How do I run on DoQ and verify it?

[Unknown78]

https://adguard-dns.io/en/public-dns.html
On the Public DNS AdGuard site, scroll down to the "Our server addresses" section. Then we'll find it lists a lot of options.

1. Now I want to use
   quic://unfiltered.adguard-dns.com

2. After putting it in the hostname in the using https://dnscrypt.info/stamps/
   I got this stamp
   sdns://BAcAAAAAAAAAAAAadW5maWx0ZXJlZC5hZGd1YXJkLWRucy5jb20

3. Then I proceed editing my dnscrypt-proxy.toml file
   I create a new server names, such that
   server_names = ['adguard-dns-unfiltered-quic']

4. Then I also put the stamp on the static section, such that

   [static.'adguard-dns-unfiltered-quic']`
      stamp = 'sdns://BAcAAAAAAAAAAAAadW5maWx0ZXJlZC5hZGd1YXJkLWRucy5jb20'`
   

5. After I run dnscrypt-proxy.exe, it throws me an error

   [2022-08-05 12:01:23] [NOTICE] dnscrypt-proxy 2.1.2
   [2022-08-05 12:01:23] [NOTICE] Network connectivity detected
   [2022-08-05 12:01:23] [NOTICE] Now listening to 127.0.0.1:53 [UDP]
   [2022-08-05 12:01:23] [NOTICE] Now listening to 127.0.0.1:53 [TCP]
   [2022-08-05 12:01:23] [NOTICE] Source [public-resolvers] loaded
   [2022-08-05 12:01:23] [NOTICE] Source [relays] loaded
   [2022-08-05 12:01:23] [FATAL] Stamp error for the static [adguard-dns-unfiltered-quic] definition: [Unsupported stamp version or protocol]
   

What went wrong? Did I miss something?

[jedisct1]

dnscrypt-proxy doesn't support DoQ. It supports DNSCrypt which is also UDP-based, and DNS-over-HTTP/3 which is QUIC-based.

[Unknown78]

1. But it's there on the stamp calculator, so it will support it in the future then?
2. At the moment, is there any public resolver that use DNS-over-HTTP/3? I couldn't find it listed on https://dnscrypt.info/public-servers/

[ghost]

Last time I tested there were 4 out of 103. IIRC google and jp.tiar.app-doh were 2 of them. Set log level to 0 and look for protocol h3 in the log file.

[Unknown78]

Last time I tested there were 4 out of 103. IIRC google and jp.tiar.app-doh were 2 of them. Set log level to 0 and look for protocol h3 in the log file.

I could only found two:

[INFO] [doh-crypto-sx] TLS version: 304 - Protocol: h3 - Cipher suite: 4867
[NOTICE] [doh-crypto-sx] OK (DoH) - rtt: 450ms
[INFO] [jp.tiarap.org] TLS version: 304 - Protocol: h3 - Cipher suite: 4867
[NOTICE] [jp.tiarap.org] OK (DoH) - rtt: 191ms

1. Is it what it is? Only two? Did I make a mistake? In mine, the latency is very high compared to Cloudflare h2 which is less than 20ms.
2. How did you find it to be four? Is the support vary over time?
3. Which one should I prioritize? Protocol or latency?

[tebakyuk]

I could only found two:

[INFO] [doh-crypto-sx] TLS version: 304 - Protocol: h3 - Cipher suite: 4867
[NOTICE] [doh-crypto-sx] OK (DoH) - rtt: 450ms
[INFO] [jp.tiarap.org] TLS version: 304 - Protocol: h3 - Cipher suite: 4867
[NOTICE] [jp.tiarap.org] OK (DoH) - rtt: 191ms

1. Is it what it is? Only two? Did I make a mistake? In mine, the latency is very high compared to Cloudflare h2 which is less than 20ms.

2. How did you find it to be four? Is the support vary over time?

3. Which one should I prioritize? Protocol or latency?

not only you ,

if Http3 true resolver can't be detect or latency too high , but via dns leak use nearest server location

well this is problem if we force use Http3 maybe in some hours or days dnscrypt-proxy will make it down by self cause unable to detect http3 server and can't find another resolver use http3.

best way disable Http3 or keep turn on but turn on dnscrypt servers so have backup if dnscrypt-proxy unable process trought http3

[ghost]

It's currently 5 out of 101 for me.
However according to this there should be at least twice as many.
@jedisct1 What's going on here? (e.g. BlahDNS explicitly claims to support DNS over HTTP/3 but it doesn't seem to work with DNSCrypt)

[lifenjoiner]

BlahDNS explicitly claims to support DNS over HTTP/3 but it doesn't seem to work with DNSCrypt

BlahDNS does NOT advertise the availability of an equivalent HTTP/3 endpoint via the Alt-Svc HTTP response header field that dnscrypt-proxy adopts.

[Unknown78]

Ok I understand about http3 in the config file. But I don't understand both of your answer on blahdns and cloudflare? How does that relate to my question?

[lifenjoiner]

In other words:
There may be more DoH support http/3. But those servers, like BlahDNS, don't response with alt-svc field in the http header, will not be recognized.

[Unknown78]

Could dnscrypt-proxy just force-check whether the server supports or not instead of being passive?

[lifenjoiner]

But supporting h3 is the few (rare) part. That will lead to much more delay for others.

[ghost]

Why does the protocol matter that much to you?