Service binding and parameter specification via the DNS (DNS SVCB and HTTPS RRs)

1.1. Goals of the SVCB RR

The goal of the SVCB RR is to allow clients to resolve a single additional DNS RR in a way that:¶

• Provides alternative endpoints that are authoritative for the service, along with parameters associated with each of these endpoints.¶
• Does not assume that all alternative endpoints have the same parameters or capabilities, or are even operated by the same entity. This is important, as DNS does not provide any way to tie together multiple RRSets for the same name. For example, if www.example.com is a CNAME alias that switches between one of three CDNs or hosting environments, successive queries for that name may return records that correspond to different environments.¶
• Enables CNAME-like functionality at a zone apex (such as "example.com") for participating protocols, and generally enables delegation of operational authority for an origin within the DNS to an alternate name.¶

Additional goals specific to HTTPS RRs and the HTTP use-cases include:¶

• Connect directly to HTTP/3 (QUIC transport) alternative endpoints [HTTP3]¶
• Support non-default TCP and UDP ports¶
• Enable SRV-like benefits (e.g. apex delegation, as mentioned above) for HTTP, where SRV [SRV] has not been widely adopted¶
• Provide an HSTS-like indication [HSTS] signaling that the "https" scheme should be used instead of "http" for all HTTP requests to this host and port (see Section 9.5).¶
• Enable the conveyance of Encrypted ClientHello [ECH] keys associated with an alternative endpoint.¶

1.2. Overview of the SVCB RR

This subsection briefly describes the SVCB RR with forward references to the full exposition of each component. (As mentioned above, this all applies equally to the HTTPS RR which shares the same encoding, format, and high-level semantics.)¶

The SVCB RR has two modes: AliasMode (Section 2.4.2), which aliases a name to another name, and ServiceMode (Section 2.4.3), which provides connection information bound to a service endpoint domain. Placing both forms in a single RR type allows clients to fetch the relevant information with a single query (Section 2.3).¶

The SVCB RR has two required fields and one optional field. The fields are:¶

1. SvcPriority (Section 2.4.1): The priority of this record (relative to others, with lower values preferred). A value of 0 indicates AliasMode.¶
2. TargetName: The domain name of either the alias target (for AliasMode) or the alternative endpoint (for ServiceMode).¶
3. SvcParams (optional): A list of key=value pairs describing the alternative endpoint at TargetName (only used in ServiceMode and otherwise ignored). Described in Section 2.1.¶

Cooperating DNS recursive resolvers will perform subsequent record resolution (for SVCB, A, and AAAA records) and return them in the Additional Section of the response (Section 4.2). Clients either use responses included in the additional section returned by the recursive resolver or perform necessary SVCB, A, and AAAA record resolutions (Section 3). DNS authoritative servers can attach in-bailiwick SVCB, A, AAAA, and CNAME records in the Additional Section to responses for a SVCB query (Section 4.1).¶

In ServiceMode, the SvcParams of the SVCB RR provide an extensible data model for describing alternative endpoints that are authoritative for a service, along with parameters associated with each of these alternative endpoints (Section 7).¶

For HTTP use-cases, the HTTPS RR (Section 9) enables many of the benefits of Alt-Svc [AltSvc] without waiting for a full HTTP connection initiation (multiple roundtrips) before learning of the preferred alternative, and without necessarily revealing the user's intended destination to all entities along the network path.¶

1.3. Terminology

Our terminology is based on the common case where the SVCB record is used to access a resource identified by a URI whose authority field contains a DNS hostname as the host.¶

• The "service" is the information source identified by the authority and scheme of the URI, capable of providing access to the resource. For "https" URIs, the "service" corresponds to an "origin" [RFC6454].¶
• The "service name" is the host portion of the authority.¶
• The "authority endpoint" is the authority's hostname and a port number implied by the scheme or specified in the URI.¶
• An "alternative endpoint" is a hostname, port number, and other associated instructions to the client on how to reach an instance of service.¶

Additional DNS terminology intends to be consistent with [DNSTerm].¶

SVCB is a contraction of "service binding". The SVCB RR, HTTPS RR, and future RR types that share SVCB's formats and registry are collectively known as SVCB-compatible RR types. The contraction "SVCB" is also used to refer to this system as a whole.¶

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.¶

2.1. Zone file presentation format

The presentation format <RDATA> of the record ([RFC1035], Section 5.1) has the form:¶

SvcPriority TargetName SvcParams

The SVCB record is defined specifically within the Internet ("IN") Class ([RFC1035], Section 3.2.4).¶

SvcPriority is a number in the range 0-65535, TargetName is a <domain-name> ([RFC1035], Section 5.1), and the SvcParams are a whitespace-separated list, with each SvcParam consisting of a SvcParamKey=SvcParamValue pair or a standalone SvcParamKey. SvcParamKeys are subject to IANA control (Section 14.3).¶

