Introducing MASQUE: A Faster Path to Modern Sites

Websites and browsers talk to each other using a set of shared rules. Those rules have been updated over the years, and the newest version is called HTTP/3. Most of the sites you visit every day already work with it – Chrome, Safari, Firefox, and Edge all use it.

Most proxies don't. They were built for the older rules, so when your request passes through them, it gets switched back to the older version before it reaches the website. Nothing breaks. You get no error and no warning. But your request now looks a little different from a real browser's request, and it moves a little slower. If you've been having access issues you can't explain on big, modern websites, this is one place worth checking.

Oxylabs' Residential Proxies now support MASQUE, a newer standard for carrying proxy traffic. Your requests keep the modern rules all the way to the website, instead of being switched back on the way through.

What is MASQUE?

A proxy's job is to pass your request along to a website on your behalf. To do that, it needs a way to carry your traffic. MASQUE is a set of IETF standards (an IETF Working Group and its RFCs) for carrying proxied traffic over QUIC/HTTP. It isn't one single specification but a family of them; the piece we've built into Residential Proxies is the one that carries UDP traffic, known as CONNECT-UDP.

With a traditional TCP tunnel, HTTP/3 can't pass through, so your request falls back to the older HTTP/2-over-TCP style before reaching the site. MASQUE opens a UDP path instead, so your real QUIC/HTTP-3 connection runs all the way to the target – and because it uses QUIC's unreliable datagrams rather than a reliable tunnel, it avoids the double congestion-control and performance-limiting delays you'd get from forcing QUIC through TCP. It's the same approach already running behind the scenes in Chrome's own IP Protection feature, at a very large scale.

Why does this matter?

Two reasons. The second one is the one that affects your results.

The first is reach. A large share of the web now supports HTTP/3, and that includes every site sitting behind Cloudflare. In other words, a large part of what people actually collect data from. A proxy that can't handle modern traffic is only fully at home on part of the web.

The second is consistency. Websites are getting better at telling whether a request really came from the browser it claims to be. For years, they mostly checked the details of how a visitor's connection was set up. Now some of them also check how the connection actually behaves.

That creates a problem that's hard to hide. If your request says "I'm Chrome" but then can't use the newer rules that every real Chrome browser uses, it doesn't add up. The rest of your setup can be perfect and it won't help, because the connection itself is saying something different from the request.

Going through MASQUE removes that mismatch. Here's what you get:

• Higher success rates. Your request isn't switched to the older rules along the way, so what it claims to be and how it actually behaves match. There's less for a website to find odd.

• More native connection experience. Sessions run as ordinary secure connections, the same as regular modern web traffic, instead of using an older tunnel style that's easier to recognize.

• No hold-ups along the way. Traditional TCP-based proxy tunnels can reintroduce delays, where data packet loss holds up other data in transit. MASQUE carries UDP-based traffic over HTTP/3, helping preserve QUIC’s ability to handle packet loss efficiently. This can support a more reliable connection on residential and mobile networks, where occasional packet loss is common.

• Sessions survive network changes. If the connection on the other end switches networks or changes its IP partway through, your session can keep going instead of dropping.

• Faster start. Setting up a connection used to take several back-and-forth steps. Now it takes fewer, so your data starts moving sooner.

There's also a timing point worth saying out loud. Support for HTTP/3 keeps growing. Once it passes half the web, handling it properly stops being something a provider can advertise and becomes something customers simply expect. We'd rather have it ready early.

How to get started

MASQUE is available on Residential Proxies now. If you're already a customer, you don't need new credentials or a different endpoint. Head over to MASQUE documentation for the setup details.

Not using Residential Proxies yet? Talk to our team or start a trial, and try it on a modern website that's been giving you trouble. That comparison will tell you more than any explanation we can write.