Skip to content
Control Plane Labs

HTTPS record

Service binding record for HTTPS origins: advertises HTTP/3, ECH keys, and address hints.

Last updated July 27, 2026

Zone-file example

example.com.   300   IN   HTTPS   1 . alpn="h3,h2" ipv4hint="203.0.113.10"

Typical uses

  • Advertising HTTP/3 support so browsers skip the Alt-Svc upgrade round trip
  • Publishing Encrypted ClientHello keys in the ech parameter
  • Apex aliasing to a CDN hostname, using AliasMode instead of a proprietary ALIAS
  • Upgrading a plaintext navigation before any HSTS header has been seen

When it breaks, check

  • Type 65 queries are dropped by some middleboxes and old resolvers, so the record never arrives
  • The ech value is generated by your TLS terminator; hand-editing it breaks the handshake
  • A stale ipv4hint gives a slow first connection rather than a clean error
  • Browsers query this on every navigation, so a slow authoritative server becomes visible

What the HTTPS record does

The record removes a round trip HTTP lived with for years. Without it, a browser connects over TCP and TLS, receives an Alt-Svc header advertising HTTP/3, and only uses QUIC on some later request. With alpn="h3" in DNS, the first connection can be QUIC.

Encrypted ClientHello is the second driver, and arguably the one that got the record deployed. ECH needs the client to hold a public key before the handshake starts, and DNS is the natural place for it, so the ech parameter carries those keys. A browser that finds an HTTPS record also treats the origin as HTTPS-only, upgrading a plaintext navigation without a redirect or a cached HSTS header.

Zone-file and wire format

The wire and presentation formats are identical to SVCB — only the type number differs, so AliasMode, ServiceMode, and SvcParams carry over unchanged. Owner names for port 443 are the plain origin name with no underscore prefix, which is why example.com works directly; other ports use _port._https. A ServiceMode record with target . at the apex is by far the most common deployment.

; owner        TTL  class type  pri target  SvcParams
example.com.  300  IN    HTTPS 1   .       alpn="h3,h2" ipv4hint="203.0.113.10"

; AliasMode at the apex: priority 0, no parameters, delegates to a CDN
example.com.  300  IN    HTTPS 0   cdn.provider.net.

; non-443 origins use the _port._https prefix, SRV-style
_8443._https.example.com. 300 IN HTTPS 1 . alpn="h2" port="8443"

; the ech value is base64 emitted by your TLS stack — never hand-written

Common uses

Publish one if you serve HTTP/3, terminate TLS somewhere that supports ECH, or want apex aliasing without a vendor-specific type. Major CDNs generate these automatically for zones they host, which is how the record reached real deployment in a few years. AliasMode gives example.com the delegation behaviour that previously required proprietary ALIAS records, as a standard type that survives a provider migration.

Troubleshooting

The classic failure is silence. Type 65 is new enough that some resolvers, home routers, and enterprise middleboxes drop or mangle the query instead of answering, so clients behind them never learn about HTTP/3 or ECH and quietly fall back to ordinary A and AAAA resolution. Nothing logs an error. Test from several networks, and compare against a direct query to your authoritative server, before deciding the record is wrong.

Stale parameters are quieter. An ipv4hint on a decommissioned address costs a connection timeout on the first attempt, and an ech value that no longer matches the server’s key causes handshake retries.

# what browsers ask for on every navigation
dig example.com HTTPS +noall +answer

# some resolvers still need the numeric type
dig example.com TYPE65 +short

# compare a public resolver with the authoritative server to spot filtering
dig @1.1.1.1 example.com HTTPS +short
dig +norecurse @ns1.example.com example.com HTTPS +short

# confirm the advertised protocol actually works
curl --http3 -sSI https://example.com/

The defining RFC

HTTPS is type 65 and shares its definition with SVCB in RFC 9460; HTTP-specific behaviour is §9, query name construction §9.1, and the comparison with the Alt-Svc mechanism it partly replaces §9.2. Parameters live in the IANA Service Parameter Keys registry, where ech is reserved for Encrypted ClientHello — still published only as the IETF draft draft-ietf-tls-esni, with no RFC number. Query one with the DNS lookup tool.

Reference and tooling

Every record type and its assigned numeric value is listed in theIANA DNS Parameters registry. To query a live zone from the browser, use theDNS lookup tool. If the record you are chasing is TLS-related, the TLS inspector andCertificate Transparency lookup are usually the next two stops.

Other record types