Each SvcParamKey SHALL appear at most once in the SvcParams. In presentation format, SvcParamKeys are lower-case alphanumeric strings. Key names contain 1-63 characters from the ranges "a"-"z", "0"-"9", and "-". In ABNF [RFC5234],¶

alpha-lc      = %x61-7A   ;  a-z
SvcParamKey   = 1*63(alpha-lc / DIGIT / "-")
SvcParam      = SvcParamKey ["=" SvcParamValue]
SvcParamValue = char-string ; See Appendix A
value         = *OCTET ; Value before key-specific parsing

The SvcParamValue is parsed using the character-string decoding algorithm (Appendix A), producing a value. The value is then validated and converted into wire-format in a manner specific to each key.¶

When the optional "=" and SvcParamValue are omitted, the value is interpreted as empty.¶

Arbitrary keys can be represented using the unknown-key presentation format "keyNNNNN" where NNNNN is the numeric value of the key type without leading zeros. A SvcParam in this form SHALL be parsed as specified above, and the decoded value SHALL be used as its wire format encoding.¶

For some SvcParamKeys, the value corresponds to a list or set of items. Presentation formats for such keys SHOULD use a comma-separated list (Appendix A.1).¶

SvcParams in presentation format MAY appear in any order, but keys MUST NOT be repeated.¶

2.2. RDATA wire format

The RDATA for the SVCB RR consists of:¶

• a 2-octet field for SvcPriority as an integer in network byte order.¶
• the uncompressed, fully-qualified TargetName, represented as a sequence of length-prefixed labels as in Section 3.1 of [RFC1035].¶
• the SvcParams, consuming the remainder of the record (so smaller than 65535 octets and constrained by the RDATA and DNS message sizes).¶

When the list of SvcParams is non-empty, it contains a series of SvcParamKey=SvcParamValue pairs, represented as:¶

• a 2-octet field containing the SvcParamKey as an integer in network byte order. (See Section 14.3.2 for the defined values.)¶
• a 2-octet field containing the length of the SvcParamValue as an integer between 0 and 65535 in network byte order.¶
• an octet string of this length whose contents are the SvcParamValue in a format determined by the SvcParamKey.¶

SvcParamKeys SHALL appear in increasing numeric order.¶

Clients MUST consider an RR malformed if:¶

• the end of the RDATA occurs within a SvcParam.¶
• SvcParamKeys are not in strictly increasing numeric order.¶
• the SvcParamValue for an SvcParamKey does not have the expected format.¶

Note that the second condition implies that there are no duplicate SvcParamKeys.¶

If any RRs are malformed, the client MUST reject the entire RRSet and fall back to non-SVCB connection establishment.¶

2.3. SVCB query names

When querying the SVCB RR, a service is translated into a QNAME by prepending the service name with a label indicating the scheme, prefixed with an underscore, resulting in a domain name like "_examplescheme.api.example.com.". This follows the Attrleaf naming pattern [Attrleaf], so the scheme MUST be registered appropriately with IANA (see Section 11).¶

Protocol mapping documents MAY specify additional underscore-prefixed labels to be prepended. For schemes that specify a port (Section 3.2.3 of [URI]), one reasonable possibility is to prepend the indicated port number if a non-default port number is specified. We term this behavior "Port Prefix Naming", and use it in the examples throughout this document.¶

See Section 9.1 for the HTTPS RR behavior.¶

When a prior CNAME or SVCB record has aliased to a SVCB record, each RR SHALL be returned under its own owner name, as in ordinary CNAME processing ([RFC1034], Section 3.6.2). For details, see the recommendations regarding aliases for clients (Section 3), servers (Section 4), and zones (Section 10).¶

Note that none of these forms alter the origin or authority for validation purposes. For example, TLS clients MUST continue to validate TLS certificates for the original service name.¶

As an example, the owner of example.com could publish this record:¶

_8443._foo.api.example.com. 7200 IN SVCB 0 svc4.example.net.

to indicate that "foo://api.example.com:8443" is aliased to "svc4.example.net". The owner of example.net, in turn, could publish this record:¶

svc4.example.net.  7200  IN SVCB 3 svc4.example.net. (
    alpn="bar" port="8004" )

to indicate that these services are served on port number 8004, which supports the protocol "bar" and its associated transport in addition to the default transport protocol for "foo://".¶

(Parentheses are used to ignore a line break in DNS zone file presentation format ([RFC1035], Section 5.1).)¶

2.4. Interpretation

_8080._foo.example.com. 3600 IN SVCB 0 foosvc.example.net.

example.com. 3600 IN HTTPS 0 svc.example.net.

2.5. Special handling of "." in TargetName

If TargetName has the value "." (represented in the wire format as a zero-length label), special rules apply.¶

example.com.      7200  IN HTTPS 0 svc.example.net.
svc.example.net.  7200  IN CNAME svc2.example.net.
svc2.example.net. 7200  IN HTTPS 1 . port=8002
svc2.example.net. 300   IN A     192.0.2.2
svc2.example.net. 300   IN AAAA  2001:db8::2

3.1. Handling resolution failures

If DNS responses are cryptographically protected (e.g. using DNSSEC or TLS [DoT][DoH]), and SVCB resolution fails due to an authentication error, SERVFAIL response, transport error, or timeout, the client SHOULD abandon its attempt to reach the service, even if the client is SVCB-optional. Otherwise, an active attacker could mount a downgrade attack by denying the user access to the SvcParams.¶

