-proxy
brew install dnscrypt-proxy

# Configuration file
cat > /usr/local/etc/dnscrypt-proxy/dnscrypt-proxy.toml << 'EOF'
listen_addresses = ['127.0.0.1:53']

# Use Mullvad DoQ
server_names = ['mullvad']

# Log DNS queries (optional, privacy implications)
log_files = []

# Disable logging for privacy
cert_ignore_timestamp = false
EOF

# Start service
brew services start dnscrypt-proxy

# Verify
dig @127.0.0.1 example.com

# 1. Verify local DoQ proxy is listening
ss -ulnp | grep 784
# Should show: UNCONN  0  0  0.0.0.0:784  0.0.0.0:*

# 2. Test DoQ query directly
q example.com @quic://dns.mullvad.net -v

# 3. Check firewall rules
sudo ufw status | grep 784
# Add if needed: sudo ufw allow 784/udp

# 4. Capture traffic to verify
sudo tcpdump -i eth0 -n 'udp port 784'

# 5. Test from different network (ISP blocking?)
# Use hotspot or mobile data to test

# 6. Verify certificate validity (if self-hosted)
openssl s_client -connect yourdns.example.com:784

#!/bin/bash
# dns-protocol-benchmark.sh

DOMAIN="example.com"
ITERATIONS=100

echo "=== DNS Protocol Performance Benchmark ==="

for protocol in "plain-dns" "dot" "doh" "doq"; do
  case $protocol in
    plain-dns)
      RESOLVER="@1.1.1.1"
      LABEL="DNS (plain)"
      ;;
    dot)
      RESOLVER="@tls://dns.mullvad.net"
      LABEL="DNS over TLS"
      ;;
    doh)
      RESOLVER="@https://dns.mullvad.net/dns-query"
      LABEL="DNS over HTTPS"
      ;;
    doq)
      RESOLVER="@quic://dns.mullvad.net"
      LABEL="DNS over QUIC"
      ;;
  esac

  echo -n "Testing $LABEL: "

  total_time=0
  for ((i=1; i<=ITERATIONS; i++)); do
    start=$(date +%s%N)
    q $DOMAIN $RESOLVER > /dev/null 2>&1
    end=$(date +%s%N)
    elapsed=$((($end - $start) / 1000000))  # Convert to ms
    total_time=$(($total_time + $elapsed))
  done

  avg=$((total_time / ITERATIONS))
  echo "${avg}ms average"
done

echo
echo "Summary:"
echo "Plain DNS: Fastest, no privacy"
echo "DoT:       +10-20ms, encrypted"
echo "DoH:       +15-25ms, looks like HTTPS"
echo "DoQ:       +5-15ms, lowest latency (QUIC)"

# Using AdGuard Home API
curl -s http://localhost:3000/control/stats \
  -H "Authorization: Basic $(echo -n 'admin:password' | base64)" | jq '{
    total_queries: .num_dns_queries,
    queries_today: .num_dns_queries_today,
    blocked: .num_blocked_filtering,
    query_log_enabled: .query_log_enabled,
    stats_interval: .stats_interval
  }'

# Parse query log for DoQ specific stats
jq -r 'select(.Protocol == "quic") | .QH' /opt/AdGuardHome/data/querylog.json \
  | sort | uniq -c | sort -rn | head -10