HTTPS HTTPS Service Binding Common
The web-specific version of SVCB — tells browsers how to connect efficiently, including HTTP/3 support and connection hints.
What it's for
An HTTPS record is the web-specific specialization of SVCB (Service Binding), purpose-built so browsers and HTTP clients can learn how to connect to a website efficiently — including whether it supports HTTP/3 (QUIC), what ports and application protocols are available, and IP address hints — all from a single DNS lookup, rather than discovering this information gradually through slower application-layer negotiation.
Modern browsers increasingly query for HTTPS records automatically when connecting to a site, and if the record exists and advertises HTTP/3 support, the browser can attempt a QUIC connection directly on the first try instead of connecting via HTTP/1.1 or HTTP/2 first and upgrading later.
Format & syntax
example.com. 3600 IN HTTPS 1 . alpn=h2,h3 ipv4hint=192.0.2.1
- Priority — same alias-mode-vs-service-mode meaning as SVCB
- Target —
.commonly means "this same hostname," or can point to a different hostname (useful for pointing a bare domain at a CDN's infrastructure hostname, similar in spirit to a CNAME-at-the-apex workaround) - Parameters —
alpn(which protocols are supported —h2for HTTP/2,h3for HTTP/3 over QUIC),ipv4hint/ipv6hint(address hints to potentially skip a separate A/AAAA lookup), and other SVCB-inherited parameters
How it's used in practice
- Enabling faster HTTP/3 connections — the single biggest practical driver behind HTTPS record adoption: a browser that sees
alpn=h3in an HTTPS record can attempt a QUIC/HTTP-3 connection on the very first request, rather than needing to first connect over TCP/TLS and discover HTTP/3 availability via anAlt-Svcresponse header. - CDN and hosting platform automation — this is largely a "your CDN handles it" feature today; providers like Cloudflare publish HTTPS records automatically once HTTP/3 is enabled on a zone, meaning most site operators benefit from this without manual DNS configuration.
- Apex domain workaround (in some configurations) — because the target field can point elsewhere, some setups use HTTPS records at the zone apex in ways conceptually similar to CNAME-flattening workarounds, letting a bare domain benefit from pointing at CDN infrastructure with richer connection metadata than a plain A record alone provides.
Common mistakes & gotchas
- Not realizing your platform already manages this — if you're on a modern CDN, you likely already have HTTPS records without having created them yourself; manually adding conflicting ones can cause confusion or duplicate/inconsistent records.
- Advertising
h3support without actually having it configured correctly server-side — if the HTTPS record claims HTTP/3 support but the server/CDN doesn't actually have HTTP/3 properly configured, browsers may attempt and fail a QUIC connection before falling back, adding latency rather than saving it — the opposite of the intended benefit. - Assuming this record is required for basic HTTPS to work — despite the name, an HTTPS record is a performance and protocol-negotiation optimization, not a requirement for a site to serve HTTPS at all. Sites without any HTTPS DNS record still work fine over standard TLS; they just don't get the connection-setup speedups this record can provide.
- Manually authoring incorrect parameter syntax — same risk as with plain SVCB — malformed parameters tend to be silently ignored by clients that understand the record type rather than causing an obvious error, making mistakes easy to overlook.
Comparison & FAQ
| Type | Purpose | Key difference from HTTPS |
|---|---|---|
| SVCB | The general-purpose base mechanism | HTTPS is the web-specific specialization that browsers actually look for |
| A / AAAA | Basic address resolution | HTTPS records can include address hints as an optimization but don't replace the need for A/AAAA records entirely |
Do I need an HTTPS record for my site to work over HTTPS?
No — it's a performance optimization for faster protocol negotiation (particularly HTTP/3), not a requirement for basic HTTPS/TLS to function. A site can serve HTTPS perfectly well without one.
Does my CDN automatically create HTTPS records for me?
Often, yes — many modern CDNs and hosting platforms publish HTTPS records automatically once HTTP/3 support is enabled on your zone, without requiring manual configuration.
What's the practical benefit of an HTTPS record?
It lets browsers learn upfront (from a single DNS answer) whether a site supports HTTP/3 and other connection details, allowing a faster, more direct connection attempt instead of discovering this information through slower application-layer negotiation after an initial connection.
What happens if a browser doesn't support HTTPS records?
It simply ignores them and falls back to standard DNS resolution (A/AAAA) plus normal HTTP protocol negotiation — there's no compatibility risk for clients that don't understand this newer record type.