A SERVFAIL error can occur if the domain is DNSSEC-signed, the recursive resolver is DNSSEC-validating, and the attacker is between the recursive resolver and the authoritative DNS server. A transport error or timeout can occur if an active attacker between the client and the recursive resolver is selectively dropping SVCB queries or responses, based on their size or other observable patterns.¶

If the client enforces DNSSEC validation on A/AAAA responses, it SHOULD apply the same validation policy to SVCB. Otherwise, an attacker could defeat the A/AAAA protection by forging SVCB responses that direct the client to other IP addresses.¶

If DNS responses are not cryptographically protected, clients MAY treat SVCB resolution failure as fatal or nonfatal.¶

If the client is unable to complete SVCB resolution due to its chain length limit, the client MUST fall back to the authority endpoint, as if the origin's SVCB record did not exist.¶

3.2. Clients using a Proxy

Clients using a domain-oriented transport proxy like HTTP CONNECT ([RFC7231], Section 4.3.6) or SOCKS5 ([RFC1928]) have the option to use named destinations, in which case the client does not perform any A or AAAA queries for destination domains. If the client is configured to use named destinations with a proxy that does not provide SVCB query capability (e.g. through an affiliated DNS resolver), the client would have to perform SVCB resolution separately, likely disclosing the destinations to additional parties than just the proxy. Clients in this configuration SHOULD arrange for a separate SVCB resolution procedure with appropriate privacy properties. If this is not possible, SVCB-optional clients MUST disable SVCB resolution entirely, and SVCB-reliant clients MUST treat the configuration as invalid.¶

If the client does use SVCB and named destinations, the client SHOULD follow the standard SVCB resolution process, selecting the smallest-SvcPriority option that is compatible with the client and the proxy. When connecting using a SVCB record, clients MUST provide the final TargetName and port to the proxy, which will perform any required A and AAAA lookups.¶

This arrangement has several benefits:¶

• Compared to disabling SVCB:¶

  • It allows the client to use the SvcParams, if present, which are only usable with a specific TargetName. The SvcParams may include information that enhances performance (e.g. alpn) and privacy.¶
  • It allows the service to delegate the apex domain.¶

• Compared to providing the proxy with an IP address:¶

  • It allows the proxy to select between IPv4 and IPv6 addresses for the server according to its configuration.¶
  • It ensures that the proxy receives addresses based on its network geolocation, not the client's.¶
  • It enables faster fallback for TCP destinations with multiple addresses of the same family.¶

4.1. Authoritative servers

When replying to a SVCB query, authoritative DNS servers SHOULD return A, AAAA, and SVCB records in the Additional Section for any TargetNames that are in the zone. If the zone is signed, the server SHOULD also include positive or negative DNSSEC responses for these records in the Additional section.¶

See Section 4.4 for exceptions.¶

4.2. Recursive resolvers

Whether the recursive resolver is aware of SVCB or not, the normal response construction process (i.e. unknown RR type resolution under [RFC3597]) generates the Answer section of the response. Recursive resolvers that are aware of SVCB SHOULD help the client to execute the procedure in Section 3 with minimum overall latency by incorporating additional useful information into the Additional section of the response as follows:¶

1. Incorporate the results of SVCB resolution. If the recursive resolver's local chain length limit (which may be different from the client's limit) has been reached, terminate.¶

2. If any of the resolved SVCB records are in AliasMode, choose one of them at random, and resolve SVCB, A, and AAAA records for its TargetName.¶

   • If any SVCB records are resolved, go to step 1.¶
   • Otherwise, incorporate the results of A and AAAA resolution, and terminate.¶
3. All the resolved SVCB records are in ServiceMode. Resolve A and AAAA queries for each TargetName (or for the owner name if TargetName is "."), incorporate all the results, and terminate.¶

In this procedure, "resolve" means the resolver's ordinary recursive resolution procedure, as if processing a query for that RRSet. This includes following any aliases that the resolver would ordinarily follow (e.g. CNAME, DNAME [DNAME]). Errors or anomalies in obtaining additional records MAY cause this process to terminate, but MUST NOT themselves cause the resolver to send a failure response.¶

See Section 2.4.2 for additional safeguards for recursive resolvers to implement to mitigate loops.¶

See Section 5.2 for possible optimizations of this procedure.¶

4.3. General requirements

Recursive resolvers MUST be able to convey SVCB records with unrecognized SvcParamKeys, and MAY treat the entire SvcParams portion of the record as opaque, even if the contents are invalid. Alternatively, recursive resolvers MAY report an error such as SERVFAIL to avoid returning a SvcParamValue that is invalid according to the SvcParam's specification. For complex value types whose interpretation might differ between implementations or have additional future allowed values added (e.g. URIs or "alpn"), resolvers SHOULD limit validation to specified constraints.¶

When responding to a query that includes the DNSSEC OK bit ([RFC3225]), DNSSEC-capable recursive and authoritative DNS servers MUST accompany each RRSet in the Additional section with the same DNSSEC-related records that they would send when providing that RRSet as an Answer (e.g. RRSIG, NSEC, NSEC3).¶

