HTTPS record
An HTTPS record tells browsers how to connect to a website before they connect: which protocols it speaks (such as HTTP/3), which addresses to try, and the key for Encrypted Client Hello. It also works as an alias at the root of a domain. Chrome, Safari and Firefox look it up alongside A and AAAA.
| Record type | HTTPS |
|---|---|
| Type number | 65 |
| Used for | Websites |
| How common | Common |
| Defined in | RFC 9460 |
Format
<name> <ttl> IN HTTPS <priority> <target> [key=value ...]
| Field | What it means | Accepted values |
|---|---|---|
| Priority | 0 means alias mode (like a CNAME that works at the root). 1 or more means service mode; lower is preferred. | 0 to 65535. |
| Target | The host that serves the site. . means this same name. | A host name, or .. |
| alpn | Protocols the server supports, so browsers can start with HTTP/3 straight away. | Comma-separated: h3, h2, http/1.1. |
| ipv4hint, ipv6hint | Addresses to try, saving a lookup. | Comma-separated IP addresses. |
| ech | Encrypted Client Hello settings, which hide the site name from the network. | Base64, generated by your CDN or server. |
| port | A port other than 443. | 0 to 65535. |
Check an HTTPS record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid HTTPS record.
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL300 | Resolvers may keep this answer for 5 minutes before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeHTTPS | Service binding for websites. |
| Priority1 | 1: service mode. Lower numbers are preferred. |
| Target. | A dot means the service runs at this same name. |
| alpnalpn=h3,h2 | Protocols the server speaks: h3 is HTTP/3 (QUIC), h2 is HTTP/2, http/1.1. Lets browsers start with HTTP/3 straight away. |
| ipv4hintipv4hint=192.0.2.10 | IPv4 addresses to try, saving a lookup. A and AAAA records still win if they differ. |
Examples
HTTP/3 advertised
@ 300 IN HTTPS 1 . alpn=h3,h2
Browsers can open the first connection over HTTP/3 instead of discovering it later.
Alias mode at the root
@ 300 IN HTTPS 0 example.cdn.net.
Browsers that support HTTPS records follow this like a CNAME. Keep A and AAAA records too.
Upgrade to https
www 300 IN HTTPS 1 . alpn=h2
Any HTTPS record also tells browsers to use https:// for the name, even if someone types http://.
What it changes
- Faster first visits: browsers learn about HTTP/3 and addresses in the same DNS round trip.
- Automatic https: a browser that sees an HTTPS record upgrades http:// links to https:// for that name.
- Privacy: with ech=, the site's name is encrypted in the TLS handshake.
- Root aliasing: alias mode works at @, where CNAME can't.
Do I need to add one?
If your site is behind a CDN such as Cloudflare, it publishes HTTPS records for you on proxied names. If you run your own server, add one only when it supports what you advertise: an alpn=h3 on a server without HTTP/3 makes browsers try and fall back.
See it on a real domain
TTL
300 to 3600. Keep it no longer than your A and AAAA records, since the hints should match them. How TTL works
Common mistakes
- Advertising h3 on a server that doesn't speak HTTP/3.
- ipv4hint addresses that don't match the A records. Browsers may use the hint, so a stale one sends visitors to the wrong place.
- Adding parameters in alias mode (priority 0). Alias mode takes only a target.
- Removing A and AAAA records in favour of an HTTPS alias. Clients that don't read HTTPS records still need them.
At your DNS host
- Cloudflare: published automatically for proxied names; you can also add your own.
- Route 53 and Google Cloud DNS: available in the record type menu.
- Some registrar DNS panels don't list HTTPS yet; move DNS to a host that does if you need it.
Questions
Is an HTTPS record the same as an SSL certificate?
No. Certificates are still needed and issued as usual. The HTTPS record only tells browsers how to connect: protocols, addresses and Encrypted Client Hello.
Does the HTTPS record replace A and AAAA?
No. Publish it alongside them. Browsers use both; other software only reads A and AAAA.
What's the difference between HTTPS and SVCB?
They're the same format. HTTPS is the version for websites and lives at the site's own name; SVCB is the general version for other protocols, such as DNS-over-HTTPS resolvers.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free