BRev HTTPS record — HTTPS service binding
The HTTPS record (type 65) delivers connection parameters in the same lookup that resolves the name. Instead of connecting over HTTP/1.1, reading an Alt-Svc header and upgrading on a later request, a browser learns from DNS that the origin speaks HTTP/3, on which port, at which addresses — and connects correctly the first time. It is a browser-specific profile of the general SVCB record.
The parameters are key=value pairs in the RDATA. alpn lists the protocols (h3, h2), port overrides 443, ipv4hint and ipv6hint carry addresses so the client can skip a second lookup, and ech carries the Encrypted Client Hello configuration — which is how the hostname in the TLS handshake stops being visible on the wire. ECH cannot work without this record: the key has to be published somewhere the client can read before it connects.
The second capability is aliasing. An HTTPS record with priority 0 is AliasMode, which points the name at another target much like a CNAME — but unlike a CNAME it is legal at the apex, because it does not exclude other records. That is a genuine answer to the oldest problem in DNS hosting, currently limited by how widely resolvers and browsers implement it.
What a HTTPS record looks like
Type 65 · HTTPS service binding (ALPN, ECH, hints). Zone-file form below — owner name, TTL, then the record and its RDATA.
| Name | TTL | Record | What it means |
|---|---|---|---|
| example.com. | 3600 | HTTPS 1 . alpn="h3,h2" | ServiceMode at the apex. The single dot means "this same name"; the client learns HTTP/3 is available. |
| example.com. | 3600 | HTTPS 1 . alpn="h3,h2" ipv4hint=93.184.215.14 ipv6hint=2606:2800::1 | Address hints let the client connect without waiting for a separate A/AAAA lookup. |
| www.example.com. | 300 | HTTPS 1 . alpn="h2" ech=AEX+DQBB… | The ECH configuration. Encrypted Client Hello has nowhere else to publish its key. |
| example.com. | 3600 | HTTPS 0 origin.example-cdn.net. | Priority 0 is AliasMode — apex aliasing that a CNAME cannot legally do. |
The mistakes that break production
Publishing an HTTPS record that contradicts reality
Advertising alpn="h3" when the server does not serve HTTP/3, or an ipv4hint that is no longer the right address, sends clients down a path that fails and then has to be retried. Because it is only a hint, the symptom is added latency for some visitors rather than a clean error — hard to spot and easy to leave in place.
Removing the A and AAAA records once the HTTPS record exists
Client support is not universal, and anything that does not understand type 65 still needs ordinary address records. Treat the HTTPS record as an accelerator alongside A/AAAA, not a replacement for them.
Query a HTTPS record now
The box below is seeded with cloudflare.com. Choose HTTPS as the type and press Look up — the query goes from your browser straight to Cloudflare or Google over DNS-over-HTTPS, with no server of ours in the path.
DNS is the internet's address book: it turns a name like example.com into the addresses and service endpoints machines actually connect to. Every record has a type (what kind of fact it states) and a TTL (how long resolvers may cache it).
Record types
| Type | What it stores |
|---|---|
| A | IPv4 address |
| AAAA | IPv6 address |
| CNAME | Canonical name (alias) |
| MX | Mail exchanger (priority target) |
| TXT | Text — SPF, verifications, DKIM, arbitrary data |
| NS | Authoritative nameservers |
| SOA | Start of authority (serial, refresh, retry, expire, minimum) |
| SRV | Service locator (priority weight port target) |
| CAA | Which CAs may issue certificates |
| PTR | Reverse DNS (IP → name) |
| DNSKEY | DNSSEC public key |
| DS | Delegation signer (DNSSEC chain of trust) |
| HTTPS | HTTPS service binding (ALPN, ECH, hints) |
| SVCB | General service binding |
| TLSA | DANE — pin certificates in DNS |
| NAPTR | Name authority pointer (SIP/ENUM) |
TTL & “propagation”
DNS changes don't “push” anywhere — resolvers simply keep the old answer until its TTL runs out, then fetch the new one. So a change “propagates” in at most the old record's TTL. Planning a change? Lower the TTL (e.g. to 300s) a day in advance, make the change, then raise it back. The compare card above shows whether major public caches have picked your change up yet.
FAQ
What does an HTTPS DNS record do?
It tells the client, before connecting, which protocols the origin speaks (h3, h2), on which port, optionally at which addresses, and carries the Encrypted Client Hello key. It removes a round trip and an upgrade step.
What is the difference between HTTPS and SVCB records?
They share a format. SVCB (type 64) is the general service-binding record for any protocol; HTTPS (type 65) is the profile browsers use for web origins, so it needs no _service._proto prefix.
Can an HTTPS record replace a CNAME at the apex?
In principle — priority 0 is AliasMode and is legal at the apex, unlike a CNAME. In practice it depends on resolver and client support, so keep A/AAAA records alongside it for now.