[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHX-Y8xdo0vDgwoWhDywvA61HuUeqcZwi_2edWaMKT4M":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"a3cf35c1-75f4-4276-b5d6-d27d63017fc6","article","DNS over QUIC：DNS 查询换成 QUIC 传输，会改变什么？","dns-over-quic-doq-privacy","DNS over QUIC 把 DNS 查询封装在加密 QUIC 连接中，保护客户端到解析器这段链路。本文比较 DoQ 与 DoT 的传输方式，并澄清加密解析器通信不等于匿名，也不保证更快。","打开网页时，浏览器通常先向 DNS 解析器询问“这个域名对应哪个 IP 地址”。传统 DNS 查询可能以明文传输，网络路径上的观察者有机会看到你查询的域名。加密 DNS 的目标是保护客户端到解析器之间的查询内容；DNS over QUIC（DoQ）则选择 QUIC 作为承载协议。\n\nQUIC 建立在 UDP 之上，集成了加密与传输层功能。DoQ 把 DNS 查询和响应封装在 QUIC 流中，让客户端与解析器之间的这段通信受到加密保护。它和 DNS over TLS（DoT）有相似的隐私目标，但传输机制不同：DoT 使用 TLS 连接，而 DoQ 使用 QUIC。两者都不能让解析器本身看不见查询，因为解析器必须知道请求内容才能返回答案。\n\n采用 QUIC 有一些工程层面的特点。例如，QUIC 的连接管理和多路复用方式可能有助于减少某些连接阻塞问题，并能配合现代网络协议栈。它也带来新的部署与排障考量：网络必须允许相应 UDP 流量，客户端与解析器都要支持 DoQ，中间设备的策略也可能影响连接。不能只因为“QUIC 更新”，就推断所有场景下 DNS 一定更快。\n\nDoQ 解决的是特定链路上的隐私问题：客户端到所选解析器的 DNS 消息不再以明文暴露给旁路观察者。它并不隐藏设备的 IP 地址，也不自动加密后续访问网站的全部流量。解析器仍然能记录查询；网站服务器会看到访问请求；若设备使用的解析器本身不可信，改用加密传输并不能消除对解析器的信任。\n\n可以把它想成把写有“我要找哪家店”的纸条放进上锁信封，再通过快递送到邮局式的解析器。路过的人较难看清信封里的字，但收件人必须拆开它才能帮你查地址；快递路线和最终访问行为仍可能留下其他线索。加密保护有明确的边界，理解边界比把它称作“匿名 DNS”更准确。\n\n日常使用中，DoQ 的价值在于减少本地网络、公共 Wi-Fi 或接入链路上对 DNS 查询的被动窥探。要获得实际保护，应确认客户端确实启用了加密解析，并选择可信服务；同时记得它与 VPN、HTTPS 及网站本身的隐私政策解决的是不同问题。\n\n来源：[IETF RFC 9250：DNS over Dedicated QUIC Connections](https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9250.html)","\u002Fuploads\u002F2026-10-13\u002F4efc0042-84a4-4354-9616-30633cf9b9c4.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",null,"Internet Engineering Task Force","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc9250.html","published",false,48,0,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:51.461Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":42,"createdAt":70},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T02:13:55.563Z"]