HTTPS and SVCB are DNS record types (RFC 9460) that let a domain tell clients how to connect before they connect: which protocols are supported (such as HTTP/3), which port and host to use, and keys for Encrypted Client Hello. Browsers already query HTTPS records. This guide explains what they do and when to publish them.
Before you start
- Check whether your DNS provider supports HTTPS/SVCB record types; not all control panels do yet.
- CDNs such as Cloudflare often publish HTTPS records automatically for proxied domains.
SVCB vs HTTPS
- SVCB is the general "service binding" record for any protocol.
- HTTPS is the same format specialised for websites; browsers look it up alongside A/AAAA.
Record syntax
example.com. 3600 IN HTTPS 1 . alpn="h3,h2" ipv4hint=203.0.113.50
example.com. 3600 IN HTTPS 0 www.cdn.example.| Part | Meaning |
|---|---|
| Priority 0 | AliasMode – points the name to another hostname (works at the zone apex, unlike CNAME) |
| Priority 1+ | ServiceMode – describes an endpoint; lower numbers preferred |
Target . | The same name as the owner |
alpn | Supported protocols: h3 (HTTP/3), h2 |
port | Non-default port |
ipv4hint / ipv6hint | Addresses the client can use immediately |
ech | Encrypted Client Hello configuration |
What you gain
- Faster HTTP/3 – browsers can use QUIC on the first connection instead of learning about it from an
Alt-Svcheader after an HTTP/2 connection. - HTTPS-first – the presence of an HTTPS record tells browsers to upgrade to HTTPS, similar to HSTS.
- Apex aliasing – AliasMode gives CNAME-like behaviour at the root domain.
- Privacy – ECH hides the requested hostname in the TLS handshake.
When to publish one
- Your server or CDN supports HTTP/3 and you want clients to use it immediately.
- You use a CDN that needs apex aliasing and your DNS provider supports HTTPS AliasMode.
- Leave it out if you are unsure the advertised protocols work – a wrong
alpnor hint can cause connection delays until clients fall back.
On LiteSpeed hosting, HTTP/3 is supported and browsers also discover it via the Alt-Svc header, so an HTTPS record is optional.
Check HTTPS records
dig example.com HTTPS +short
dig example.com TYPE65 +shortOlder dig versions need TYPE65 (HTTPS) or TYPE64 (SVCB).
Troubleshooting
- Panel rejects the record type: your DNS host doesn't support it yet.
- Slow first loads after adding it: the advertised HTTP/3 endpoint is blocked by a firewall (UDP 443) – open it or remove
h3. - Hints don't match A records: keep
ipv4hint/ipv6hintin sync, or omit them.
FAQ: HTTPS and SVCB records
Do HTTPS records replace A records?
No. Keep A/AAAA records; HTTPS records add connection information.
Do all browsers use HTTPS records?
Major browsers query them, with support details varying by platform and resolver.
Is an HTTPS record the same as HSTS?
Both push browsers to HTTPS, but HSTS is an HTTP header cached by the browser; an HTTPS record is published in DNS.