Read the RDATA bytes
02Two priority octets and an uncompressed DNS name precede sorted key-length-value parameters.
Separate negative example: a second key 3 repeats the first. Strict increase fails, so reject the RRset; do not silently keep a preferred duplicate.
Key idea: Wire key order is strict even when zone-file order is free.
Terms
- Service binding
- A DNS record associates a service endpoint with that endpoint’s connection parameters.
- Origin
- The scheme, host and port identifying the HTTP service. An alternative endpoint does not replace this identity.
- ALPN
- Application-Layer Protocol Negotiation: protocol identifiers used with transports such as TLS or QUIC.
- RRset
- Resource records with the same owner name, class and type; an unordered set.
Rules & examples
Wire key order is strict even when zone-file order is free.
- SvcPriority is a network-order uint16. TargetName is a fully qualified, uncompressed sequence of length-prefixed DNS labels, ending in the root label. The diagram shows RDATA only, not a full DNS message.
- Each SvcParam contains a uint16 numeric key, uint16 value length, and exactly that many value octets. Wire keys SHALL increase strictly; presentation keys MAY appear in any order but MUST NOT repeat (§§2.1–2.2).
- Truncated parameters, non-increasing keys and wrong known value formats are malformed. If any RR is malformed the client MUST reject the entire RRset and fall back to non-SVCB connection establishment (§2.2).
- Key 3 is port, encoded as two network-order octets: 53 is 00 35. The illustration uses the published Appendix D.2 vector; it is a SVCB encoding example, not an instruction for an HTTPS connection to port 53.
Fictional names and documentation addresses. This is a bounded connection-discovery illustration, not a DNS server, TLS implementation or full deployment recipe.
Sources
New to this? Start hereA quick picture + helpful background
Read one endpoint’s instruction card
Imagine a service offering several entrances, each with its own instructions. Keep each card intact: an entrance address and its required equipment belong together. DNS service binding works similarly, but the client must still verify the service’s identity when connecting.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.