SVCB and HTTPS DNS Records

The two modes

Every SVCB or HTTPS record starts with a priority number and a target name. The priority decides which of two modes the record is in.

The target name has one special value, a single dot. In ServiceMode, . means “the endpoint is this same name,” which is the most common setup. In AliasMode, a dot target means the service is not available at this name. A name should hold only one AliasMode record, and if one is present, clients ignore any ServiceMode records beside it.

The HTTPS record is looked up at the hostname itself, such as www.example.com. If the site runs on a port other than 443, the client asks a prefixed name instead, for example _8443._https.www.example.com. The general SVCB type is used by other protocols that define their own mapping. One example is RFC 9461, which uses SVCB to advertise encrypted DNS servers, and RFC 9462, which builds resolver discovery on top of it.

Service parameters

ServiceMode records carry key-value pairs called SvcParams. RFC 9460 defines the first set of keys, and new ones are registered with IANA. The ones you will meet most often are:

• alpn: the application protocols the endpoint supports, such as h3 for HTTP/3 and h2 for HTTP/2. A client that sees h3 can try QUIC straight away instead of waiting for an Alt-Svc header on a first TCP connection.
• port: a non-default port for the endpoint.
• ipv4hint and ipv6hint: addresses the client may use while its A and AAAA lookups are still in flight. They are hints only; once real address records arrive, clients should prefer them.
• ech: the configuration a client needs for Encrypted Client Hello, which hides the requested hostname from observers on the network. DNS is the main way that key is distributed.
• mandatory and no-default-alpn: flags that tell clients which parameters they must understand, and that the default protocol should not be assumed.

Examples in a zone file

A site that serves itself and supports HTTP/3 and HTTP/2:

www.example.com.  3600 IN HTTPS 1 . alpn="h3,h2" ipv4hint=192.0.2.10 ipv6hint=2001:db8::10
www.example.com.  3600 IN A     192.0.2.10
www.example.com.  3600 IN AAAA  2001:db8::10

An apex that hands HTTPS traffic to a hosting platform, while keeping its mail and verification records, plus the platform’s own ServiceMode record:

example.com.          3600 IN HTTPS 0 edge.example.net.
example.com.          3600 IN MX    10 mail.example.com.
example.com.          3600 IN TXT   "v=spf1 mx -all"
example.com.          300  IN A     192.0.2.20

edge.example.net.     300  IN HTTPS 1 . alpn="h3,h2"
edge.example.net.     300  IN A     192.0.2.20

Keeping an A record at the apex matters. Clients without AliasMode support ignore the HTTPS record and use the address. The trade-offs between this approach and provider flattening are covered in CNAME at the Apex: ALIAS and Flattening.

Querying HTTPS records

Recent versions of dig understand the HTTPS and SVCB types and print parameters in readable form. Older versions show the raw data or reject the type name, in which case you can ask for TYPE65.

$ dig +noall +answer www.example.com HTTPS
www.example.com.  3600  IN  HTTPS  1 . alpn="h3,h2" ipv4hint=192.0.2.10 ipv6hint=2001:db8::10

$ dig +noall +answer example.com HTTPS
example.com.      3600  IN  HTTPS  0 edge.example.net.

$ dig +noall +answer edge.example.net HTTPS
edge.example.net. 300   IN  HTTPS  1 . alpn="h3,h2"

Clients normally send the HTTPS query in parallel with the A and AAAA queries, so it does not add a round trip. If you rely on encrypted DNS transports, the same records are visible through them; see DoH vs DoT vs DoQ for how those transports differ.

Operational cautions

Hints and addresses drift apart

If you change the A record but forget the ipv4hint, some clients may briefly try the old address. Update both together, or leave hints out if your addresses change often.

Advertising protocols you do not serve

Listing h3 when UDP port 443 is blocked by a firewall makes clients try QUIC, fail, and fall back, which costs time. Only advertise what the endpoint actually answers on.

It acts like a promise to use HTTPS

RFC 9460 tells clients that receive an HTTPS record to treat plain http:// links to that name as https://, much like HSTS. Do not publish an HTTPS record for a name that only works over plain HTTP.

Provider support varies

Some DNS hosts accept HTTPS and SVCB records natively, some only through an API, and some CDNs publish them automatically for names they serve. Check whether your provider adds records on your behalf before writing your own, so you do not publish conflicting answers.

How DNS Panopticon helps

Domain Visualizer does not query HTTPS or SVCB records in its current scans, so use dig for those. What it does show is the A, AAAA and CAA records at the apex and the A, AAAA and CNAME records for www, which is the data your hints and targets must agree with. Website Recon reports the network and AS number behind each resolved address, a quick way to confirm that an AliasMode target and the apex addresses belong to the same platform.

When you review a zone export in Zone Analyzer, filter the grid by type to list any HTTPS or SVCB rows next to the address records for the same names, then export that view as CSV for a change review.