According to Section 5.4.1 of [RFC2181], "Unauthenticated RRs received and cached from ... the additional data section ... should not be cached in such a way that they would ever be returned as answers to a received query. They may be returned as additional information where appropriate.". Recursive resolvers therefore MAY cache records from the Additional section for use in populating Additional section responses, and MAY cache them for general use if they are authenticated by DNSSEC.¶

4.4. EDNS Client Subnet (ECS)

The EDNS Client Subnet option (ECS, [RFC7871]) allows recursive resolvers to request IP addresses that are suitable for a particular client IP range. SVCB records may contain IP addresses (in ipv*hint SvcParams), or direct users to a subnet-specific TargetName, so recursive resolvers SHOULD include the same ECS option in SVCB queries as in A/AAAA queries.¶

According to Section 7.3.1 of [RFC7871], "Any records from [the Additional section] MUST NOT be tied to a network". Accordingly, when processing a response whose QTYPE is SVCB-compatible, resolvers SHOULD treat any records in the Additional section as having SOURCE PREFIX-LENGTH zero and SCOPE PREFIX-LENGTH as specified in the ECS option. Authoritative servers MUST omit such records if they are not suitable for use by any stub resolvers that set SOURCE PREFIX-LENGTH to zero. This will cause the resolver to perform a follow-up query that can receive properly tailored ECS. (This is similar to the usage of CNAME with ECS discussed in [RFC7871], Section 7.2.1.)¶

Authoritative servers that omit Additional records can avoid the added latency of a follow-up query by following the advice in Section 10.2.¶

5.1. Optimistic pre-connection and connection reuse

If an address response arrives before the corresponding SVCB response, the client MAY initiate a connection as if the SVCB query returned NODATA, but MUST NOT transmit any information that could be altered by the SVCB response until it arrives. For example, future SvcParamKeys could be defined that alter the TLS ClientHello.¶

Clients implementing this optimization SHOULD wait for 50 milliseconds before starting optimistic pre-connection, as per the guidance in [HappyEyeballsV2].¶

A SVCB record is consistent with a connection if the client would attempt an equivalent connection when making use of that record. If a SVCB record is consistent with an active or in-progress connection C, the client MAY prefer that record and use C as its connection. For example, suppose the client receives this SVCB RRSet for a protocol that uses TLS over TCP:¶

_1234._bar.example.com. 300 IN SVCB 1 svc1.example.net. (
    ipv6hint=2001:db8::1 port=1234 )
                               SVCB 2 svc2.example.net. (
    ipv6hint=2001:db8::2 port=1234 )

If the client has an in-progress TCP connection to [2001:db8::2]:1234, it MAY proceed with TLS on that connection, even though the other record in the RRSet has higher priority.¶

If none of the SVCB records are consistent with any active or in-progress connection, clients proceed with connection establishment as described in Section 3.¶

5.2. Generating and using incomplete responses

When following the procedure in Section 4.2, recursive resolvers MAY terminate the procedure early and produce a reply that omits some of the associated RRSets. This is REQUIRED when the chain length limit is reached (Section 4.2 step 1), but might also be appropriate when the maximum response size is reached, or when responding before fully chasing dependencies would improve performance. When omitting certain RRSets, recursive resolvers SHOULD prioritize information for smaller-SvcPriority records.¶

As discussed in Section 3, clients MUST be able to fetch additional information that is required to use a SVCB record, if it is not included in the initial response. As a performance optimization, if some of the SVCB records in the response can be used without requiring additional DNS queries, the client MAY prefer those records, regardless of their priorities.¶

7.1. "alpn" and "no-default-alpn"

The "alpn" and "no-default-alpn" SvcParamKeys together indicate the set of Application Layer Protocol Negotiation (ALPN) protocol identifiers [ALPN] and associated transport protocols supported by this service endpoint (the "SVCB ALPN set").¶

As with Alt-Svc [AltSvc], each ALPN protocol identifier is used to identify the application protocol and associated suite of protocols supported by the endpoint (the "protocol suite"). The presence of an ALPN protocol identifier in the SVCB ALPN set indicates that this service endpoint, described by TargetName and the other parameters (e.g. "port") offers service with the protocol suite associated with this ALPN identifier.¶

Clients filter the set of ALPN identifiers to match the protocol suites they support, and this informs the underlying transport protocol used (such as QUIC-over-UDP or TLS-over-TCP). ALPN protocol identifiers that do not uniquely identify a protocol suite (e.g. an Identification Sequence that can be used with both TLS and DTLS) are not compatible with this SvcParamKey and MUST NOT be included in the SVCB ALPN set.¶

alpn-id = 1*255OCTET

7.2. "port"

The "port" SvcParamKey defines the TCP or UDP port that should be used to reach this alternative endpoint. If this key is not present, clients SHALL use the authority endpoint's port number.¶

The presentation value of the SvcParamValue is a single decimal integer between 0 and 65535 in ASCII. Any other value (e.g. an empty value) is a syntax error. To enable simpler parsing, this SvcParam MUST NOT contain escape sequences.¶

The wire format of the SvcParamValue is the corresponding 2 octet numeric value in network byte order.¶

