Testing HTTP/3

[IngmarStein]

I'm using the latest Docker image to run DnsServer and have enabled DNS-over-HTTP/3 on the standard port 443. A TLS certificate is configured and HTTP/2 works just fine.

Testing on the local network without a firewall in between the client the DNS server, however fails:

❯ curl --http3-only -v https://doh.example.com
* Host doh.example.com:443 was resolved.
* IPv6: (none)
* IPv4: 192.168.1.8
*   Trying 192.168.1.8:443...
* connect to 192.168.1.8 port 443 failed: Weird server reply
*   Trying 192.168.1.8:443...
* connect to 192.168.1.8 port 443 failed: Weird server reply
* Failed to connect to doh.example.com port 443 after 153 ms: Weird server reply
* closing connection #0
curl: (8) Failed to connect to doh.example.com port 443 after 153 ms: Weird server reply

Using Wireshark, I see that the client receives a response: CONNECTION_CLOSE (Transport) Error code: CRYPTO_ERROR (No application Protocol).

The client, however, included "h3" in alpn:

Am I missing something?

[ShreyasZare]

Thanks for the post. The DNS-over-QUIC protocol expects ALPN to be doq which is why it seems to not work with your tests. I would suggest that you test with the DNS Client tool on the admin panel which should work as expected.

[IngmarStein]

I see. But I'm trying DNS-over-HTTP/3, not DNS-over-QUIC. The DNS Client tool only offers "DNS-over-HTTPS" and I can't tell whether that uses HTTP/1, /2, or /3.
Should the ALPN also be doq for DNS-over-HTTP/3?

[ShreyasZare]

Ohh I guess I misread the post. For HTTP/3 it should work with h3 ALPN. Does it work when you try to visit using a web browser? I have not tried to test with curl but it does work with web browser which returns the DoH help page.

Also, on what platform/OS is the DNS server running?

[IngmarStein]

I'm running the DNS Server as a Docker container in a macvlan network on a Synology NAS.
I'll test the DoH help page when I'm back in the local network, but HTTP/2 is working fine over a public network.

[IngmarStein]

Chrome with QUIC enabled uses h2 to load the help page (I checked on google.com that h3 support works).
The DNS Server's response headers contain alt-svc: h3=":443"; ma=86400 and the domain's HTTPS record is HTTPS 1 . alpn="h3,h2" ipv4hint=192.168.1.8

[ShreyasZare]

Thanks for the details and feedback. I checked with my setup and it too was not working over http/3 anymore and was giving the same error response that you saw in Wireshark.

Did some tests and looks like the Kestrel web server has had some subtle changes which is causing http/3 to break. To fix this it now needs to explicitly provide the Application Protocol in code.

Will get this code updated and let you know when the update is available.

[IngmarStein]

Thanks!

[ShreyasZare]

Technitium DNS Server v13.1.1 is now available which fixes this issue with HTTP/3 support. Do update and let me know your feedback.

[IngmarStein]

Works like a charm again. Thanks for the fix!

[ShreyasZare]

Thanks for the feedback!