An HTTPS record describes how to connect to a website. It's the dedicated variant of SVCB for the web. It can designate a target and announce parameters like protocols, port, and ECH data. Browsers use it to choose the best connection.
An HTTPS record contains a name, a type, a priority, a target, parameters, and a TTL. The TTL indicates how long the response remains cached in the local resolver.
| Name | Type | Priority | Target | Parameters | TTL in seconds |
|---|
| test.captaindns.com | HTTPS | 1 | cdn.example.net. | alpn=h3,h2 port=443 ipv4hint=203.0.113.10 | 3600 |
In this example, the name targets the website. The target is another hostname. The parameters indicate protocols, the entry port, and a fallback address. A TTL of 3600 corresponds to one hour.
A priority of zero activates alias mode. The name then behaves like an alias to the target.
| Name | Type | Priority | Target | Parameters | TTL in seconds |
|---|
| captaindns.com | HTTPS | 0 | cdn.example.net. | (no parameters) | 3600 |
This mode is used to target another zone while remaining compliant at the apex where a CNAME is not desired.
| Parameter name | Role |
|---|
| alpn | Announces protocols like h2 or h3 |
| port | Indicates the service entry port |
| ipv4hint | Provides indicative v4 addresses |
| ipv6hint | Provides indicative v6 addresses |
| ech | Publishes ECH data to encrypt ClientHello |
These parameters guide the client. They do not replace A and AAAA records which remain the source of addresses.
A short TTL makes a change more visible. Useful during a transition.
A medium or long TTL reduces queries to authoritative servers. Suitable for a stable service.
Reduce the TTL a few hours before a switchover, then increase it after validation.
Good to know
Clients that don't understand HTTPS records use A and AAAA. Publishing HTTPS doesn't remove the need to keep these addresses.
On www to announce h3 or a distribution target. At the apex in alias mode to target a name while remaining compliant. On an application subdomain if the web service resides there.
HTTPS can coexist with A and AAAA. Browsers choose IPv6 when possible and fall back to IPv4 if needed.
To avoid
Publishing HTTPS without A or AAAA on the target.
Chaining multiple targets without reason.
Declaring parameters that don't match the actual service.
An online DNS lookup allows entering a name. You can see the priority, target, parameters, and TTL as perceived from the Internet. It's a useful first check. Then perform a local test from your machine.
Windows provides nslookup. It can be used in interactive mode.
nslookup
set q=https
example.com
nslookup
set q=https
server 1.1.1.1
example.com
The first part queries according to the machine's network configuration. The second forces the use of a third-party resolver, here Cloudflare's.
On these systems, the dig command is practical and easy to use.
dig HTTPS example.com
dig HTTPS example.com @1.1.1.1
A priority of zero indicates an alias. A value greater than zero describes a service with parameters.
The presence of alpn guides the h3 or h2 choice. The ipv4hint and ipv6hint fields are only hints.
A high remaining TTL may explain a lag after a change.
- Choose the objective. Alias at the apex or parameter publication on
www. - Reduce the TTL to 300 or even 60 seconds before setup.
- Publish the HTTPS record with the chosen priority, target, and parameters.
- Verify with nslookup or dig command from multiple networks.
- Increase the TTL when everything is stable.
Practical tip
Document the priority, target, and each parameter. Keep the date and reason for the change. This trace facilitates checks.
Publish alpn h3 on www. Keep h2 for compatibility.
Use alias mode to target the name provided by the service. Keep A and AAAA on the target.
Publish ech when the platform offers it. Verify browser-side support.
- If the site doesn't benefit from h3, check the presence of alpn and server-side support.
- If clients ignore HTTPS, check A and AAAA on the target.
- If a loop appears, verify that the target doesn't redirect back to the origin name.
- If the response remains old despite the update, wait for TTL expiration and purge the local resolver cache if possible.
In summary, an HTTPS record announces the optimal way to connect to a website. It can serve as a controlled alias and publish useful parameters like alpn, port, and ech. A well-adjusted TTL facilitates transitions. Verification goes through an online tool then through nslookup and dig.
With these markers, management remains clear. Changes proceed without stress. Users access the site without incident.