diff --git a/Cargo.lock b/Cargo.lock
index 3b0e5f7f..0c00818f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -204,6 +204,17 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.87",
+]
+
 [[package]]
 name = "async-task"
 version = "4.7.1"
@@ -260,12 +271,6 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
-[[package]]
-name = "base64"
-version = "0.21.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -945,15 +950,6 @@ dependencies = [
  "pin-project-lite",
 ]
 
-[[package]]
-name = "fastrand"
-version = "1.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
-dependencies = [
- "instant",
-]
-
 [[package]]
 name = "fastrand"
 version = "2.1.1"
@@ -1206,25 +1202,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "h2"
-version = "0.3.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.6"
@@ -1236,7 +1213,7 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.1.0",
+ "http",
  "indexmap",
  "slab",
  "tokio",
@@ -1246,29 +1223,29 @@ dependencies = [
 
 [[package]]
 name = "h3"
-version = "0.0.2"
+version = "0.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6de6ca43eed186fd055214af06967b0a7a68336cefec7e8a4004e96efeaccb9e"
+checksum = "5e7675a0963b47a6d12fe44c279918b4ffb19baee838ac37f48d2722ad5bc6ab"
 dependencies = [
  "bytes",
- "fastrand 1.9.0",
+ "fastrand",
  "futures-util",
- "http 0.2.12",
+ "http",
+ "pin-project-lite",
  "tokio",
- "tracing",
 ]
 
 [[package]]
 name = "h3-quinn"
-version = "0.0.3"
+version = "0.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d4a1a1763e4f3e82ee9f1ecf2cf862b22cc7316ebe14684e42f94532b5ec64d"
+checksum = "17c799f413fceeea505236c4d8132f084ff4b55a652288d91439ee93dc24d855"
 dependencies = [
  "bytes",
  "futures",
  "h3",
- "quinn 0.10.2",
- "quinn-proto 0.10.6",
+ "quinn",
+ "tokio",
  "tokio-util",
 ]
 
@@ -1317,10 +1294,11 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hickory-proto"
-version = "0.24.1"
+version = "0.25.0-alpha.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07698b8420e2f0d6447a436ba999ec85d8fbf2a398bbd737b82cac4a2e96e512"
+checksum = "993f9d675890080b3bab88e475e6a0db4fe96b39b2fbd42a72eb315dc9009798"
 dependencies = [
+ "async-recursion",
  "async-trait",
  "bytes",
  "cfg-if",
@@ -1329,35 +1307,35 @@ dependencies = [
  "futures-channel",
  "futures-io",
  "futures-util",
- "h2 0.3.26",
+ "h2",
  "h3",
  "h3-quinn",
- "http 0.2.12",
- "idna 0.4.0",
+ "http",
+ "idna 0.5.0",
  "ipnet",
  "native-tls",
  "once_cell",
- "quinn 0.10.2",
+ "pin-project-lite",
+ "quinn",
  "rand",
- "rustls 0.21.12",
- "rustls-native-certs 0.6.3",
- "rustls-pemfile 1.0.4",
+ "rustls",
+ "rustls-native-certs 0.7.3",
  "serde",
  "thiserror",
  "tinyvec",
  "tokio",
  "tokio-native-tls",
- "tokio-rustls 0.24.1",
+ "tokio-rustls",
  "tracing",
  "url",
- "webpki-roots 0.25.4",
+ "webpki-roots",
 ]
 
 [[package]]
 name = "hickory-resolver"
-version = "0.24.1"
+version = "0.25.0-alpha.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28757f23aa75c98f254cf0405e6d8c25b831b32921b050a66692427679b1f243"
+checksum = "0eec9ac701a9b34a77c8ccbe39d589db876290f6bdc6e05ac118fd114cb1ad26"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -1366,18 +1344,19 @@ dependencies = [
  "lru-cache",
  "once_cell",
  "parking_lot 0.12.3",
+ "quinn",
  "rand",
  "resolv-conf",
- "rustls 0.21.12",
- "rustls-native-certs 0.6.3",
+ "rustls",
+ "rustls-native-certs 0.7.3",
  "serde",
  "smallvec",
  "thiserror",
  "tokio",
  "tokio-native-tls",
- "tokio-rustls 0.24.1",
+ "tokio-rustls",
  "tracing",
- "webpki-roots 0.25.4",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -1409,17 +1388,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http"
 version = "1.1.0"
@@ -1438,7 +1406,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.1.0",
+ "http",
 ]
 
