RFC 9000 Lands: QUIC Version 1 Is Now Generally Available

On May 27, 2021, the IETF published RFC 9000, finalizing the QUIC transport protocol after the QUIC Working Group issued its Last Call seven months prior. The suite of documents—RFC 8999 through RFC 9002—represents years of design work and real-world testing. The very next day, Cloudflare made the standardized version of QUIC available to all of its customers.

Transport protocols have historically struggled to gain traction on the Internet. QUIC sidesteps that problem by running over UDP. Compared to TCP, QUIC provides security by default, shielding nearly every byte from inspection or interference by middleboxes. It also includes built-in mechanisms for faster connection establishment and for mitigating performance degradation under packet loss or high latency. Its pluggable extension points are designed to support iterative feature development and performance improvements without requiring protocol-wide revisions.

What makes QUIC genuinely distinctive, though, is that it is actually deployable. Cloudflare began with a limited beta in 2018, moved to general availability in 2019, and has tracked every document revision since. Browsers and other user agents have adopted QUIC along the way, proving that it works at Internet scale. According to Cloudflare Radar, roughly 12% of Internet traffic already uses QUIC with HTTP/3, a figure expected to climb now that RFC 9000 is out.

HTTP/3 and the QUIC Handshake

QUIC alone is just a transport protocol; it needs an application protocol mapping to be useful. The QUIC Working Group has defined that mapping as HTTP/3. The specification is complete but not yet published as an RFC. Despite that, Cloudflare has supported HTTP over QUIC for over three years.

From a customer perspective, enabling QUIC and HTTP/3 is a matter of flipping a switch in the Network tab of the Cloudflare dashboard. Behind the scenes, Cloudflare servers listen for QUIC traffic on UDP port 443. Clients initiate the handshake by sending an Initial QUIC packet within a UDP datagram. That packet includes a version identifier, which the server checks and selects from, plus a list of application protocols via the TLS Application Layer Negotiation Protocol (ALPN) extension. Cloudflare currently supports clients that connect directly and speak QUIC version 1 with the ALPN identifier "h3".

Draft versions of the wire format each had their own version and ALPN identifiers to keep implementations from miscommunicating. RFC 9000 assigns version 0x00000001. Earlier drafts appear as 0xff00001d, 0xff00001c, and 0xff00001b, corresponding to drafts 29, 28, and 27 respectively. Notably, version identifiers are 32-bit, unlike many other QUIC fields that use the protocol's variable-length integer encoding.

Before a client can send that Initial packet, it must know the server is listening. HTTP historically resolved this through URLs: port 80 for http, port 443 for https, or an explicit authority component. Changing URL schemes was never an option, so during development the Working Group relied on out-of-band knowledge or direct communication between implementers—a model that obviously doesn't scale.

For real-world deployment, QUIC relies on HTTP Alternative Services (RFC 7838). Cloudflare returns an Alt-Svc header to TCP-based clients, advertising supported QUIC versions. For example:

$ curl -sI https://www.cloudflare.com/ | grep alt-svc
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

The entry "h3-29" signals support for HTTP/3 over QUIC draft 29 on UDP port 443. Clients may respond with an Initial containing that single version, or hedge by including all versions they support. Cloudflare then picks the highest mutually supported version. Clients that prefer TCP can simply ignore the advertisement and continue as usual.

Browsers previously required experimental flags to test QUIC. Now many have it enabled by default, and Cloudflare expects them to add QUIC v1 support soon. The company has started updating its Alt-Svc advertisements to include the "h3" identifier, with worldwide rollout expected by early next week. These upgrades happen transparently; users may just notice faster connections. Developers can confirm what's running by enabling the Protocol column in their browser's network tools:

BLOG-528 Embedded Image - NMm6rl

Under the Hood: Quiche

Cloudflare's QUIC and HTTP/3 implementation is quiche, an open-source Rust library that exposes a C API. It was designed from the start for easy integration into varied projects. Cloudflare's edge servers use it, as do curl and netty. Mozilla's neqo—the QUIC implementation powering Firefox—uses Cloudflare's qlog sub-crate.