If a port-restricting firewall is in place between some client and the service endpoint, changing the port number might cause that client to lose access to the service, so operators should exercise caution when using this SvcParamKey to specify a non-default port.¶

7.3. "ipv4hint" and "ipv6hint"

The "ipv4hint" and "ipv6hint" keys convey IP addresses that clients MAY use to reach the service. If A and AAAA records for TargetName are locally available, the client SHOULD ignore these hints. Otherwise, clients SHOULD perform A and/or AAAA queries for TargetName as in Section 3, and clients SHOULD use the IP address in those responses for future connections. Clients MAY opt to terminate any connections using the addresses in hints and instead switch to the addresses in response to the TargetName query. Failure to use A and/or AAAA response addresses could negatively impact load balancing or other geo-aware features and thereby degrade client performance.¶

The presentation value SHALL be a comma-separated list (Appendix A.1) of one or more IP addresses of the appropriate family in standard textual format [RFC5952][RFC4001]. To enable simpler parsing, this SvcParamValue MUST NOT contain escape sequences.¶

The wire format for each parameter is a sequence of IP addresses in network byte order (for the respective address-family). Like an A or AAAA RRSet, the list of addresses represents an unordered collection, and clients SHOULD pick addresses to use in a random order. An empty list of addresses is invalid.¶

When selecting between IPv4 and IPv6 addresses to use, clients may use an approach such as Happy Eyeballs [HappyEyeballsV2]. When only "ipv4hint" is present, NAT64 clients may synthesize IPv6 addresses as specified in [RFC7050] or ignore the "ipv4hint" key and wait for AAAA resolution (Section 3). For best performance, server operators SHOULD include an "ipv6hint" parameter whenever they include an "ipv4hint" parameter.¶

These parameters are intended to minimize additional connection latency when a recursive resolver is not compliant with the requirements in Section 4, and SHOULD NOT be included if most clients are using compliant recursive resolvers. When TargetName is the origin hostname or the owner name (which can be written as "."), server operators SHOULD NOT include these hints, because they are unlikely to convey any performance benefit.¶

7.4. "mandatory"

See Section 8.¶

9.1. Query names for HTTPS RRs

The HTTPS RR uses Port Prefix Naming (Section 2.3), with one modification: if the scheme is "https" and the port is 443, then the client's original QNAME is equal to the service name (i.e. the origin's hostname), without any prefix labels.¶

By removing the Attrleaf labels [Attrleaf] used in SVCB, this construction enables offline DNSSEC signing of wildcard domains, which are commonly used with HTTP. Using the service name as the owner name of the HTTPS record, without prefixes, also allows the targets of existing CNAME chains (e.g. CDN hosts) to start returning HTTPS RR responses without requiring origin domains to configure and maintain an additional delegation.¶

Following of HTTPS AliasMode RRs and CNAME aliases is unchanged from SVCB.¶

Clients always convert "http" URLs to "https" before performing an HTTPS RR query using the process described in Section 9.5, so domain owners MUST NOT publish HTTPS RRs with a prefix of "_http".¶

Note that none of these forms alter the HTTPS origin or authority. For example, clients MUST continue to validate TLS certificate hostnames based on the origin.¶

9.2. Comparison with Alt-Svc

Publishing a ServiceMode HTTPS RR in DNS is intended to be similar to transmitting an Alt-Svc field value over HTTP, and receiving an HTTPS RR is intended to be similar to receiving that field value over HTTP. However, there are some differences in the intended client and server behavior.¶

9.3. Interaction with Alt-Svc

Clients that implement support for both Alt-Svc and HTTPS records and are making a connection based on a cached Alt-Svc response SHOULD retrieve any HTTPS records for the Alt-Svc alt-authority, and ensure that their connection attempts are consistent with both the Alt-Svc parameters and any received HTTPS SvcParams. If present, the HTTPS record's TargetName and port are used for connection establishment (as in Section 3). For example, suppose that "https://example.com" sends an Alt-Svc field value of:¶

Alt-Svc: h2="alt.example:443", h2="alt2.example:443", h3=":8443"

The client would retrieve the following HTTPS records:¶

alt.example.              IN HTTPS 1 . alpn=h2,h3 foo=...
alt2.example.             IN HTTPS 1 alt2b.example. alpn=h3 foo=...
_8443._https.example.com. IN HTTPS 1 alt3.example. (
    port=9443 alpn=h2,h3 foo=... )

Based on these inputs, the following connection attempts would always be allowed:¶

• HTTP/2 to alt.example:443¶
• HTTP/3 to alt3.example:9443¶
• Fallback to the client's non-Alt-Svc connection behavior¶

The following connection attempts would not be allowed:¶

• HTTP/3 to alt.example:443 (not consistent with Alt-Svc)¶
• Any connection to alt2b.example (no ALPN consistent with both the HTTPS record and Alt-Svc)¶
• HTTPS over TCP to any port on alt3.example (not consistent with Alt-Svc)¶

Suppose that "foo" is a SvcParamKey that renders the client SVCB-reliant. The following Alt-Svc-only connection attempts would be allowed only if the client does not support "foo", as they rely on SVCB-optional fallback behavior:¶