 [[package]]
@@ -1449,7 +1417,7 @@ checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
 dependencies = [
  "bytes",
  "futures-util",
- "http 1.1.0",
+ "http",
  "http-body",
  "pin-project-lite",
 ]
@@ -1481,8 +1449,8 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "h2 0.4.6",
- "http 1.1.0",
+ "h2",
+ "http",
  "http-body",
  "httparse",
  "httpdate",
@@ -1500,16 +1468,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333"
 dependencies = [
  "futures-util",
- "http 1.1.0",
+ "http",
  "hyper",
  "hyper-util",
- "rustls 0.23.16",
+ "rustls",
  "rustls-native-certs 0.8.0",
  "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.26.0",
+ "tokio-rustls",
  "tower-service",
- "webpki-roots 0.26.6",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -1537,7 +1505,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.1.0",
+ "http",
  "http-body",
  "hyper",
  "pin-project-lite",
@@ -1690,9 +1658,9 @@ dependencies = [
 
 [[package]]
 name = "idna"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+checksum = "634d9b1461af396cad843f47fdba5597a4f9e6ddd4bfb6ff5d85028c25cb12f6"
 dependencies = [
  "unicode-bidi",
  "unicode-normalization",
@@ -1894,7 +1862,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4979f22fdb869068da03c9f7528f8297c6fd2606bc3a4affe42e6a823fdb8da4"
 dependencies = [
  "cfg-if",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -2430,7 +2398,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96c8c490f422ef9a4efd2cb5b42b76c8613d7e7dfc1caf667b8a3350a5acc066"
 dependencies = [
  "atomic-waker",
- "fastrand 2.1.1",
+ "fastrand",
  "futures-io",
 ]
 
@@ -2542,23 +2510,6 @@ version = "1.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
 
-[[package]]
-name = "quinn"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cc2c5017e4b43d5995dcea317bc46c1e09404c0a9664d2908f7f02dfe943d75"
-dependencies = [
- "bytes",
- "pin-project-lite",
- "quinn-proto 0.10.6",
- "quinn-udp 0.4.1",
- "rustc-hash 1.1.0",
- "rustls 0.21.12",
- "thiserror",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "quinn"
 version = "0.11.5"
@@ -2566,34 +2517,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c7c5fdde3cdae7203427dc4f0a68fe0ed09833edc525a03456b153b79828684"
 dependencies = [
  "bytes",
+ "futures-io",
  "pin-project-lite",
- "quinn-proto 0.11.8",
- "quinn-udp 0.5.6",
- "rustc-hash 2.0.0",
- "rustls 0.23.16",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
  "socket2",
  "thiserror",
  "tokio",
  "tracing",
 ]
 
-[[package]]
-name = "quinn-proto"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "141bf7dfde2fbc246bfd3fe12f2455aa24b0fbd9af535d8c86c7bd1381ff2b1a"
-dependencies = [
- "bytes",
- "rand",
- "ring 0.16.20",
- "rustc-hash 1.1.0",
- "rustls 0.21.12",
- "slab",
- "thiserror",
- "tinyvec",
- "tracing",
-]
-
 [[package]]
 name = "quinn-proto"
 version = "0.11.8"
@@ -2602,28 +2537,15 @@ checksum = "fadfaed2cd7f389d0161bb73eeb07b7b78f8691047a6f3e73caaeae55310a4a6"
 dependencies = [
  "bytes",
  "rand",
- "ring 0.17.8",
- "rustc-hash 2.0.0",
- "rustls 0.23.16",
+ "ring",
+ "rustc-hash",
+ "rustls",
  "slab",
  "thiserror",
  "tinyvec",
  "tracing",
 ]
 
