Skip to main content

Configure HTTPS records

Managed DNS supports HTTPS records — a specialized form of the Service Binding (SVCB) DNS record standardized by the IETF. HTTPS records consolidate connection parameters into a single DNS response, reducing the round trips required to establish a secure connection and enabling future protocol upgrades without client-side changes.

HTTPS record

The HTTPS DNS record provides more detailed information than A or AAAA records about the services available for a specific domain. It communicates supported protocols, ports, and alternate servers that clients can use to connect.

This extended information allows a client to fetch all parameters needed for a secure connection in a single DNS query, rather than performing multiple sequential queries. The result is a faster, more secure connection handshake.

HTTPS connection overhead

Even when a client connects directly over HTTPS, establishing a connection involves several additional steps beyond the initial DNS lookup. After resolving the A or AAAA records, the client must negotiate TLS and, in some cases, discover the supported application protocols separately — often via a subsequent DNS query or an Alt-Svc header returned only after the first response. Sites that still redirect HTTP to HTTPS add an extra round trip before any of this begins.

Each additional round trip increases latency. The HTTPS record eliminates most of these extra steps by delivering protocol parameters — ALPN identifiers, IP hints, and port information — as part of the original DNS response.

HTTPS record structure

An HTTPS record for sample-test.com looks like this:

www.sample-test.com. 1800 IN HTTPS 1 . alpn=h3,h3-29,h2 ipv4hint=1.2.3.4,9.8.7.6 ipv6hint=2001:db8:3333:4444:5555:6666:7777:8888,2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF

Each element represents:

  • www.sample-test.com — the domain name
  • 1800 — Time To Live (TTL)
  • IN — the record class
  • HTTPS — the record type
  • 1 — the priority (selection preference when multiple HTTPS records exist for the same name)
  • . — the target host when it is the same as the domain name
  • alpn=h3,h3-29,h2 — the application protocol versions
  • ipv4hint=1.2.3.4,9.8.7.6 — IPv4 addresses (optional)
  • ipv6hint=2001:db8:3333:4444:5555:6666:7777:8888,2001:db8:3333:4444:CCCC:DDDD:EEEE:FFFF — IPv6 addresses (optional)

When a browser requests the HTTPS record, it receives all parameters needed to connect to https://sample-test.com in a single response:

  • The exact protocol configuration and server preferences for the domain.
  • IP addresses of web servers — potentially from multiple CDNs or providers — which also resolves the limitations of records at the domain apex.

Combining all parameters into a single lookup response reduces the additional round trips needed before a connection can begin. When paired with ECN configuration, this can reduce the number of TLS negotiation steps required, while still supporting multi-CDN deployments.

Configure HTTPS records

To add an HTTPS record to a zone, navigate to the zone in the Customer Portal and fill in the record form.

  1. 1

    Open the zone records

    In the CDB Technical Web Portal, navigate to DNS → All zones and click the zone name.

    DNS zones list
  2. 2

    Open the Add record form

    Zone records list with the Add record button
  3. 3

    Configure the HTTPS record

    Fill in the form:

    1. Type: Select HTTPS.
    2. (Optional) Name: Leave empty to create a record for the zone apex. To target a specific subdomain, enter the prefix — www for www.sample-test.com.
    3. (Optional) TTL: Leave empty or enter a value in seconds. For production, 1800 or higher allows recursive resolvers to cache the record effectively.
    4. Priority: Enter a number. Use incrementing values — 1, 10, 20 — when multiple HTTPS records exist for the same name.
    5. TargetName: Enter a valid domain name or leave it as ..
    6. In the Key dropdown, select alpn. The alpn attribute identifies the protocol versions supported by the web server, allowing browsers to negotiate the connection protocol without additional round trips.
    7. In the value field, enter protocol identifiers as a comma-separated list: h3, h2, http/1.1, or h3-29.
    8. (Optional) In the Key dropdown, select ipv4hint or ipv6hint to provide the server's IP addresses directly in the DNS response, eliminating additional lookups.
    9. (Optional) Enter the IP address.
    HTTPS record form with alpn attribute configured
    1. Click Add.

The record now appears in the zone records list:

Zone records list showing the new HTTPS record

Verify the record using kdig (the Knot DNS variant of dig). When using standard dig, confirm the version is current — older versions don't support HTTPS record types. The DNS Lookup tool also confirms correct configuration.

kdig https sample-test.com @ns1.gcorelabs.net

;; ->>HEADER<<\- opcode: QUERY; status: NOERROR; id: 34710
;; Flags: qr aa rd; QUERY: 1; ANSWER: 1; AUTHORITY: 0; ADDITIONAL: 0

;; QUESTION SECTION:
;;sample-test.com. IN HTTPS

;; ANSWER SECTION:
sample-test.com. 1800 IN HTTPS 1 . alpn=h3,h2,http/1.1 ipv4hint=1.2.3.4,9.8.7.6 ipv6hint=2001:db8:3333:4444:5555:6666:7777:8888,2001:db8:3333:4444:cccc:dddd:eeee:ffff