{"id":15671,"date":"2026-11-06T08:05:00","date_gmt":"2026-11-06T07:05:00","guid":{"rendered":"https:\/\/www.lukaswojcik.com\/blog\/?p=15671"},"modified":"2026-10-26T13:14:30","modified_gmt":"2026-10-26T12:14:30","slug":"https-records-in-dns-how-http-3-discovery-works","status":"publish","type":"post","link":"https:\/\/www.lukaswojcik.com\/blog\/en\/web-development\/tutorials-en-web-development\/https-records-in-dns-how-http-3-discovery-works\/","title":{"rendered":"HTTPS Records in DNS: How HTTP\/3 Discovery Works"},"content":{"rendered":"

HTTP\/3 carries HTTP over QUIC, which uses UDP. A client can try QUIC directly without a prior advertisement. Success still depends on the endpoint and network path. Failure may be immediate or become apparent only when a time limit expires.<\/p>\n

Two information sources help with selection: Alt-Svc<\/code> names an alternative service in an HTTP response; an HTTPS DNS record can provide connection parameters before the first HTTP request. Both advertise possibilities, without guaranteeing a reachable or faster connection.<\/p>\n

\"Two
Client support, endpoint and network path determine actual use.<\/figcaption><\/figure>\n

Alt-Svc can help during the same page view<\/h2>\n

Alt-Svc: h3=\":443\"; ma=86400<\/code> advertises an equivalent HTTP\/3 service on UDP port 443 at the same host. ma<\/code> gives the freshness lifetime for new connection attempts in seconds. Use of the alternative is optional; certificate validation for the original host still applies.<\/p>\n

Without a previous cache entry or another information source, the header is often first received over HTTP\/1.1 or HTTP\/2. After reading it, a supporting client can establish an additional QUIC connection. This does not require another website visit: further resources on the same page may already benefit. The original TCP connection need not close first.<\/p>\n

What an HTTPS record adds<\/h2>\n

The HTTPS DNS type has number 65 and belongs to the SVCB framework. For an ordinary HTTPS URL on port 443, the lookup uses the hostname. A ServiceMode record describes a potential endpoint: the server name, port and supported application protocols such as HTTP\/3. These protocols are identified by ALPN names. AliasMode instead points to another name whose records need further resolution.<\/p>\n

alpn=\"h3,h2\"<\/code> advertises HTTP\/3 and HTTP\/2. A compatible client can therefore try the first HTTP request over QUIC. Selection, parallel connection attempts, cache state and network conditions determine the actual sequence. A DNS record does not enable HTTP\/3 on the server.<\/p>\n

ipv4hint<\/code> and ipv6hint<\/code> supply address hints for an early connection attempt. Available A\/AAAA answers take precedence; otherwise the corresponding lookups should still take place. Hints therefore do not generally replace address resolution.<\/p>\n

The ech<\/code> parameter can carry an ECH configuration list containing a public key and additional information. With supporting clients and servers, ECH protects the inner TLS server name and other fields. A DNS advertisement does not prove successful ECH use. Plaintext DNS queries or visible destination addresses can still reveal information, and ECH configuration can also be supplied through other mechanisms.<\/p>\n

Historical results from 20 domains<\/h2>\n

The saved tool results from 5 September 2026<\/strong> were reanalysed during this revision. The following table describes that historical run, not a current provider measurement or representative market share.<\/p>\n
Historical observation<\/th>Domains<\/th><\/tr><\/thead>
Any HTTPS record<\/td>3<\/td><\/tr>
HTTPS record with h3<\/td>2<\/td><\/tr>
Alt-Svc advertising h3<\/td>7<\/td><\/tr>
Both HTTP\/3 advertisements<\/td>2<\/td><\/tr>
Alt-Svc h3 only<\/td>5<\/td><\/tr>
HTTPS h3 only<\/td>0<\/td><\/tr><\/tbody><\/table>\n

The two domains advertising h3<\/code> in HTTPS records also had a corresponding Alt-Svc header. This was not true of every HTTPS record: the third listed only h2<\/code> and had no Alt-Svc header. Seven versus two gives a factor of 3.5 for observed HTTP\/3 advertisements<\/em>; seven versus all three HTTPS records would be only about 2.3.<\/p>\n

Five Alt-Svc advertisements had ma<\/code> values of 86,400 seconds; two used 2,592,000 seconds. No ech<\/code> parameter was recognised in the processed DNS results. This did not measure negotiated ECH connections, and the DNS processing limitations also matter.<\/p>\n

A single error does not establish the cause<\/h2>\n

The historical h2-only record belonged to stackoverflow.com<\/code>. Its forced HTTP\/3 test ended after 63 milliseconds with \u201cQUIC connection has been shut down\u201d. That does not establish behaviour at every endpoint or the operator’s intention. A valid HTTPS record without h3<\/code> is nevertheless not a configuration error in itself.<\/p>\n

Two advertised services timed out while other HTTP\/3 connections succeeded in the same run. That establishes basic QUIC capability in the measuring setup, but does not explain every failure. For google.com, connection and TLS times were recorded before the request expired without receiving a response. A timeout therefore does not always mean UDP was blocked.<\/p>\n

A useful failure report identifies the URL, tested endpoint, IP family, client version, measurement time and location. One failed attempt from one location does not prove a worldwide outage.<\/p>\n

TTL and ma govern different caches<\/h2>\n

The TTL limits how long a DNS answer may normally be reused from a cache. The recursive DNS answers contained TTL values of 20 and 21,474 seconds for the two h3 records. Such values may show remaining cache lifetime. They do not reliably establish the original configured TTL, or prove a deliberate choice of maximum flexibility or minimum resolver load.<\/p>\n

A short configured TTL eases changes but may increase query load. Longer values complicate rapid corrections. DNS serve-stale also permits expired data under certain failure conditions. A TTL is therefore not a global switchover guarantee. Likewise, ma<\/code> is a defined freshness limit for new alternative connections, not merely a suggestion; existing connections need not close at expiry.<\/p>\n

Separate checks for advertisement and reachability<\/h2>\n

The examples use a placeholder. The first request displays response headers from a GET request, followed by a DNS lookup. The last command requires a curl build with HTTP\/3 support; curl --version<\/code> lists available capabilities.<\/p>\n

Shell<\/span>