Put one transaction on one stream
02A client-initiated bidirectional stream carries one DNS query and its response or responses. Bidirectional means both endpoints can send bytes on that same stream.
After its last response the server indicates FIN. This transaction is complete; another query uses another client-initiated bidirectional stream.
Source for this drawing: RFC 9250 · Read RFC section 4.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
A length prefix frames each message; FIN ends each sending direction.
- Each message MUST have a two-octet length prefix followed by DNS message bytes. The length excludes its own prefix. DoQ messages are limited to65535 bytes; the EDNS UDP size is ignored for this transport.
- The client MUST choose the next available client-initiated bidirectional stream, send one query, and indicate STREAM FIN. The first such stream is 0, then4, then8.
- The server MUST send the response(s) on the same stream and indicate FIN after the last response. A server MAY wait for the client FIN before processing.
- The DNS Message ID MUST be0 on DoQ; correlation uses the stream. A proxy forwarding to another transport MUST generate an ID according to that transport, and MUST set it to0 when forwarding back over DoQ.
The literal example is a 32-byte query for picnic.example and a 48-byte answer with a fictional192.0.2.7 address. Lengths are computed from the bytes; field boxes are schematic. This framing example assumes required padding is applied at the QUIC packet level, outside the DNS message; chapter5 shows EDNS padding instead. FIN is a QUIC stream indication, not a byte appended to the DNS message.
Read the RFC section ↗