Guides HTTPS / SVCB
What is an HTTPS/SVCB record?
An HTTPS record can tell supporting HTTP clients about endpoints and parameters such as ALPN, address hints and ECH before they connect.
An HTTP client that supports HTTPS/SVCB can query an HTTPS record (type 65) alongside A and AAAA during DNS resolution. That record can publish alternative endpoints and connection parameters such as available ALPN protocols. The client does not have to learn that information from an earlier connection.
SVCB is the general service-binding framework. Each application defines how it uses that framework. HTTPS is the mapping for HTTP: HTTP clients that implement this standard query type 65 for an HTTPS origin.
What the record holds
An HTTPS record has a priority, a target name and optional parameters. A ServiceMode record might look like this: example.com. HTTPS 1 . alpn="h3,h2".
A priority above zero means ServiceMode. Lower values are preferred. Here the dot makes the owner name, example.com, the effective target name. alpn="h3,h2" adds HTTP/3 and HTTP/2 to the SVCB ALPN set. For HTTPS, http/1.1 also belongs to that set by default unless the record contains no-default-alpn. This lets a supporting client decide which transports are candidates before connecting.
Parameters you will meet in the wild:
- alpn: protocol identifiers such as h3 and h2.
- ipv4hint and ipv6hint: preliminary addresses a client may try. The client should still query A and/or AAAA for the target name and should prefer locally available A/AAAA answers over the hints.
- port: a non-standard port.
- ech: a binary ECHConfigList. A compatible client can use it to put the real SNI in the encrypted inner ClientHello. DNS queries, the destination IP and traffic metadata can still reveal or suggest the destination. SVCB/HTTPS is the primary DNS bootstrap for ECH; clients can obtain ECH configuration through other mechanisms as well.
AliasMode is not ServiceMode
Only priority 0 means AliasMode: example.com. HTTPS 0 cdn.provider.net.. The client then continues the HTTPS lookup at cdn.provider.net. Parameters on an AliasMode record are ignored.
A record such as example.com. HTTPS 1 cdn.provider.net. alpn="h3,h2" is therefore not an alias. In ServiceMode it describes an alternative endpoint with connection parameters.
AliasMode can sit at the apex alongside other record types, where a CNAME cannot. It applies only to the specific SVCB-compatible record type: an HTTPS alias does not change A, AAAA or MX lookups. A working A/AAAA route at the original name therefore remains important for older clients. An SVCB-optional client that has followed at least one AliasMode record also tries the final alias target without SvcParams before falling back to an ordinary non-SVCB connection.
Do you need it?
No. Existing HTTP protocols have to be implemented as SVCB-optional. With no record, or with no usable ServiceMode record, such a client can use the ordinary connection path. That is why the absence of HTTPS/SVCB costs no points in the scan.
The record can still be useful when: - you want supporting clients to consider an HTTP/3 endpoint immediately; whether that is actually faster depends on the client, network and configuration; - you want to provide an ECHConfigList through DNS; - you want to direct supporting clients from the apex to a CDN's HTTPS configuration.
Providers may publish HTTPS records automatically. Check their documentation or DNS control panel before adding a second, potentially conflicting record yourself.
SVCB-optional does not mean every failure leads to ordinary A/AAAA fallback. If SVCB resolution over cryptographically protected DNS fails with an authentication error, SERVFAIL, transport error or timeout, RFC 9460 says the client should stop to prevent a downgrade. An AliasMode record, or a ServiceMode record compatible with that client, can also signal an HTTP client to treat an http URL like a temporary redirect to https. Which ServiceMode records are compatible depends on the client.
Where it can go wrong
The record has to match the real service. If it advertises only a protocol the client does not support or the endpoint does not offer, that route is unusable. Fallback between transports is client behaviour and is not guaranteed.
A stale ipv4hint or ipv6hint can delay an initial connection attempt. Hints are not a replacement for current A/AAAA answers. AliasMode chains, equal priorities and mandatory parameters are also processed per client. Do not only test whether the record is syntactically valid; make sure the target name and its A/AAAA records remain reachable as well.
For ECH, publishing the parameter alone is not enough: the client, server and the rest of the configuration must support ECH. Encrypted DNS also helps prevent the same hostname from already being visible in the DNS query.
Primary sources
Frequently asked questions
Is it bad if I have no HTTPS/SVCB record?
No. If your ordinary A/AAAA route and HTTPS service work, SVCB-optional HTTP clients can connect without this record. You lose no points for it in the scan.
What's the difference between HTTPS and SVCB?
SVCB is the general framework (record type 64), which an application can use through its own mapping. HTTPS is the HTTP mapping and has record type 65. HTTP clients that implement this standard therefore query an HTTPS record for an HTTPS origin.
Can I use this to replace a CNAME on my apex?
For supporting clients, HTTPS AliasMode can take over part of that role. Use priority 0 and no parameters. The alias applies only to HTTPS queries; older clients keep using the original name's A/AAAA records.
Do I have to create it myself?
Usually not. A CDN or host may publish it automatically. If you create it yourself, check that your DNS provider supports record type 65 and that the mode, target name and parameters precisely match the service.