HTTPS Record Service

The HTTPS record (also called HTTPS RR) is a modern DNS record type that enables faster, more secure web connections. It combines connection information with service binding, allowing browsers to connect over HTTPS more efficiently without needing additional DNS lookups or HTTP redirects.

What Is an HTTPS Record?

HTTPS records (defined in RFC 9460) provide essential connection parameters for HTTPS services directly in DNS. Benefits include:

• Faster connections — Eliminates HTTP-to-HTTPS redirects
• ALPN hints — Tells browsers which protocols are supported (HTTP/2, HTTP/3)
• IP hints — Can include IP addresses to reduce DNS lookups
• Port specification — Can specify non-standard ports
• CNAME-like aliasing — Can point to another hostname at the apex

HTTPS Record Format

HTTPS records have a priority, target, and optional service parameters:

example.com.    3600    IN    HTTPS    1 . alpn="h2,h3" ipv4hint="192.0.2.1"

HTTPS Record Components

Service Mode vs Alias Mode

Service Mode (Priority > 0)

Provides connection parameters for the service:

example.com.    HTTPS    1 . alpn="h2,h3"

Alias Mode (Priority = 0)

Acts like a CNAME but can be used at the apex. Points to another domain:

example.com.    HTTPS    0 cdn.example.net.

This is particularly useful because CNAMEs cannot be placed at the zone apex alongside NS and SOA records.

Common HTTPS Record Configurations

1. Basic HTTP/2 and HTTP/3 Support

example.com.    HTTPS    1 . alpn="h2,h3"

2. With IP Hints

example.com.    HTTPS    1 . alpn="h2,h3" ipv4hint="192.0.2.1" ipv6hint="2001:db8::1"

3. Apex Alias to CDN

example.com.    HTTPS    0 d123.cloudfront.net.

4. Multiple Priorities (Failover)

example.com.    HTTPS    1 primary.example.com. alpn="h2,h3"
example.com.    HTTPS    2 backup.example.com. alpn="h2"

5. With Encrypted Client Hello

example.com.    HTTPS    1 . alpn="h2,h3" ech="AEX+DQBBpQA..."

HTTPS Record Benefits

• No HTTP redirect needed — Browsers know to use HTTPS directly
• HTTP/3 discovery — Browsers learn about QUIC support immediately
• Apex aliasing — Works where CNAME cannot
• Connection coalescing — Enables more efficient connection reuse
• Privacy — Encrypted Client Hello support protects SNI

Browser Support

HTTPS records are supported by modern browsers:

• Chrome/Chromium 89+
• Firefox 88+
• Safari 16+
• Edge (Chromium-based)

HTTPS Record Best Practices

• Include alpn hints — Specify h2 and h3 if your server supports them.
• Use for apex domains — HTTPS records can alias at the apex where CNAME can't.
• Keep A/AAAA records — Maintain traditional records for backward compatibility.
• Consider IP hints — Can reduce additional DNS lookups.
• Test thoroughly — Verify that connections work before rolling out broadly.

HTTPS vs SVCB Records

HTTPS records are actually a special case of SVCB records specifically for the "https" service. SVCB is the generic record type; HTTPS is the specialized version for web traffic.

Troubleshooting HTTPS Records

Common issues and solutions:

• Browser not using HTTP/3 — Verify alpn includes "h3" and your server supports QUIC.
• Record not found — HTTPS records are relatively new; ensure your DNS provider supports them.
• Alias mode not working — Priority must be 0 for alias mode.
• Connection issues — Verify the target hostname has valid A/AAAA records.

Related Record Types

• SVCB Record — Generic service binding
• A Record — Traditional IPv4 address
• AAAA Record — Traditional IPv6 address
• CNAME Record — Traditional aliasing