diff --git a/quic/transport_http3.go b/quic/transport_http3.go
index b00f0c1..1651645 100644
--- a/quic/transport_http3.go
+++ b/quic/transport_http3.go
@@ -33,6 +33,7 @@ func init() {
 type HTTP3Transport struct {
 	name        string
 	destination string
+	serverURL   *url.URL
 	transport   *http3.RoundTripper
 }
 
@@ -45,6 +46,7 @@ func NewHTTP3Transport(options dns.TransportOptions) (*HTTP3Transport, error) {
 	return &HTTP3Transport{
 		name:        options.Name,
 		destination: serverURL.String(),
+		serverURL:   options.ServerURL,
 		transport: &http3.RoundTripper{
 			Dial: func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlyConnection, error) {
 				destinationAddr := M.ParseSocksaddr(addr)
@@ -98,6 +100,10 @@ func (t *HTTP3Transport) Exchange(ctx context.Context, message *mDNS.Msg) (*mDNS
 	}
 	request.Header.Set("Content-Type", dns.MimeType)
 	request.Header.Set("Accept", dns.MimeType)
+	if t.serverURL.User != nil {
+		password, _ := t.serverURL.User.Password()
+		request.SetBasicAuth(t.serverURL.User.Username(), password)
+	}
 	response, err := t.transport.RoundTrip(request)
 	requestBuffer.Release()
 	if err != nil {
diff --git a/quic/transport_quic.go b/quic/transport_quic.go
index b5b765f..8d86afb 100644
--- a/quic/transport_quic.go
+++ b/quic/transport_quic.go
@@ -159,6 +159,7 @@ func (t *Transport) exchange(ctx context.Context, message *mDNS.Msg, conn quic.C
 	if err != nil {
 		return nil, err
 	}
+	_ = stream.Close()
 	buffer.Reset()
 	_, err = buffer.ReadFullFrom(stream, 2)
 	if err != nil {
diff --git a/transport.go b/transport.go
index b3edd0b..0c71ed2 100644
--- a/transport.go
+++ b/transport.go
@@ -30,6 +30,7 @@ type TransportOptions struct {
 	Name         string
 	Dialer       N.Dialer
 	Address      string
+	ServerURL    *url.URL
 	ClientSubnet netip.Prefix
 }
 
@@ -52,6 +53,7 @@ func CreateTransport(options TransportOptions) (Transport, error) {
 		if serverURL != nil {
 			scheme = serverURL.Scheme
 		}
+		options.ServerURL = serverURL
 		constructor = transports[scheme]
 	}
 	if constructor == nil {
diff --git a/transport_https.go b/transport_https.go
index eb680ab..d6e58ef 100644
--- a/transport_https.go
+++ b/transport_https.go
@@ -8,6 +8,7 @@ import (
 	"net"
 	"net/http"
 	"net/netip"
+	"net/url"
 	"os"
 
 	"github.com/sagernet/sing/common/buf"
@@ -24,6 +25,7 @@ var _ Transport = (*HTTPSTransport)(nil)
 type HTTPSTransport struct {
 	name        string
 	destination string
+	serverURL   *url.URL
 	transport   *http.Transport
 }
 
@@ -37,6 +39,7 @@ func NewHTTPSTransport(options TransportOptions) *HTTPSTransport {
 	return &HTTPSTransport{
 		name:        options.Name,
 		destination: options.Address,
+		serverURL:   options.ServerURL,
 		transport: &http.Transport{
 			ForceAttemptHTTP2: true,
 			DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
@@ -88,6 +91,10 @@ func (t *HTTPSTransport) Exchange(ctx context.Context, message *dns.Msg) (*dns.M
 	}
 	request.Header.Set("Content-Type", MimeType)
 	request.Header.Set("Accept", MimeType)
+	if t.serverURL.User != nil {
+		password, _ := t.serverURL.User.Password()
+		request.SetBasicAuth(t.serverURL.User.Username(), password)
+	}
 	response, err := t.transport.RoundTrip(request)
 	requestBuffer.Release()
 	if err != nil {