An SVCB record describes how to connect to a service. It can designate another name and provide parameters like protocol, fallback address, and port. For a website, we often publish an HTTPS record which is the dedicated variant of SVCB.
An SVCB record contains a name, a type, a priority, a target, parameters, and a TTL. The TTL indicates how long the response remains cached in the local resolver.
| Name | Type | Priority | Target | Parameters | TTL in seconds |
|---|
| _imap._tcp.example.com | SVCB | 1 | mail.example.net. | alpn=imap port=993 ipv4hint=203.0.113.10 | 3600 |
In this example, the name targets the imap service over tcp. The target is another hostname. The parameters indicate the protocol, entry port, and a fallback address. A TTL of 3600 corresponds to one hour.
A priority of zero activates alias mode. The name then behaves like an alias to the target.
| Name | Type | Priority | Target | Parameters | TTL in seconds |
|---|
| apex.example.com | SVCB | 0 | cdn.example.net. | (no parameters) | 3600 |
This mode serves as a bridge. It avoids using a CNAME where it's not desired.
| Parameter name | Role |
|---|
| alpn | Announces supported protocols like h2 or h3 |
| port | Indicates the service entry port |
| ipv4hint | Provides indicative v4 addresses |
| ipv6hint | Provides indicative v6 addresses |
| ech | Publishes ECH data to encrypt ClientHello |
These parameters guide the client. They don't replace A and AAAA records which remain the source of addresses.
A short TTL makes a change more visible. Useful during a transition.
A medium or long TTL reduces queries to authoritative servers. Suitable for a stable service.
Reduce the TTL a few hours before a switchover, then increase it after validation.
Good to know
For the web, favor an HTTPS record. It follows the same rules as SVCB and adds fields useful to browsers.
On a dedicated service name like _imap._tcp or _smtp._tcp when the protocol provides for it.
At the apex in alias mode if you need to target another name while avoiding a CNAME.
SVCB can coexist with A and AAAA. Clients that don't understand SVCB use classic addresses.
To avoid
Chaining targets without reason. Get to the point.
Publishing parameters inconsistent with the actual service.
Forgetting A or AAAA on the target when the client needs to reach it.
An online DNS lookup allows entering a domain name. You can see the priority, target, parameters, and TTL as perceived from the Internet. It's a useful first check. Then perform a local test from your machine.
Windows provides nslookup. It can be used in interactive mode.
nslookup
set q=svcb
example.com
nslookup
set q=svcb
server 1.1.1.1
example.com
The first part queries according to the machine's network configuration. The second forces the use of a third-party resolver, here Cloudflare's.
On these systems, the dig command is practical and easy to use.
dig SVCB example.com
dig SVCB example.com @1.1.1.1
A priority of zero indicates an alias. A value greater than zero indicates a service with parameters.
The presence of alpn guides protocol choice. The ipv4hint and ipv6hint fields are only hints.
A high remaining TTL may explain a lag after a change.
- Define the need. Alias to a target or parameter publication.
- Reduce the TTL to 300 or even 60 seconds a few hours before setup.
- Publish the SVCB with the chosen priority and parameters.
- Verify with nslookup or dig command from multiple networks.
- Increase the TTL when everything is stable.
Practical tip
Document the priority, target, and each parameter. Keep the date and reason for change. This trace facilitates checks.
Publish an SVCB on _api._tcp to announce alpn and port. The application knows how to connect.
Use alias mode to target the name provided by the service. Keep A and AAAA on the target.
On a website, publish a dedicated HTTPS record with alpn h3. Add ech if the service offers it.
- If clients ignore SVCB, verify that A and AAAA exist on the target.
- If the wrong protocol is chosen, verify alpn.
- If a loop appears, verify that the target doesn't redirect back to the origin name.
- If the response remains old despite the update, wait for TTL expiration and purge the local resolver cache if possible.
In summary, an SVCB record describes a service and can serve as a controlled alias. Parameters guide the client without replacing A and AAAA. A well-adjusted TTL facilitates transitions. Verification goes through an online tool then through nslookup and dig.
With these markers, management remains clear. Changes proceed without stress. Users access the service without incident.