SVCB and HTTPS records for service parameters and connection hints

SVCB (Service Binding, defined in RFC 9460) and its special case HTTPS (type 65) shift connection parameters out of hard-coded client or app settings and into a DNS record. An HTTPS record for a web host can advertise which services and protocols to use, including an ALPN list, priorities and specific ports.

Understand the record

• RFC 9460 SVCB. Generalises the old SRV idea: a canonical name plus parameters for a service. It carries a target name and a list of parameters.
• HTTPS record (type 65). The SVCB variant for web origins. When you publish an HTTPS record at a name like www.example.com, the client reads the record and uses its advertised settings instead of defaulting to A/AAAA + port 443.
• Why it matters. It lets an origin signal "use this host, these protocols, this ALPN," which is how newer HTTP versions (such as HTTP/3 or Alt-Svc-like hints) can be discovered without brittle client configuration. It also supports aliasing so a domain can point at a service hostname.

Write the syntax

A basic HTTPS record uses a priority, a target and parameters:

www.example.com.  3600  IN  HTTPS  1  .  alpn="h3,h2,h1"

• Priority. Lower is preferred. The client sorts records by priority.
• Target. The service hostname, or . to mean "use the name in the record itself".
• Common parameters. alpn="h3,h2" lists the ALPN protocol IDs in preference order; port= overrides the default; ipv4hint= and ipv6hint= give addresses the client may try before resolving the target.

A record that advertises HTTP/3 support and delegating to a CDN might look like:

example.com.  3600  IN  HTTPS  1  cdn.example.net. alpn="h3,h2" port=443

Deliver connection hints

• How EE/CO hints ride DNS. The HTTPS record also carries ech= parameters for Encrypted ClientHello. When the record advertises an ech value, a supporting client can configure itself for ECH without a separate out-of-band config, and it signals capability through connection hints.
• Interaction with existing records. Only clients that understand SVCB/HTTPS read the record and its hints. Others fall back to A/AAAA on port 443, so publishing an HTTPS record is a safe enhancement rather than a requirement.
• Operational note. Because the record changes how clients connect, test changes in a staging zone first and keep the A/AAAA records accurate so non-supporting clients still resolve. Invalid alpn or port values can make a browser retry or fail to connect, which is why validation is worthwhile before broad rollout.