SVCB (service binding) is the general form of the HTTPS record: it tells a client which endpoints, protocols and parameters a service offers, for any scheme.
_dns.one.one.one.one. 300 IN SVCB 1 one.one.one.one. alpn="h3,h2" dohpath="/dns-query{?dns}"
; ServiceMode priority 1 on one.one.one.one, protocols h3,h2, DNS over HTTPS
_dns.one.one.one.one. 300 IN SVCB 2 one.one.one.one. alpn="dot"
; ServiceMode priority 2 on one.one.one.one, protocols dot
_dns.dns.google. 900 IN SVCB 1 dns.google. alpn="dot" ; ServiceMode priority 1 on dns.google, protocols dot _dns.dns.google. 900 IN SVCB 2 dns.google. alpn="h2,h3" dohpath="/dns-query{?dns}" ; ServiceMode priority 2 on dns.google, protocols h2,h3, DNS over HTTPS
_dns.dns.quad9.net. 1200 IN SVCB 1 dns.quad9.net. alpn="h3,h2" dohpath="/dns-query{?dns}"
; ServiceMode priority 1 on dns.quad9.net, protocols h3,h2, DNS over HTTPS
_dns.dns.quad9.net. 1200 IN SVCB 2 dns.quad9.net. alpn="dot"
; ServiceMode priority 2 on dns.quad9.net, protocols dot
_dns.dns.quad9.net. 1200 IN SVCB 3 dns.quad9.net. alpn="doq"
; ServiceMode priority 3 on dns.quad9.net, protocols doq
_dns.resolver.arpa. 300 IN SVCB 1 one.one.one.one. alpn="h2,h3" port="443" ipv4hint="1.1.1.1,1.0.0.1" ipv6hint="2606:4700:4700::1111,2606:4700:4700::1001" dohpath="/dns-query{?dns}"
; ServiceMode priority 1 on one.one.one.one, protocols h2,h3, DNS over HTTPS
_dns.resolver.arpa. 300 IN SVCB 2 one.one.one.one. alpn="dot" port="853" ipv4hint="1.1.1.1,1.0.0.1" ipv6hint="2606:4700:4700::1111,2606:4700:4700::1001"
; ServiceMode priority 2 on one.one.one.one, protocols dot
A protocol that adopts SVCB defines the owner name, usually with an underscore prefix, and which parameters apply. The most visible use today is encrypted DNS. RFC 9461 maps DNS servers to SVCB at _dns.<resolver name>, with alpn="dot" for DNS over TLS, h2/h3 plus dohpath for DNS over HTTPS, and doq for DNS over QUIC. RFC 9462 (DDR) lets a client ask its plain-text resolver for _dns.resolver.arpa and upgrade to an encrypted one.
Priority 0 is AliasMode and priorities 1 and up are ServiceMode, exactly as in the HTTPS record.
_dns.dns.example.net. 300 IN SVCB 1 dns.example.net. alpn="h2,h3" dohpath="/dns-query{?dns}"
_dns.dns.example.net. 300 IN SVCB 2 dns.example.net. alpn="dot" port=853Wire format: Same as HTTPS: 16-bit priority, target name, then SvcParams in ascending key order.
| Field | Meaning |
|---|---|
| SvcPriority | 0 AliasMode, 1+ ServiceMode (lower preferred). |
| TargetName | Host serving the endpoint; . means the owner name (ServiceMode). |
| alpn | Protocols: dot, doq, h2, h3... |
| dohpath | URI template for DoH (RFC 9461). |
| port, ipv4hint, ipv6hint | Endpoint port and address hints. |