Discover more than an address
01A and AAAA records supply addresses. SVCB and HTTPS records bind service endpoints to connection instructions.
The client obtains A/AAAA for edge.example.net if needed. These addresses locate that endpoint; they do not authenticate example.com.
Key idea: Keep each endpoint’s parameters together.
Terms
- Service binding
- A DNS record associates a service endpoint with that endpoint’s connection parameters.
- Origin
- The scheme, host and port identifying the HTTP service. An alternative endpoint does not replace this identity.
- ALPN
- Application-Layer Protocol Negotiation: protocol identifiers used with transports such as TLS or QUIC.
- RRset
- Resource records with the same owner name, class and type; an unordered set.
Rules & examples
Keep each endpoint’s parameters together.
- SVCB is RR type 64; HTTPS is SVCB-compatible RR type 65 with the same RDATA encoding. HTTP and HTTPS clients MUST NOT use SVCB queries or accept SVCB responses for these schemes (§9).
- For https://example.com on port 443, query example.com for HTTPS. A non-default port uses, for example, _8443._https.example.com. Generic SVCB uses a registered scheme mapping and underscore labels (§§2.3,9.1).
- SvcPriority 0 selects AliasMode; positive values select ServiceMode. Each ServiceMode RR binds one TargetName and its SvcParams. Never combine one record’s port with another record’s target.
- Clients MUST be able to fetch required information absent from the initial reply. Additional-section A/AAAA records can save queries; an unaware resolver does not make the mechanism unusable (§§3,4,5.2).
Fictional names and documentation addresses. This is a bounded connection-discovery illustration, not a DNS server, TLS implementation or full deployment recipe.
Sources
New to this? Start hereA quick picture + helpful background
Read one endpoint’s instruction card
Imagine a service offering several entrances, each with its own instructions. Keep each card intact: an entrance address and its required equipment belong together. DNS service binding works similarly, but the client must still verify the service’s identity when connecting.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.