Guides HTTPS / SVCB
What is an HTTPS/SVCB record?
A browser asking for your site initially knows only your IP address: that's in your A and AAAA records. Everything else it has to work out while connecting. Whether your server does HTTP/3, for instance, or whether the site actually lives somewhere else. That costs a detour, and sometimes an extra round trip. The HTTPS record fills that gap. It sits on your domain name alongside your A/AAAA records and states up front how to connect. SVCB is the general form of the same idea, meant for any service. HTTPS is the variant made specifically for websites.
What the record holds
An HTTPS record has a priority, a target name and a list of parameters. The simplest case looks like this: example.com. HTTPS 1 . alpn="h3,h2".
The 1 is the priority: a lower number is tried first. The dot means 'the same address as this name', so your A/AAAA records still apply. And alpn="h3,h2" says this server speaks HTTP/3 and HTTP/2. That tells a browser before the first packet that it may try HTTP/3, instead of setting up HTTP/2 first and only then discovering it could have been faster.
The parameters you'll meet in the wild:
- alpn: which protocols the server speaks (h3, h2).
- ipv4hint and ipv6hint: addresses the browser may use straight away, so it doesn't have to ask DNS again.
- port: a non-standard port.
- ech: the key for Encrypted Client Hello, which stops the name of the site you're requesting from travelling readably over the wire.
The difference from a CNAME
An HTTPS record can also point at another name, and then it resembles a CNAME: example.com. HTTPS 1 cdn.provider.net. alpn="h3,h2".
The difference matters. A CNAME may not sit on your apex (example.com itself) alongside other records. That's one of the classic DNS limitations. An HTTPS record may, so you can point your apex at a CDN without the workarounds providers invented for it (ANAME, ALIAS, CNAME flattening).
It doesn't replace your A/AAAA records. Does a browser not know HTTPS records, or does an older resolver not pass them on? Then it simply uses your A/AAAA. That's why those are always still needed.
Do you need it?
No. Without an HTTPS record your site works exactly as before. Browsers do discover what your server supports while connecting. That's why a missing record doesn't count as a fault in your report. It's a gain when you have it, not a shortcoming when you don't.
It is free gain in three cases: - Your server supports HTTP/3 and you want visitors to use it right away instead of after a detour. - You want to enable ECH, so the requested hostname no longer travels readably. That's only possible through this record. - You want your apex to point at a CDN without provider-specific CNAME workarounds.
In practice you rarely set it by hand. Are you behind Cloudflare, Fastly or a comparable provider? Then they publish the record for you. This guide is then mainly the answer to the question of what that record you didn't create yourself is doing.
Where it can go wrong
The record has to match reality. If it says alpn="h3" while your server doesn't do HTTP/3, a browser tries something that fails and then falls back. You've added the detour instead of removing it. The same goes for an ipv4hint holding an address that's no longer in use.
Older resolvers and firewalls didn't always pass unknown record types along either. That's largely fixed by now, but it's the reason your A/AAAA records always keep existing alongside your HTTPS record. An HTTPS record is an optimisation on top of a working setup, never the only route to your site.
Frequently asked questions
Is it bad if I have no HTTPS/SVCB record?
No. For many sites that's simply still the normal situation. Browsers then use your A/AAAA records and work out what your server supports while connecting. You lose no points for it in the scan.
What's the difference between HTTPS and SVCB?
The same mechanism, two record types. SVCB is the general form, meant for any service. HTTPS is the special variant for websites, which browsers request automatically for https:// traffic. So for a website you publish an HTTPS record.
Can I use this to replace a CNAME on my apex?
Partly. An HTTPS record may sit alongside other records on your apex and point at a CDN, which a CNAME there may not. But your A/AAAA records are still needed for anyone who doesn't know the record, so it doesn't fully replace the provider workarounds.
Do I have to create it myself?
Usually not. Large CDNs and hosts publish it automatically. If you do want it yourself, your DNS provider has to support the record type. Then make sure the parameters match what your server actually supports.