Skip to content

Knowledgebase

Understand HTTPS and SVCB records before adding them to a hosting zone

domains-dns, security-ssl

HTTPS and SVCB records can advertise service endpoints and connection parameters to compatible clients. They add information beyond ordinary address records, but do not install a certificate, enable a protocol on the server or replace every client's A/AAAA lookup.

Information to have ready

Obtain the exact record from the hosting or CDN provider that implements the service. Confirm the DNS editor and authoritative provider support the record type and parameter encoding. Keep the current working address and HTTPS configuration available.

01 Review and publish the intended service-binding record

  1. Check the intended owner name and record type. HTTPS is the HTTP-specific form; a generic SVCB record is not automatically used for ordinary website navigation.
  2. Enter the supplied priority and target. Priority 0 denotes AliasMode, whose service parameters are ignored. Nonzero priority denotes ServiceMode with its applicable parameters. Do not combine modes by copying unrelated examples.
  3. For ServiceMode records, add only parameters supported by the real endpoint, such as advertised protocols, a service port or address hints. A DNS statement that HTTP/3 exists does not start an HTTP/3 server.
  4. Preserve the provider's required A/AAAA fallback and certificate configuration. Address hints are not a replacement for a complete, correctly resolvable service.
  5. Query the published HTTPS/SVCB data and test with a compatible client. Compare a client that does not use the record to confirm the intended fallback still works.

Confirm the expected result

Check that the website remains reachable, the certificate validates for the requested origin, and the advertised protocol or alternate endpoint actually operates. Review provider-managed records after a service migration.

Troubleshoot unexpected results

If only newer clients fail, inspect stale or unsupported HTTPS parameters and an alternate endpoint that no longer exists. Restore the previous supported record set while investigating, rather than changing every ordinary address record.

A common question

Can an HTTPS record turn an HTTP-only website into a secure HTTPS service?

No. The destination still needs a working TLS endpoint, the correct certificate and application configuration. The record helps compatible clients discover supported connection details; it cannot supply missing server capabilities by itself.

Sources and further reading

Was this answer helpful?

Need a little more help?

Our support team can help you find the next step.

Contact support