Proxylity Launches Serverless DTLS Listeners to Simplify Encrypted UDP

Proxylity has introduced DTLS Listeners as part of its UDP Gateway service, enabling developers to implement encrypted UDP transport without maintaining persistent server infrastructure. The service terminates encrypted connections and routes decrypted plaintext payloads directly to AWS serverless destinations, such as AWS Lambda.

The new offering supports both DTLS 1.2 and DTLS 1.3 protocols. To streamline deployment, Proxylity provides multiple authentication options, including Pre-Shared Keys (PSK) and server certificates managed directly by the platform. To ensure performance and security, the gateway includes 0-RTT (Early Data) for DTLS 1.3 to minimize latency and employs Cookie Protection to mitigate common UDP amplification attacks. According to the company, the service has maintained over 99.99% availability since early last year.

The UDP Scaling Challenge

UDP is traditionally difficult to scale within serverless environments because it is connectionless. Unlike TCP, which has well-established load-balancing patterns, UDP often requires always-on listeners to maintain session state or handle the complex handshakes required by DTLS. This typically forces developers to maintain global fleets of virtual machines to ensure low latency and connection stability.

Proxylity's UDP Gateway acts as a managed proxy that terminates these connections—including UDP, WireGuard, and DTLS—and converts the traffic into event-driven triggers. This architecture effectively treats encrypted datagram traffic as a native serverless event source, removing the need for the user to manage the underlying compute layer.

Industry Implications

This shift removes a significant operational burden for industries relying on protocols like RADIUS, IoT telemetry, and real-time gaming. By offloading the termination point, developers can adopt event-driven architectures for encrypted traffic that previously required rigid server setups. The founder of Proxylity noted that the primary driver is the desire to avoid running always-on servers globally, prioritizing convenience and scale.

However, this architecture introduces a specific trust dependency. Because Proxylity terminates the encryption to route the payload, the service sees the plaintext data before it is forwarded to the user's AWS account. To address security concerns, Proxylity is a certified AWS partner, and its software has passed an AWS security review.

Future Outlook

As the service evolves, Proxylity is working toward achieving SOC-2 auditing to further validate its security posture. Developers will likely watch for expanded native integrations across the AWS ecosystem to further reduce the glue code required between the gateway and backend serverless functions.