SVCB/HTTPS record

Per RFC 9460 + 9461 + 9540

Service binding DNS record (RFC 9460) with ALPN, IPv4/IPv6 hints, ECH and dohpath. Replaces A/AAAA for HTTPS, DoH and DoT.

What is this, and when do I need it?

What is this?

SVCB and HTTPS resource records (RFC 9460) are the modern DNS layer that ties one hostname to the actual transport: ALPN protocols (HTTP/2, HTTP/3), alternative ports, IPv4/IPv6 hints, the ECH config for encrypted ClientHello, and DoH/OHTTP discovery. The HTTPS RR is a specialised SVCB record for HTTPS origins.

Browsers (Chrome, Firefox, Safari) and resolvers query the HTTPS RR before the A/AAAA, which lets you advertise HTTP/3 without an Alt-Svc header and ship ECH without sacrificing SNI privacy.

When do I need it?

Useful as soon as you ship HTTP/3 or want to switch on ECH. Also useful for DoH/DoT resolver discovery (RFC 9461), where the SVCB record holds the dohpath template the client needs to construct DoH requests.

Adoption note: the record is additive - clients that do not understand it fall back to A/AAAA. Drop-in safe.

Should already be in place

TLS certificate for the TargetName

Sensible next steps

Record type Owner name For HTTPS typically the apex domain (example.com). For SVCB the full DNS owner including the service prefix, e.g. _dns.resolver.example.com for DoH (RFC 9461) or _853._tcp.dot.example.com for a custom DoT hint.

SvcPriority 0 = AliasMode (TargetName points to another owner that holds the records). 1..65535 = ServiceMode (TargetName and SvcParams live here). TargetName . means "the same owner". In ServiceMode often .. AliasMode requires a real hostname. TTL (seconds) Optional. Default 3600. DNS providers often apply their own defaults.

Presets:

SvcParams (ServiceMode) ALPN tokens Comma-separated list of supported application-layer protocols. Common: h2,h3 or h3,h2,http/1.1. For DoT: dot. For DoH: h2. Set no-default-alpn When enabled, the client drops the implicit default ALPN (otherwise http/1.1 is added automatically for HTTPS).

Port override Optional. Use when the service does not run on the scheme default port (e.g. HTTPS on 8443). dohpath (RFC 9461) Path template for DoH, must contain {?dns} or {dns}. Example: /dns-query{?dns}.

IPv4 hints Comma-separated IPv4 addresses that the client uses as a hint instead of a separate A record. Speeds up the first connect. IPv6 hints Comma-separated IPv6 addresses analogous to ipv4hint.

ECH config (Base64) Encrypted ClientHello, Base64 encoded. Cloudflare and Mozilla rotate this automatically; usually not maintained by hand, take it from the provider dashboard. Set OHTTP flag (RFC 9540) When enabled, the record signals that the service accepts OHTTP gateway requests. mandatory keys Optional. Comma-separated list of SvcParam keys the client must understand, otherwise it discards the record (RFC 9460 § 8). Rarely needed.

DNS record in zone-file format per RFC 9460 + 9461 + 9540

example.com.	3600	IN	HTTPS	1 . alpn="h3,h2"

How to add this record at your DNS provider

The record generated above has three parts: the record type (typically TXT, occasionally CAA), the host (a subdomain like _dmarc, _smtp._tls or empty for the root domain) and the value (the actual payload in quotes). Every DNS provider asks for these same three fields - only the menu wording differs.

INWX (Dernium default for new customers)

Sign in at www.inwx.de.
Tab Nameserver → pick the domain → Nameserver-Sets verwalten → DNS-Einträge.
Button Neuen Eintrag anlegen.
Pick a type (e.g. TXT), enter the host (empty for the root domain, otherwise e.g. _dmarc), paste the value, leave TTL at 3600.
Save. Propagation typically within 5-15 minutes.

Strato

Sign in to the Strato customer area.
Menu Domains → pick the domain → Verwalten.
Section DNS-Verwaltung → Nameserver/DNS-Einstellungen anpassen.
Under Eigene DNS-Verwaltung pick the right record type (TXT records have their own block), enter host and value.
Save. Strato typically propagates within 30-60 minutes.

Hetzner DNS Console

Sign in at dns.hetzner.com.
Click on the zone of your domain.
Button Add record → pick a type, enter the name (use @ for the root domain), paste the value.
Save. Propagation typically under 5 minutes.

IONOS (1&1)

Sign in to the IONOS customer center.
Menu Domains & SSL → click the domain → DNS.
Button Eintrag hinzufügen → pick a type, enter the host, paste the value into the content field.
Save. Propagation typically 15-60 minutes.

Cloudflare

Sign in to Cloudflare, pick the domain.
Tab DNS → Records.
Button Add record → pick a type, enter the name (use @ for the root domain), paste the value, leave proxy status on DNS only for TXT/CAA records.
Save. Propagation typically under 2 minutes.

Note: If your DNS provider is not listed, you usually find the right place under headings like "DNS management", "Zone editor", or "Records". When in doubt, your provider's support helps; the paths shown here are vendor-specific and can shift slightly with redesigns.

Check an existing HTTPS/SVCB record live

Fetches the HTTPS or SVCB record via DNS-over-HTTPS (Cloudflare 1.1.1.1, with DNSSEC AD bit) and evaluates priority, TargetName and SvcParams against best practice. Server path: at most 12 requests per minute per IP subnet, no logging.

Examples: · ·