-[[package]]
-name = "quinn-udp"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "055b4e778e8feb9f93c4e439f71dc2156ef13360b432b799e179a8c4cdf0b1d7"
-dependencies = [
- "bytes",
- "libc",
- "socket2",
- "tracing",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "quinn-udp"
 version = "0.5.6"
@@ -2768,8 +2690,8 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.6",
- "http 1.1.0",
+ "h2",
+ "http",
  "http-body",
  "http-body-util",
  "hyper",
@@ -2784,10 +2706,10 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "quinn 0.11.5",
- "rustls 0.23.16",
+ "quinn",
+ "rustls",
  "rustls-native-certs 0.8.0",
- "rustls-pemfile 2.2.0",
+ "rustls-pemfile",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -2796,13 +2718,13 @@ dependencies = [
  "system-configuration",
  "tokio",
  "tokio-native-tls",
- "tokio-rustls 0.26.0",
+ "tokio-rustls",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots 0.26.6",
+ "webpki-roots",
  "windows-registry",
 ]
 
@@ -2816,21 +2738,6 @@ dependencies = [
  "quick-error",
 ]
 
-[[package]]
-name = "ring"
-version = "0.16.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
-dependencies = [
- "cc",
- "libc",
- "once_cell",
- "spin 0.5.2",
- "untrusted 0.7.1",
- "web-sys",
- "winapi",
-]
-
 [[package]]
 name = "ring"
 version = "0.17.8"
@@ -2841,8 +2748,8 @@ dependencies = [
  "cfg-if",
  "getrandom",
  "libc",
- "spin 0.9.8",
- "untrusted 0.9.0",
+ "spin",
+ "untrusted",
  "windows-sys 0.52.0",
 ]
 
@@ -2861,7 +2768,7 @@ dependencies = [
  "p384",
  "pkcs8",
  "rand_core",
- "ring 0.17.8",
+ "ring",
  "signature",
 ]
 
@@ -2912,12 +2819,6 @@ version = "0.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc-hash"
 version = "2.0.0"
@@ -2937,18 +2838,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "rustls"
-version = "0.21.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
-dependencies = [
- "log",
- "ring 0.17.8",
- "rustls-webpki 0.101.7",
- "sct",
-]
-
 [[package]]
 name = "rustls"
 version = "0.23.16"
@@ -2957,21 +2846,22 @@ checksum = "eee87ff5d9b36712a58574e12e9f0ea80f915a5b0ac518d322b24a465617925e"
 dependencies = [
  "log",
  "once_cell",
- "ring 0.17.8",
+ "ring",
  "rustls-pki-types",
- "rustls-webpki 0.102.8",
+ "rustls-webpki",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.6.3"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
 dependencies = [
  "openssl-probe",
- "rustls-pemfile 1.0.4",
+ "rustls-pemfile",
+ "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
@@ -2983,21 +2873,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcaf18a4f2be7326cd874a5fa579fae794320a0f388d365dca7e480e55f83f8a"
 dependencies = [
  "openssl-probe",
- "rustls-pemfile 2.2.0",
+ "rustls-pemfile",
  "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
 
-[[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
-dependencies = [
- "base64 0.21.7",
-]
-
 [[package]]
 name = "rustls-pemfile"
 version = "2.2.0"
@@ -3013,25 +2894,15 @@ version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "16f1201b3c9a7ee8039bcadc17b7e605e2945b27eee7631788c1bd2b0643674b"
 
-[[package]]
-name = "rustls-webpki"
-version = "0.101.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
-dependencies = [
- "ring 0.17.8",
- "untrusted 0.9.0",
-]
-
 [[package]]
 name = "rustls-webpki"
 version = "0.102.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
 dependencies = [
- "ring 0.17.8",
+ "ring",
  "rustls-pki-types",
- "untrusted 0.9.0",
+ "untrusted",
 ]
 
