Clash DNS-over-HTTP/3 Setup Guide: Configuring DoH3 in Clash Meta
Why DNS-over-HTTP/3
Traditional DNS queries are sent in plaintext, making them vulnerable to eavesdropping and manipulation. DNS-over-HTTPS (DoH) solved the privacy problem by encrypting DNS within HTTPS connections. However, DoH still relies on TCP and TLS handshake overhead, which adds latency.
DoH3 uses QUIC (UDP-based transport) as its foundation, eliminating TCP handshake latency. In benchmarks, DoH3 resolves domains 20-40% faster than DoH, with the improvement being more pronounced on high-latency connections. Additionally, QUIC built-in multiplexing means DNS queries do not block each other.
Prerequisites
Before configuring DoH3 in Clash Meta, ensure the following requirements are met. First, you need Clash Meta core version 1.15.0 or later, as earlier versions do not support the DoH3 protocol. Second, your DNS upstream server must support HTTP/3. Popular options include Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9), all of which support HTTP/3.
Basic DoH3 Configuration
The DoH3 configuration goes in the dns section of your Clash Meta config file. The key configuration parameters include the resolver address with h3 prefix, the port (default 443 for QUIC), and the SNI (Server Name Indication) for TLS verification.
Combining DoH3 with Fallback DNS
For optimal performance, configure DoH3 as the primary resolver and use DoH (HTTP/2) as the fallback. This way, if the QUIC connection fails (some networks block UDP port 443), the system automatically falls back to the more compatible DoH protocol.
Performance Comparison
| Protocol | Avg Resolution Time | Connection Setup | Privacy Level |
|---|---|---|---|
| Plain DNS | 45ms | None | None |
| DoT (TLS) | 85ms | TLS handshake | Full encryption |
| DoH (HTTP/2) | 95ms | TCP+TLS handshake | Full encryption |
| DoH3 (QUIC) | 62ms | QUIC 0-RTT | Full encryption |
Troubleshooting Common Issues
QUIC Blocked by Network
Some networks block UDP port 443 which QUIC requires. If DoH3 resolution fails, check whether UDP 443 is accessible. If blocked, fall back to DoH configuration.
Certificate Verification Failures
If you see certificate errors in Clash Meta logs, ensure the SNI value matches the DNS provider hostname exactly. Some misconfigurations use IP addresses instead of hostnames in the SNI field, which causes verification to fail.
Compatibility with fake-ip Mode
DoH3 works seamlessly with Clash Meta fake-ip mode. There are no known compatibility issues. The DNS resolution process remains the same from the perspective of Clash Meta, only the transport protocol changes.