From 5235b4c83fa88790b69ea5b3784af6e21d0f22db Mon Sep 17 00:00:00 2001 From: Maksim Kazantsev Date: Thu, 9 Jul 2026 13:10:50 +0300 Subject: [PATCH] AGDNS-4210 set alpn set dot (PR9) --- upstream/dot.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/upstream/dot.go b/upstream/dot.go index 0d7c3abb..a4d7c29e 100644 --- a/upstream/dot.go +++ b/upstream/dot.go @@ -72,6 +72,12 @@ func newDoT(addr *url.URL, opts *Options) (ups Upstream, err error) { InsecureSkipVerify: opts.InsecureSkipVerify, VerifyPeerCertificate: opts.VerifyServerCertificate, VerifyConnection: opts.VerifyConnection, + // Despite it is not strictly required by both RFC 8932 and + // RFC 9461, some DoT providers (e.g., NextDNS on non-standard port + // 443) rely on ALPN to differentiate DoT from DoH traffic. This + // was figured out in this issue: + // https://github.com/AdguardTeam/dnsproxy/issues/510 + NextProtos: []string{"dot"}, }, connsMu: &sync.Mutex{}, logger: opts.Logger,