# HTTPS record An HTTPS record tells browsers how to connect to a website before they connect: which protocols it speaks (such as HTTP/3), which addresses to try, and the key for Encrypted Client Hello. It also works as an alias at the root of a domain. Chrome, Safari and Firefox look it up alongside A and AAAA. - Record type: HTTPS - Type number: 65 - Used for: Websites - How common: Common - Defined in: RFC 9460 ## Format ``` IN HTTPS [key=value ...] ``` | Field | What it means | Accepted values | | --- | --- | --- | | Priority | 0 means alias mode (like a CNAME that works at the root). 1 or more means service mode; lower is preferred. | 0 to 65535. | | Target | The host that serves the site. `.` means this same name. | A host name, or `.`. | | alpn | Protocols the server supports, so browsers can start with HTTP/3 straight away. | Comma-separated: `h3`, `h2`, `http/1.1`. | | ipv4hint, ipv6hint | Addresses to try, saving a lookup. | Comma-separated IP addresses. | | ech | Encrypted Client Hello settings, which hide the site name from the network. | Base64, generated by your CDN or server. | | port | A port other than 443. | 0 to 65535. | ## Examples ### HTTP/3 advertised ``` @ 300 IN HTTPS 1 . alpn=h3,h2 ``` Browsers can open the first connection over HTTP/3 instead of discovering it later. ### Alias mode at the root ``` @ 300 IN HTTPS 0 example.cdn.net. ``` Browsers that support HTTPS records follow this like a CNAME. Keep A and AAAA records too. ### Upgrade to https ``` www 300 IN HTTPS 1 . alpn=h2 ``` Any HTTPS record also tells browsers to use https:// for the name, even if someone types http://. ## What it changes - Faster first visits: browsers learn about HTTP/3 and addresses in the same DNS round trip. - Automatic https: a browser that sees an HTTPS record upgrades http:// links to https:// for that name. - Privacy: with ech=, the site's name is encrypted in the TLS handshake. - Root aliasing: alias mode works at @, where CNAME can't. ## Do I need to add one? If your site is behind a CDN such as Cloudflare, it publishes HTTPS records for you on proxied names. If you run your own server, add one only when it supports what you advertise: an alpn=h3 on a server without HTTP/3 makes browsers try and fall back. ## TTL 300 to 3600. Keep it no longer than your A and AAAA records, since the hints should match them. ## Common mistakes - Advertising h3 on a server that doesn't speak HTTP/3. - ipv4hint addresses that don't match the A records. Browsers may use the hint, so a stale one sends visitors to the wrong place. - Adding parameters in alias mode (priority 0). Alias mode takes only a target. - Removing A and AAAA records in favour of an HTTPS alias. Clients that don't read HTTPS records still need them. ## At your DNS host - Cloudflare: published automatically for proxied names; you can also add your own. - Route 53 and Google Cloud DNS: available in the record type menu. - Some registrar DNS panels don't list HTTPS yet; move DNS to a host that does if you need it. ## Questions ### Is an HTTPS record the same as an SSL certificate? No. Certificates are still needed and issued as usual. The HTTPS record only tells browsers how to connect: protocols, addresses and Encrypted Client Hello. ### Does the HTTPS record replace A and AAAA? No. Publish it alongside them. Browsers use both; other software only reads A and AAAA. ### What's the difference between HTTPS and SVCB? They're the same format. HTTPS is the version for websites and lives at the site's own name; SVCB is the general version for other protocols, such as DNS-over-HTTPS resolvers. ## Related - [SVCB record](https://lemon.domains/dns-records/svcb.md) - [A record](https://lemon.domains/dns-records/a.md) - [AAAA record](https://lemon.domains/dns-records/aaaa.md) - [ALIAS and ANAME records](https://lemon.domains/dns-records/alias.md) - [CAA record](https://lemon.domains/dns-records/caa.md) Interactive version with a record checker and live lookup: https://lemon.domains/dns-records/https