• HTTP/2 to alt2.example:443¶
• HTTP/3 to example.com:8443¶

Alt-authorities SHOULD carry the same SvcParams as the origin unless a deviation is specifically known to be safe. As noted in Section 2.4 of [AltSvc], clients MAY disallow any Alt-Svc connection according to their own criteria, e.g. disallowing Alt-Svc connections that lack support for privacy features that are available on the origin endpoint.¶

9.4. Requiring Server Name Indication

Clients MUST NOT use an HTTPS RR response unless the client supports TLS Server Name Indication (SNI) and indicates the origin name in the TLS ClientHello (which might be encrypted via a future specification such as ECH). This supports the conservation of IP addresses.¶

Note that the TLS SNI (and also the HTTP "Host" or ":authority") will indicate the origin, not the TargetName.¶

9.5. HTTP Strict Transport Security

An HTTPS RR directs the client to communicate with this host only over a secure transport, similar to HTTP Strict Transport Security [HSTS]. Prior to making an "http" scheme request, the client SHOULD perform a lookup to determine if any HTTPS RRs exist for that origin. To do so, the client SHOULD construct a corresponding "https" URL as follows:¶

1. Replace the "http" scheme with "https".¶
2. If the "http" URL explicitly specifies port 80, specify port 443.¶
3. Do not alter any other aspect of the URL.¶

This construction is equivalent to Section 8.3 of [HSTS], point 5.¶

If an HTTPS RR query for this "https" URL returns any AliasMode HTTPS RRs, or any compatible ServiceMode HTTPS RRs (see Section 8), the client SHOULD behave as if it has received an HTTP 307 (Temporary Redirect) status code with this "https" URL in the "Location" field. (Receipt of an incompatible ServiceMode RR does not trigger the redirect behavior.) Because HTTPS RRs are received over an often-insecure channel (DNS), clients MUST NOT place any more trust in this signal than if they had received a 307 (Temporary Redirect) response over cleartext HTTP.¶

Publishing an HTTPS RR has the potential to have unexpected results or a loss in functionality in cases where the "http" resource neither redirects to the "https" resource nor references the same underlying resource.¶

When an "https" connection fails due to an error in the underlying secure transport, such as an error in certificate validation, some clients currently offer a "user recourse" that allows the user to bypass the security error and connect anyway. When making an "https" scheme request to an origin with an HTTPS RR, either directly or via the above redirect, such a client MAY remove the user recourse option. Origins that publish HTTPS RRs therefore MUST NOT rely on user recourse for access. For more information, see Section 8.4 and Section 12.1 of [HSTS].¶

9.6. Use of HTTPS RRs in other protocols

All HTTP connections to named origins are eligible to use HTTPS RRs, even when HTTP is used as part of another protocol or without an explicit HTTP URL. For example, clients that support HTTPS RRs and implement the altered WebSocket [WebSocket] opening handshake from the W3C Fetch specification [FETCH] SHOULD use HTTPS RRs for the requestURL.¶

When HTTP is used in a context where URLs or redirects are not applicable (e.g. connections to an HTTP proxy), clients that find a corresponding HTTPS RR SHOULD implement a security upgrade behavior equivalent to the one specified in Section 9.5.¶

Such protocols MAY define their own SVCB mappings, which MAY be defined to take precedence over HTTPS RRs.¶

10.1. Structuring zones for flexibility

Each ServiceMode RRSet can only serve a single scheme. The scheme is indicated by the owner name and the RR type. For the generic SVCB RR type, this means that each owner name can only be used for a single scheme. The underscore prefixing requirement (Section 2.3) ensures that this is true for the initial query, but it is the responsibility of zone owners to choose names that satisfy this constraint when using aliases, including CNAME and AliasMode records.¶

When using the generic SVCB RR type with aliasing, zone owners SHOULD choose alias target names that indicate the scheme in use (e.g. foosvc.example.net for foo:// schemes). This will help to avoid confusion when another scheme needs to be added to the configuration. When multiple port numbers are in use, it may be helpful to repeat the prefix labels in the alias target name (e.g. _1234._foo.svc.example.net).¶

10.2. Structuring zones for performance

To avoid a delay for clients using a nonconforming recursive resolver, domain owners SHOULD minimize the use of AliasMode records, and SHOULD choose TargetName according to a predictable convention that is known to the client, so that clients can issue A and/or AAAA queries for TargetName in advance (see Section 5). Unless otherwise specified, the convention is to set TargetName to the service name for an initial ServiceMode record, or to "." if it is reached via an alias.¶

$ORIGIN example.com. ; Origin
foo                  3600 IN CNAME foosvc.example.net.
_8080._foo.foo       3600 IN CNAME foosvc.example.net.
bar                   300 IN AAAA 2001:db8::2
_9090._bar.bar       3600 IN SVCB 1 bar key65444=...

