The HTTPS record tells browsers, before they connect, which protocols a site supports (HTTP/2, HTTP/3), which addresses to use, and the keys for Encrypted Client Hello.
cloudflare.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint="104.16.132.229,104.16.133.229" ipv6hint="2606:4700::6810:84e5,2606:4700::6810:85e5"
; ServiceMode priority 1 on this name, protocols h3,h2
google.com. 19897 IN HTTPS 1 . alpn="h2,h3"
; ServiceMode priority 1 on this name, protocols h2,h3
facebook.com. 2131 IN HTTPS 1 . alpn="h2,h3" ; ServiceMode priority 1 on this name, protocols h2,h3 facebook.com. 2131 IN HTTPS 2 star-mini.fallback.c10r.facebook.com. alpn="h2,h3" ; ServiceMode priority 2 on star-mini.fallback.c10r.facebook.com, protocols h2,h3
discord.com. 22 IN HTTPS 1 . alpn="h3,h2" ipv4hint="162.159.128.233,162.159.135.232,162.159.136.232,162.159.137.232,162.159.138.232"
; ServiceMode priority 1 on this name, protocols h3,h2
HTTPS is SVCB specialised for the https scheme. A browser that sees alpn="h3,h2" can open a QUIC (HTTP/3) connection straight away, without first connecting over TCP and learning about HTTP/3 from an Alt-Svc header. A record with priority 0 is AliasMode: it points the name at another name, like a CNAME that is allowed at the zone apex. Priorities 1 and up are ServiceMode and carry parameters.
The ech parameter carries the public key for Encrypted Client Hello, which hides the hostname from network observers. Recent versions of Chrome, Firefox and Safari use HTTPS records; Cloudflare publishes them for proxied sites automatically.
example.com. 300 IN HTTPS 1 . alpn="h3,h2" ipv4hint="192.0.2.1" ipv6hint="2001:db8::1"
www.example.com. 300 IN HTTPS 0 example.com. ; AliasModeWire format: RDATA is a 16-bit SvcPriority, the TargetName, then SvcParams as (key, length, value) triples in ascending key order.
| Field | Meaning |
|---|---|
| SvcPriority | 0 = AliasMode; 1-65535 = ServiceMode, lower preferred. |
| TargetName | . means the owner name itself (ServiceMode) and is invalid in AliasMode. |
| alpn | Supported application protocols: h3, h2, http/1.1. |
| ipv4hint / ipv6hint | Addresses the client may use before its A/AAAA lookups finish. A/AAAA remain authoritative. |
| ech | Base64 ECHConfigList for Encrypted Client Hello. |
| port | Non-default port. |
h3 when UDP 443 is blocked by your firewall, which costs each new visitor a failed QUIC attempt.ech key that no longer matches the server after a CDN change; clients then retry without ECH or fail.