 [[package]]
@@ -3064,16 +2935,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring 0.17.8",
- "untrusted 0.9.0",
-]
-
 [[package]]
 name = "sec1"
 version = "0.7.3"
@@ -3249,7 +3110,7 @@ dependencies = [
  "serde_urlencoded",
  "shadowsocks-crypto",
  "socket2",
- "spin 0.9.8",
+ "spin",
  "thiserror",
  "tokio",
  "tokio-tfo",
@@ -3343,7 +3204,7 @@ dependencies = [
  "flate2",
  "futures",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "http-body-util",
  "httparse",
  "hyper",
@@ -3367,13 +3228,13 @@ dependencies = [
  "sled",
  "smoltcp",
  "socket2",
- "spin 0.9.8",
+ "spin",
  "thiserror",
  "tokio",
  "tokio-native-tls",
- "tokio-rustls 0.26.0",
+ "tokio-rustls",
  "tun2",
- "webpki-roots 0.26.6",
+ "webpki-roots",
  "windows-sys 0.59.0",
  "zstd",
 ]
@@ -3500,12 +3361,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "spin"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
-
 [[package]]
 name = "spin"
 version = "0.9.8"
@@ -3640,7 +3495,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f2c9fc62d0beef6951ccffd757e241266a2c833136efbe35af6cd2567dca5b"
 dependencies = [
  "cfg-if",
- "fastrand 2.1.1",
+ "fastrand",
  "once_cell",
  "rustix",
  "windows-sys 0.59.0",
@@ -3793,23 +3648,13 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls 0.21.12",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
 dependencies = [
- "rustls 0.23.16",
+ "rustls",
  "rustls-pki-types",
  "tokio",
 ]
@@ -4007,12 +3852,6 @@ version = "0.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
 
-[[package]]
-name = "untrusted"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
-
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -4179,12 +4018,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.25.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
-
 [[package]]
 name = "webpki-roots"
 version = "0.26.6"
@@ -4222,7 +4055,7 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
diff --git a/crates/shadowsocks-service/Cargo.toml b/crates/shadowsocks-service/Cargo.toml
index 0ae5753d..28075311 100644
--- a/crates/shadowsocks-service/Cargo.toml
+++ b/crates/shadowsocks-service/Cargo.toml
@@ -61,7 +61,6 @@ dns-over-native-tls-vendored = [
 ]
 dns-over-https = [
     "hickory-dns",
-    "hickory-resolver/dns-over-https",
     "hickory-resolver/dns-over-https-rustls",
     "hickory-resolver/webpki-roots",
     "hickory-resolver/native-certs",
@@ -182,8 +181,8 @@ http-body-util = { version = "0.1", optional = true }
 http = { version = "1.1", optional = true }
 httparse = { version = "1.9", optional = true }
 
-hickory-resolver = { version = "0.24", optional = true, features = [
-    "serde-config",
+hickory-resolver = { version = "0.25.0-alpha", optional = true, features = [
+    "serde",
 ] }
 
 idna = "1.0"
diff --git a/crates/shadowsocks-service/src/config.rs b/crates/shadowsocks-service/src/config.rs
index 57a4d1f0..c958371c 100644
--- a/crates/shadowsocks-service/src/config.rs
+++ b/crates/shadowsocks-service/src/config.rs
@@ -59,7 +59,7 @@ use std::{
 
 use cfg_if::cfg_if;
 #[cfg(feature = "hickory-dns")]
-use hickory_resolver::config::{NameServerConfig, Protocol, ResolverConfig};
+use hickory_resolver::config::{NameServerConfig, ResolverConfig};
 #[cfg(feature = "local-tun")]
 use ipnet::IpNet;
 #[cfg(feature = "local-fake-dns")]
@@ -2484,6 +2484,8 @@ impl Config {
 
     #[cfg(any(feature = "hickory-dns", feature = "local-dns"))]
     fn parse_dns_nameservers(&mut self, nameservers: &str) -> Result<DnsConfig, Error> {
+        use hickory_resolver::proto::xfer::Protocol;
+
         #[cfg(all(unix, feature = "local-dns"))]
         if let Some(nameservers) = nameservers.strip_prefix("unix://") {
             // A special DNS server only for shadowsocks-android
diff --git a/crates/shadowsocks-service/src/local/dns/client_cache.rs b/crates/shadowsocks-service/src/local/dns/client_cache.rs
index d4b2694f..7d82fd55 100644
--- a/crates/shadowsocks-service/src/local/dns/client_cache.rs
+++ b/crates/shadowsocks-service/src/local/dns/client_cache.rs
@@ -10,7 +10,7 @@ use std::{
     time::Duration,
 };
 
