curl 8.22 Adds a 25 ms Happy Eyeballs v3 Resolution Delay: What Proxy Teams Should Test

curl 8.22.0, released on 2 September 2026, lists a networking change described as “Happy Eyeballing v3: resolution delay of 25ms.” This is relevant to proxy-backed data collection, ad verification and market research because dual-stack connection setup can affect which address family reaches a proxy gateway, how quickly a fallback begins and what operators classify as proxy latency.

The release note is concise. It does not promise that every request becomes 25 milliseconds faster, nor does it replace the existing connection-attempt pacing controls. A resolution delay concerns how the client coordinates asynchronous address-family results; it is not the same as a connection timeout, a retry delay or the full request duration. Teams should treat the upgrade as a change to connection scheduling and validate it with their actual resolver and proxy topology.

Why a resolution delay exists

A dual-stack hostname can return IPv6 and IPv4 addresses. Those answers may not arrive together, especially when a local resolver, VPN, enterprise DNS path or mobile network handles A and AAAA queries differently. Starting immediately with the first partial answer may produce a quick connection, but it can also prevent a preferred address family from joining the race.

A short resolution delay gives the other answer family a bounded opportunity to arrive before connection attempts are scheduled. The goal is to reduce avoidable stalls while preserving fast startup. The 25 ms value in curl 8.22 belongs to that resolution phase. It should not be confused with CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS, which controls pacing between connection attempts after addresses are available.

Why proxy routes need a separate test

In a proxy request, the first network connection often goes to the proxy gateway rather than the final destination. With a traditional HTTP proxy or a CONNECT tunnel, the gateway hostname may be dual stack while destination DNS is performed either by the client or by the proxy, depending on protocol and configuration. SOCKS variants can also differ in who resolves the destination.

That creates several independent questions:

• Does the client resolve the proxy gateway over both address families?
• Which gateway address wins, and is it the same before and after the upgrade?
• Does the proxy resolve the destination, or does the client send an address?
• Does connection reuse hide the new scheduling behavior after the first request?
• Does an IPv6 gateway path map to a different region, exit pool or policy than IPv4?

A successful page response answers none of those questions by itself.

Build an authorized regression matrix

Use a proxy account and destinations you are authorized to test. Create controlled gateway fixtures or approved endpoints that expose IPv4-only, IPv6-only and dual-stack names. Include a dual-stack name where one answer family is deliberately delayed inside your own DNS test environment.

Run at least these cases:

1. direct dual-stack destination with no proxy, as a control;
2. dual-stack proxy gateway with a destination resolved by the proxy;
3. dual-stack proxy gateway with client-side destination resolution;
4. IPv4-only and IPv6-only proxy gateway controls;
5. a cold connection and a reused connection for every route;
6. normal DNS timing, delayed A response and delayed AAAA response.

Keep application build, resolver configuration, gateway region, authentication, request payload and timeout budget fixed. Compare the currently approved curl build with 8.22.0 in the same environment.

Record the right measurements

Capture timestamps for the start and completion of A and AAAA resolution when your resolver tooling permits it. Also record the first connection attempt, each subsequent address-family attempt, the winning gateway address, connect completion, proxy authentication, CONNECT completion where applicable, destination TLS, first byte and total duration.

For every sample, retain:

• curl and libcurl runtime versions;
• proxy protocol and DNS ownership;
• gateway hostname, region and winning address family;
• cold or reused connection state;
• DNS answer order and measured arrival gap;
• connection result and curl error code;
• response validation result, retry count and bytes;
• p50, p90 and p95 latency by route class.

Do not store proxy passwords, cookies, tokens or complete personal-data payloads in traces. Use synthetic identifiers and redact diagnostic files before sharing them.

Interpret changes without guessing

If 8.22 starts connections sooner when one DNS answer is late, verify that the response still uses the intended gateway region and policy. A faster median is not useful if tail failures, route drift or retry amplification increase.

If IPv4 and IPv6 winner ratios change, compare loss, handshake time and validation success for each family. Do not disable IPv6 solely because IPv4 wins more often in one office or cloud region. The issue may be a resolver, route advertisement, firewall or gateway deployment difference.

If warm requests show no difference, that may be normal connection reuse. Force new connections in a controlled cohort before concluding the release has no effect. Conversely, do not force production requests to reconnect merely to expose a benchmark change.

Use the proxy latency attribution test to separate DNS and gateway connection changes from destination processing. For broader dual-stack diagnosis, follow the IPv6 proxy connectivity guide.

Define rollout gates

Set thresholds before testing. A practical canary can require:

• no increase in validated-request failure rate;
• no unexpected direct connections when the proxy is required;
• stable gateway region and exit-policy selection;
• bounded changes in IPv4/IPv6 winner share;
• improved or neutral p95 connection setup time;
• no increase in retries per validated result;
• no material increase in cost per successful business action.

Roll back if the client bypasses the proxy, selects an unauthorized route, creates a persistent tail-latency regression or produces unexplained address-family failures. Preserve the old build until the canary covers every production network class.

Upgrade checklist

• [ ] curl 8.22.0 and the loaded libcurl version are confirmed.
• [ ] Proxy gateway and destination DNS ownership are documented.
• [ ] IPv4-only, IPv6-only and dual-stack controls are available.
• [ ] A and AAAA answer timing is measurable in a controlled fixture.
• [ ] Cold and reused connections are reported separately.
• [ ] Gateway address family, region and exit policy are verified.
• [ ] Proxy authentication and CONNECT timings are separated.
• [ ] p50, p90 and p95 are calculated from validated responses only.
• [ ] Retry amplification and cost per valid result remain within budget.
• [ ] Canary rollback criteria are approved before rollout.

FAQ

Is the new 25 ms value the IPv4 fallback timeout?

No. The release note describes a resolution delay in Happy Eyeballs v3 work. Connection-attempt pacing is a separate control. Measure DNS result timing and socket-attempt timing independently.

Does this change affect every proxy request?

Not necessarily. It matters most when the hostname being connected to is dual stack and address-family answers arrive asynchronously. Reused proxy connections may avoid fresh resolution and connection setup.

Should we force IPv4 for consistency?

Only if an approved network requirement demands it. First identify whether failures belong to DNS, routing, firewall policy, gateway deployment or the client. Forcing one family can hide an IPv6 defect and reduce resilience.

Can a faster connection choose a different proxy exit?

The address-family winner may reach different gateway infrastructure in some deployments. That is why region, gateway address and observed exit policy belong in the validation record.

Source note: curl project, “Changes in 8.22.0,” released 2 September 2026; entry “Happy Eyeballing v3: resolution delay of 25ms.” External source locations are retained only in the internal operations record.

Use proxy infrastructure only for lawful, authorized purposes. Respect destination terms, rate limits, privacy duties and data-retention requirements. Never use connection tuning to evade access controls or conceal prohibited activity.