Follow aliases within one service
03AliasMode delegates service discovery. It does not alias every record type at the name.
Separate record: example.com. HTTPS 0 . advises that the service is unavailable. It is not a mandatory permanent denial; a client MAY ignore it.
Key idea: Follow the same RR type; interpret dot in its mode.
Terms
- Service binding
- A DNS record associates a service endpoint with that endpoint’s connection parameters.
- Origin
- The scheme, host and port identifying the HTTP service. An alternative endpoint does not replace this identity.
- ALPN
- Application-Layer Protocol Negotiation: protocol identifiers used with transports such as TLS or QUIC.
- RRset
- Resource records with the same owner name, class and type; an unordered set.
Rules & examples
Follow the same RR type; interpret dot in its mode.
- An AliasMode RR has priority 0. Recipients MUST ignore its SvcParams. If any AliasMode record appears in an RRset, recipients MUST ignore ServiceMode records in that set (§2.4).
- Follow an HTTPS alias with another HTTPS query, without re-adding prefixes. AliasMode only affects that RR type and service; unrelated A/AAAA and MX lookups do not become aliases. Follow CNAMEs normally (§§2.4.2,3,6).
- Implementations MUST impose a nonzero alias-chain limit. Reaching that limit MUST fall back to the authority endpoint. An alias target SHOULD NOT equal its owner (§§2.4.2,3.1).
- In ServiceMode, TargetName dot MUST mean the record’s effective owner name, including a synthesized wildcard owner. In AliasMode, dot is an advisory unavailable-service indication that clients MAY ignore (§2.5).
Fictional names and documentation addresses. This is a bounded connection-discovery illustration, not a DNS server, TLS implementation or full deployment recipe.
Sources
New to this? Start hereA quick picture + helpful background
Read one endpoint’s instruction card
Imagine a service offering several entrances, each with its own instructions. Keep each card intact: an entrance address and its required equipment belong together. DNS service binding works similarly, but the client must still verify the service’s identity when connecting.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.