-use hickory_resolver::proto::{error::ProtoError, op::Message};
+use hickory_resolver::proto::{op::Message, ProtoError};
 use log::{debug, trace};
 use tokio::sync::Mutex;
 
diff --git a/crates/shadowsocks-service/src/local/dns/dns_resolver.rs b/crates/shadowsocks-service/src/local/dns/dns_resolver.rs
index b27b02a0..065c2820 100644
--- a/crates/shadowsocks-service/src/local/dns/dns_resolver.rs
+++ b/crates/shadowsocks-service/src/local/dns/dns_resolver.rs
@@ -175,12 +175,11 @@ fn store_dns(res: Message, port: u16) -> Vec<SocketAddr> {
     let mut vaddr = Vec::new();
     for record in res.answers() {
         match record.data() {
-            Some(RData::A(addr)) => vaddr.push(SocketAddr::new(Ipv4Addr::from(*addr).into(), port)),
-            Some(RData::AAAA(addr)) => vaddr.push(SocketAddr::new(Ipv6Addr::from(*addr).into(), port)),
-            Some(rdata) => {
+            RData::A(addr) => vaddr.push(SocketAddr::new(Ipv4Addr::from(*addr).into(), port)),
+            RData::AAAA(addr) => vaddr.push(SocketAddr::new(Ipv6Addr::from(*addr).into(), port)),
+            rdata => {
                 trace!("skipped rdata {:?}", rdata);
             }
-            None => {}
         }
     }
     vaddr
diff --git a/crates/shadowsocks-service/src/local/dns/server.rs b/crates/shadowsocks-service/src/local/dns/server.rs
index bc578265..a0d47cae 100644
--- a/crates/shadowsocks-service/src/local/dns/server.rs
+++ b/crates/shadowsocks-service/src/local/dns/server.rs
@@ -649,7 +649,7 @@ fn should_forward_by_response(
             }
             macro_rules! examine_record {
                 ($rec:ident, $is_answer:expr) => {
-                    if let Some(RData::CNAME(name)) = $rec.data() {
+                    if let RData::CNAME(name) = $rec.data() {
                         if $is_answer {
                             if let Some(value) = check_name_in_proxy_list(acl, name) {
                                 return value;
@@ -667,13 +667,13 @@ fn should_forward_by_response(
                         return true;
                     }
                     let forward = match $rec.data() {
-                        Some(RData::A(ip)) => acl.check_ip_in_proxy_list(&IpAddr::V4((*ip).into())),
-                        Some(RData::AAAA(ip)) => acl.check_ip_in_proxy_list(&IpAddr::V6((*ip).into())),
+                        RData::A(ip) => acl.check_ip_in_proxy_list(&IpAddr::V4((*ip).into())),
+                        RData::AAAA(ip) => acl.check_ip_in_proxy_list(&IpAddr::V6((*ip).into())),
                         // MX records cause type A additional section processing for the host specified by EXCHANGE.
-                        Some(RData::MX(mx)) => examine_name!(mx.exchange(), $is_answer),
+                        RData::MX(mx) => examine_name!(mx.exchange(), $is_answer),
                         // NS records cause both the usual additional section processing to locate a type A record...
-                        Some(RData::NS(name)) => examine_name!(name, $is_answer),
-                        Some(RData::PTR(_)) => unreachable!(),
+                        RData::NS(name) => examine_name!(name, $is_answer),
+                        RData::PTR(_) => unreachable!(),
                         _ => acl.is_default_in_proxy_list(),
                     };
                     if !forward {
@@ -752,12 +752,12 @@ impl DnsClient {
                 for rec in result.answers() {
                     trace!("dns answer: {:?}", rec);
                     match rec.data() {
-                        Some(RData::A(ip)) => {
+                        RData::A(ip) => {
                             self.context
                                 .add_to_reverse_lookup_cache(Ipv4Addr::from(*ip).into(), forward)
                                 .await
                         }
-                        Some(RData::AAAA(ip)) => {
+                        RData::AAAA(ip) => {
                             self.context
                                 .add_to_reverse_lookup_cache(Ipv6Addr::from(*ip).into(), forward)
                                 .await
diff --git a/crates/shadowsocks-service/src/local/dns/upstream.rs b/crates/shadowsocks-service/src/local/dns/upstream.rs
index 981f22e9..db4237b9 100644
--- a/crates/shadowsocks-service/src/local/dns/upstream.rs
+++ b/crates/shadowsocks-service/src/local/dns/upstream.rs
@@ -12,10 +12,7 @@ use std::{
 