$ORIGIN example.net. ; Service provider zone
foosvc               3600 IN SVCB 1 . key65333=...
foosvc                300 IN AAAA 2001:db8::1

Domain owners SHOULD avoid using a TargetName that is below a DNAME, as this is likely unnecessary and makes responses slower and larger. Also, zone structures that require following more than 8 aliases (counting both AliasMode and CNAME records) are NOT RECOMMENDED.¶

10.3. Operational considerations

Note that some implementations may not allow A or AAAA records on names starting with an underscore due to various interpretations of RFCs. This could be an operational issue when the TargetName contains an attrleaf label, as well as using an TargetName of "." when the owner name contains an attrleaf label.¶

10.4. Examples

$ORIGIN simple.example. ; Simple example zone
@ 300 IN A    192.0.2.1
         AAAA 2001:db8::1

@ 7200 IN HTTPS 1 . alpn=h3

_8443._https 7200 IN HTTPS 1 . alpn=h3

$ORIGIN aliased.example. ; A zone that is using a hosting service
; Subdomain aliased to a high-performance server pool
www             7200 IN CNAME pool.svc.example.
; Apex domain on fixed IPs because CNAME is not allowed at the apex
@                300 IN A     192.0.2.1
                     IN AAAA  2001:db8::1

@               7200 IN HTTPS 0 pool.svc.example.

$ORIGIN svc.example. ; A hosting provider.
pool  7200 IN HTTPS 1 . alpn=h2,h3
              HTTPS 2 backup alpn=h2 port=8443
pool   300 IN A        192.0.2.2
              AAAA     2001:db8::2
backup 300 IN A        192.0.2.3
              AAAA     2001:db8::3

 ; This zone contains/returns different CNAME records
 ; at different points-in-time.  The RRset for "www" can
 ; only ever contain a single CNAME.

 ; Sometimes the zone has:
 $ORIGIN customer.example.  ; A Multi-CDN customer domain
 www 900 IN CNAME cdn1.svc1.example.

 ; and other times it contains:
 $ORIGIN customer.example.
 www 900 IN CNAME customer.svc2.example.

 ; and yet other times it contains:
 $ORIGIN customer.example.
 www 900 IN CNAME cdn3.svc3.example.

 ; With the following remaining constant and always included:
 $ORIGIN customer.example.  ; A Multi-CDN customer domain
 ; The apex is also aliased to www to match its configuration
 @     7200 IN HTTPS 0 www
 ; Non-HTTPS-aware clients use non-CDN IPs
               A    203.0.113.82
               AAAA 2001:db8:203::2

 ; Resolutions following the cdn1.svc1.example
 ; path use these records.
 ; This CDN uses a different alternative service for HTTP/3.
 $ORIGIN svc1.example.  ; domain for CDN 1
 cdn1     1800 IN HTTPS 1 h3pool alpn=h3
                  HTTPS 2 . alpn=h2
                  A    192.0.2.2
                  AAAA 2001:db8:192::4
 h3pool 300 IN A 192.0.2.3
            AAAA 2001:db8:192:7::3

 ; Resolutions following the customer.svc2.example
 ; path use these records.
 ; Note that this CDN only supports HTTP/2.
 $ORIGIN svc2.example. ; domain operated by CDN 2
 customer 300 IN HTTPS 1 . alpn=h2
           60 IN A    198.51.100.2
                 A    198.51.100.3
                 A    198.51.100.4
                 AAAA 2001:db8:198::7
                 AAAA 2001:db8:198::12

 ; Resolutions following the cdn3.svc3.example
 ; path use these records.
 ; Note that this CDN has no HTTPS records.
 $ORIGIN svc3.example. ; domain operated by CDN 3
 cdn3      60 IN A    203.0.113.8
                 AAAA 2001:db8:113::8

_8765._baz.api.example.com. 7200 IN SVCB 0 svc4-baz.example.net.

14.1. SVCB RRType

This document defines a new DNS RR type, SVCB, whose value 64 has been allocated by IANA from the "Resource Record (RR) TYPEs" registry on the "Domain Name System (DNS) Parameters" page:¶

• Type: SVCB¶
• Value: 64¶
• Meaning: General Purpose Service Binding¶
• Reference: This document¶

14.2. HTTPS RRType

This document defines a new DNS RR type, "HTTPS", whose value 65 has been allocated by IANA from the "Resource Record (RR) TYPEs" registry on the "Domain Name System (DNS) Parameters" page:¶

• Type: HTTPS¶
• Value: 65¶
• Meaning: Service Binding type for use with HTTP¶
• Reference: This document¶

14.3. New registry for Service Parameters

IANA is requested to create a new registry, entitled "Service Parameter Keys (SvcParamKeys)". This registry defines the namespace for parameters, including string representations and numeric SvcParamKey values. This registry is shared with other SVCB-compatible RR types, such as the HTTPS RR.¶

ACTION: create this registry, on a new page entitled "DNS Service Bindings (SVCB)" under the "Domain Name System (DNS) Parameters" category.¶

14.4. Other registry updates

Per [Attrleaf], please add the following entry to the DNS Underscore Global Scoped Entry Registry:¶

A.1. Decoding a comma-separated list

In order to represent lists of items in zone files, this specification uses comma-separated lists. When the allowed items in the list cannot contain "," or "\", this is trivial. (For simplicity, empty items are not allowed.) A value-list parser that splits on "," and prohibits items containing "\" is sufficient to comply with all requirements in this document. This corresponds to the simple-comma-separated syntax:¶

