RFC 9460 HTTPS & SVCB Record Builder

Inspect and generate RFC 9460 Type 65 HTTPS resource records. Configure HTTP/3 (QUIC) fast-start, Encrypted Client Hello (ECH), ALPN protocols, and zero-latency port 443 upgrades.

Standard Specification RFC 9460 (Type 65) Service Binding for HTTP

Protocol Discovery HTTP/3 (QUIC) ALPN h2 & h3 negotiation

Privacy Shield ECH (Encrypted SNI) Conceals visited hostnames

Apex CNAME Alternative AliasMode (Priority 0) Zone apex redirection

🛠️ RFC 9460 HTTPS Record Generator

Record Operating Mode:

Target Name: Use "." when serving from the same host as the query name.

ALPN Protocols Supported:

Service Port Override:

Generated BIND 9 Zone Record (RFC 9460):

Frequently Asked Questions

What is the purpose of the RFC 9460 HTTPS resource record (Type 65)?

The RFC 9460 HTTPS record allows modern web browsers to discover web server connection parameters during the initial DNS lookup before initiating an HTTP connection. It conveys support for HTTP/3 (QUIC), application-layer protocol negotiation (ALPN), Encrypted Client Hello (ECH) keys, and alternative port bindings in a single round-trip.

How does an HTTPS record eliminate the traditional port 80 to 443 redirect?

Traditionally, when a user types a bare domain, browsers attempt plain HTTP on port 80, receiving a 301/302 redirect to HTTPS on port 443. An HTTPS DNS record signals that the domain supports HTTPS natively, allowing browsers to upgrade immediately to TLS on port 443 without the unencrypted redirect round-trip.

What is AliasMode versus ServiceMode in RFC 9460 records?

In AliasMode (Priority = 0), the HTTPS record behaves like a CNAME at the zone apex without violating DNS CNAME apex restrictions. In ServiceMode (Priority > 0), the record directly advertises service endpoints, ALPN protocols (h2, h3), IPv4/IPv6 hints, and ECH keys.

How does Encrypted Client Hello (ECH) work with HTTPS records?

ECH encrypts the Server Name Indication (SNI) header inside TLS handshakes to protect user browsing privacy from network snoopers. The ECH public keys and cryptographic parameters are delivered directly inside the DNS HTTPS record ech parameter.