For development and debugging, Cloudflare built quiche-client, a tool that exposes detailed connection information and feeds into the interoperability testing matrix for ongoing cross-implementation validation. It lives in the /tools folder of the quiche repository:

RUST_LOG=trace QLOG_DIR=$PWD cargo run --manifest-path tools/apps/Cargo.toml --bin quiche-client -- --wire-version 00000001  https://www.cloudflare.com

[2021-05-28T18:59:30.506616991Z INFO  quiche_apps::client] connecting to 104.16.123.96:443 from 192.168.0.50:41238 with scid 5875ecd13154429e5c618eee35b6bbd9ecfe8c6b
[2021-05-28T18:59:30.506842369Z TRACE quiche::tls] 5875ecd13154429e5c618eee35b6bbd9ecfe8c6b write message lvl=Initial len=310
[2021-05-28T18:59:30.506891348Z TRACE quiche] 5875ecd13154429e5c618eee35b6bbd9ecfe8c6b tx pkt Initial version=1 dcid=ed8de2d33a2e830279dfeaae8a7ad674 scid=5875ecd13154429e5c618eee35b6bbd9ecfe8c6b len=330 pn=0
[2021-05-28T18:59:30.506982912Z TRACE quiche] 5875ecd13154429e5c618eee35b6bbd9ecfe8c6b tx frm CRYPTO off=0 len=310
[2021-05-28T18:59:30.507044916Z TRACE quiche::recovery] 5875ecd13154429e5c618eee35b6bbd9ecfe8c6b timer=998.815785ms latest_rtt=0ns srtt=None min_rtt=0ns rttvar=166.5ms loss_time=[None, None, None] loss_probes=[0, 0, 0] cwnd=13500 ssthresh=18446744073709551615 bytes_in_flight=377 app_limited=true congestion_recovery_start_time=None delivered=0 delivered_time=204.765µs recent_delivered_packet_sent_time=206.283µs app_limited_at_pkt=0  pacing_rate=0 last_packet_scheduled_time=Some(Instant { tv_sec: 620877, tv_nsec: 428024928 }) hystart=window_end=None last_round_min_rtt=None current_round_min_rtt=None rtt_sample_count=0 lss_start_time=None  
[2021-05-28T18:59:30.507160963Z TRACE quiche_apps::client] written 1200
[2021-05-28T18:59:30.537123997Z TRACE quiche_apps::client] got 1200 bytes
[2021-05-28T18:59:30.537194566Z TRACE quiche] 5875ecd13154429e5c618eee35b6bbd9ecfe8c6b rx pkt Initial version=1 dcid=5875ecd13154429e5c618eee35b6bbd9ecfe8c6b scid=017022e8618952fd8c7177e863894eb0447b85f4 token= len=117 pn=0
<snip>
[2021-05-28T18:59:30.542581460Z TRACE quiche] 5875ecd13154429e5c618eee35b6bbd9ecfe8c6b connection established: proto=Ok("h3") cipher=Some(AES128_GCM) curve=Some("X25519") sigalg=Some("ecdsa_secp256r1_sha256") resumed=false TransportParams { original_destination_connection_id: Some(ed8de2d33a2e830279dfeaae8a7ad674), max_idle_timeout: 180000, stateless_reset_token: None, max_udp_payload_size: 65527, initial_max_data: 10485760, initial_max_stream_data_bidi_local: 0, initial_max_stream_data_bidi_remote: 1048576, initial_max_stream_data_uni: 1048576, initial_max_streams_bidi: 256, initial_max_streams_uni: 3, ack_delay_exponent: 3, max_ack_delay: 25, disable_active_migration: false, active_conn_id_limit: 2, initial_source_connection_id: Some(017022e8618952fd8c7177e863894eb0447b85f4), retry_source_connection_id: None, max_datagram_frame_size: None }

What Comes After QUIC v1

RFC 9000 marks a major milestone, but work continues. Cloudflare's protocols team remains active in the IETF. QUIC Working Group co-chair Lucas Pardue will focus on maintenance, operations, extensibility, and QUIC version 2. Other efforts include Prioritization in the HTTP Working Group and defining how unreliable DATAGRAMs can tunnel varied traffic over QUIC and HTTP/3 in the MASQUE Working Group.

For those who want a puzzle: colleague Chris Wood, excited about the RFCs being published, passed along this cryptic note—"QUIC is finally here -- RFC 8999, 9000, 9001, and 9002. Are we and the rest of the Internet ready to turn it on? 0404d3f63f040214574904010a5735!"