 use byteorder::{BigEndian, ByteOrder};
 use bytes::{BufMut, BytesMut};
-use hickory_resolver::proto::{
-    error::{ProtoError, ProtoErrorKind},
-    op::Message,
-};
+use hickory_resolver::proto::{op::Message, ProtoError, ProtoErrorKind};
 use log::{error, trace};
 use lru_time_cache::{Entry, LruCache};
 use rand::{thread_rng, Rng};
diff --git a/crates/shadowsocks-service/src/local/fake_dns/processor.rs b/crates/shadowsocks-service/src/local/fake_dns/processor.rs
index d6252f5d..5bcde7a9 100644
--- a/crates/shadowsocks-service/src/local/fake_dns/processor.rs
+++ b/crates/shadowsocks-service/src/local/fake_dns/processor.rs
@@ -9,7 +9,7 @@ use hickory_resolver::proto::{
         DNSClass, RData, Record, RecordType,
     },
 };
-use log::{debug, trace};
+use log::{debug, trace, warn};
 
 use super::manager::FakeDnsManager;
 
@@ -26,30 +26,37 @@ pub async fn handle_dns_request(req_message: &Message, manager: &FakeDnsManager)
             rsp_message.add_query(query.clone());
 
             if query.query_class() != DNSClass::IN {
-                let record = Record::<RData>::with(query.name().clone(), query.query_type(), 0);
-                rsp_message.add_answer(record);
+                // let record = Record::<RData>::from_rdata(query.name().clone(), 0, query.query_type());
+                // rsp_message.add_answer(record);
+                warn!(
+                    "Query class: {:?} is not supported. Full {:?}",
+                    query.query_class(),
+                    req_message
+                );
                 continue;
             }
 
             match query.query_type() {
                 RecordType::A => {
                     let (ip_addr, expire_duration) = manager.map_domain_ipv4(query.name()).await?;
-                    let [a, b, c, d] = ip_addr.octets();
 
-                    let mut record =
-                        Record::<RData>::with(query.name().clone(), RecordType::A, expire_duration.as_secs() as u32);
+                    let mut record = Record::<RData>::from_rdata(
+                        query.name().clone(),
+                        expire_duration.as_secs() as u32,
+                        RData::A(A(ip_addr)),
+                    );
                     record.set_dns_class(query.query_class());
-                    record.set_data(Some(RData::A(A::new(a, b, c, d))));
                     rsp_message.add_answer(record);
                 }
                 RecordType::AAAA => {
                     let (ip_addr, expire_duration) = manager.map_domain_ipv6(query.name()).await?;
-                    let [a, b, c, d, e, f, g, h] = ip_addr.segments();
 
-                    let mut record =
-                        Record::<RData>::with(query.name().clone(), RecordType::AAAA, expire_duration.as_secs() as u32);
+                    let mut record = Record::<RData>::from_rdata(
+                        query.name().clone(),
+                        expire_duration.as_secs() as u32,
+                        RData::AAAA(AAAA(ip_addr)),
+                    );
                     record.set_dns_class(query.query_class());
-                    record.set_data(Some(RData::AAAA(AAAA::new(a, b, c, d, e, f, g, h))));
                     rsp_message.add_answer(record);
                 }
                 _ => {
diff --git a/crates/shadowsocks/Cargo.toml b/crates/shadowsocks/Cargo.toml
index 25dc8c71..3eff9683 100644
--- a/crates/shadowsocks/Cargo.toml
+++ b/crates/shadowsocks/Cargo.toml
@@ -85,7 +85,7 @@ tokio = { version = "1.9.0", features = [
     "time",
 ] }
 
-hickory-resolver = { version = "0.24", optional = true }
+hickory-resolver = { version = "0.25.0-alpha", optional = true }
 arc-swap = { version = "1.7", optional = true }
 notify = { version = "7.0", optional = true }
 
diff --git a/crates/shadowsocks/src/dns_resolver/hickory_dns_resolver.rs b/crates/shadowsocks/src/dns_resolver/hickory_dns_resolver.rs
index 9e378bca..76a499da 100644
--- a/crates/shadowsocks/src/dns_resolver/hickory_dns_resolver.rs
+++ b/crates/shadowsocks/src/dns_resolver/hickory_dns_resolver.rs
@@ -7,20 +7,19 @@ use std::{
     ops::Deref,
     pin::Pin,
     task::{Context, Poll},
+    time::Duration,
 };
 
 use cfg_if::cfg_if;
 use futures::ready;
 use hickory_resolver::{
     config::{LookupIpStrategy, ResolverConfig, ResolverOpts},
-    error::ResolveResult,
-    name_server::{GenericConnector, RuntimeProvider},
+    name_server::GenericConnector,
     proto::{
-        iocompat::AsyncIoTokioAsStd,
-        udp::{DnsUdpSocket, QuicLocalAddr},
-        TokioTime,
+        runtime::{iocompat::AsyncIoTokioAsStd, RuntimeProvider, TokioHandle, TokioTime},
+        udp::DnsUdpSocket,
     },
-    AsyncResolver, TokioHandle,
+    ResolveError, Resolver,
 };
 use log::trace;
 use tokio::{io::ReadBuf, net::UdpSocket};
@@ -62,12 +61,6 @@ impl DnsUdpSocket for ShadowUdpSocket {
     }
 }
 
-impl QuicLocalAddr for ShadowUdpSocket {
-    fn local_addr(&self) -> io::Result<SocketAddr> {
-        self.deref().local_addr()
-    }
-}
-
 impl RuntimeProvider for ShadowDnsRuntimeProvider {
     type Handle = TokioHandle;
     type Tcp = AsyncIoTokioAsStd<ShadowTcpStream>;
@@ -78,10 +71,31 @@ impl RuntimeProvider for ShadowDnsRuntimeProvider {
         self.handle.clone()
     }
 
-    fn connect_tcp(&self, server_addr: SocketAddr) -> Pin<Box<dyn Send + Future<Output = io::Result<Self::Tcp>>>> {
-        let connect_opts = self.connect_opts.clone();
+    fn connect_tcp(
+        &self,
+        server_addr: SocketAddr,
+        bind_addr: Option<SocketAddr>,
+        wait_for: Option<Duration>,
+    ) -> Pin<Box<dyn Send + Future<Output = io::Result<Self::Tcp>>>> {
+        let mut connect_opts = self.connect_opts.clone();
+
+        if let Some(bind_addr) = bind_addr {
+            connect_opts.bind_local_addr = Some(bind_addr.ip());
+        }
+
+        let wait_for = wait_for.unwrap_or_else(|| Duration::from_secs(5));
+
         Box::pin(async move {
-            let tcp = ShadowTcpStream::connect_with_opts(&server_addr, &connect_opts).await?;
+            let tcp = match tokio::time::timeout(
+                wait_for,
+                ShadowTcpStream::connect_with_opts(&server_addr, &connect_opts),
+            )
+            .await
+            {
+                Ok(Ok(s)) => s,
+                Ok(Err(err)) => return Err(err),
+                Err(_) => return Err(io::ErrorKind::TimedOut.into()),
+            };
             Ok(AsyncIoTokioAsStd(tcp))
         })
     }
@@ -105,14 +119,14 @@ pub type ShadowDnsConnectionProvider = GenericConnector<ShadowDnsRuntimeProvider
 /// Shadowsocks DNS resolver
 ///
 /// A customized hickory-dns-resolver
-pub type DnsResolver = AsyncResolver<ShadowDnsConnectionProvider>;
+pub type DnsResolver = Resolver<ShadowDnsConnectionProvider>;
 
 /// Create a `hickory-dns` asynchronous DNS resolver
 pub async fn create_resolver(
     dns: Option<ResolverConfig>,
     opts: Option<ResolverOpts>,
     connect_opts: ConnectOpts,
-) -> ResolveResult<DnsResolver> {
+) -> Result<DnsResolver, ResolveError> {
     // Customized dns resolution
     match dns {
         Some(conf) => {
@@ -173,8 +187,6 @@ pub async fn create_resolver(
 
                     Ok(DnsResolver::new(config, opts, ShadowDnsConnectionProvider::new(ShadowDnsRuntimeProvider::new(connect_opts))))
                 } else {
-                    use hickory_resolver::error::ResolveError;
-
                     Err(ResolveError::from("current platform doesn't support hickory-dns resolver with system configured".to_owned()))
                 }
             }