; item-allowed is OCTET minus "," and "\".
item-allowed           = %x00-2B / %x2D-5B / %x5D-FF
simple-item            = 1*item-allowed
simple-comma-separated = [simple-item *("," simple-item)]

For implementations that allow "," and "\" in item values, the following escaping syntax applies:¶

item            = 1*OCTET
escaped-item    = 1*(item-allowed / "\," / "\\")
comma-separated = [escaped-item *("," escaped-item)]

Decoding of value-lists happens after character-string decoding. For example, consider these char-string SvcParamValues:¶

"part1,part2,part3\\,part4\\\\"
part1\,\p\a\r\t2\044part3\092,part4\092\\

These inputs are equivalent: character-string decoding either of them would produce the same value:¶

part1,part2,part3\,part4\\

Applying comma-separated list decoding to this value would produce a list of three items:¶

part1
part2
part3,part4\

C.1. Differences from the SRV RR type

An SRV record [SRV] can perform a similar function to the SVCB record, informing a client to look in a different location for a service. However, there are several differences:¶

• SRV records are typically mandatory, whereas SVCB is intended to be optional when used with pre-existing protocols.¶
• SRV records cannot instruct the client to switch or upgrade protocols, whereas SVCB can signal such an upgrade (e.g. to HTTP/2).¶
• SRV records are not extensible, whereas SVCB and HTTPS RRs can be extended with new parameters.¶
• SRV records specify a "weight" for unbalanced randomized load-balancing. SVCB only supports balanced randomized load-balancing, although weights could be added via a future SvcParam.¶

C.2. Differences from the proposed HTTP record

Unlike [I-D.bellis-dnsop-http-record], this approach is extensible to cover Alt-Svc and Encrypted ClientHello use-cases. Like that proposal, this addresses the zone apex CNAME challenge.¶

Like that proposal, it remains necessary to continue to include address records at the zone apex for legacy clients.¶

C.3. Differences from the proposed ANAME record

Unlike [I-D.ietf-dnsop-aname], this approach is extensible to cover Alt-Svc and ECH use-cases. This approach also does not require any changes or special handling on either authoritative or primary servers, beyond optionally returning in-bailiwick additional records.¶

Like that proposal, this addresses the zone apex CNAME challenge for clients that implement this.¶

However, with this SVCB proposal, it remains necessary to continue to include address records at the zone apex for legacy clients. If deployment of this standard is successful, the number of legacy clients will fall over time. As the number of legacy clients declines, the operational effort required to serve these users without the benefit of SVCB indirection should fall. Server operators can easily observe how much traffic reaches this legacy endpoint, and may remove the apex's address records if the observed legacy traffic has fallen to negligible levels.¶

C.4. Comparison with separate RR types for AliasMode and ServiceMode

Abstractly, functions of AliasMode and ServiceMode are independent, so it might be tempting to specify them as separate RR types. However, this would result in a serious performance impairment, because clients cannot rely on their recursive resolver to follow SVCB aliases (unlike CNAME). Thus, clients would have to issue queries for both RR types in parallel, potentially at each step of the alias chain. Recursive resolvers that implement the specification would, upon receipt of a ServiceMode query, emit both a ServiceMode and an AliasMode query to the authoritative. Thus, splitting the RR type would double, or in some cases triple, the load on clients and servers, and would not reduce implementation complexity.¶

D.1. AliasMode

example.com.   HTTPS   0 foo.example.com.

\# 19 (
00 00                                              ; priority
03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 ; target
)

\x00\x00                                           # priority
\x03foo\x07example\x03com\x00                      # target

D.2. ServiceMode

example.com.   SVCB   1 .

\# 3 (
00 01      ; priority
00         ; target (root label)
)

\x00\x01   # priority
\x00       # target, root label

example.com.   SVCB   16 foo.example.com. port=53

\# 25 (
00 10                                              ; priority
03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 ; target
00 03                                              ; key 3
00 02                                              ; length 2
00 35                                              ; value
)

\x00\x10                                           # priority
\x03foo\x07example\x03com\x00                      # target
\x00\x03                                           # key 3
\x00\x02                                           # length: 2 bytes
\x00\x35                                           # value

example.com.   SVCB   1 foo.example.com. key667=hello

\# 28 (
00 01                                              ; priority
03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 ; target
02 9b                                              ; key 667
00 05                                              ; length 5
68 65 6c 6c 6f                                     ; value
)

\x00\x01                                           # priority
\x03foo\x07example\x03com\x00                      # target
\x02\x9b                                           # key 667
\x00\x05                                           # length 5
hello                                              # value

example.com.   SVCB   1 foo.example.com. key667="hello\210qoo"

\# 32 (
00 01                                              ; priority
03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 ; target
02 9b                                              ; key 667
00 09                                              ; length 9
68 65 6c 6c 6f d2 71 6f 6f                         ; value
)

\x00\x01                                           # priority
\x03foo\x07example\x03com\x00                      # target
\x02\x9b                                           # key 667
\x00\x09                                           # length 9
hello\xd2qoo                                       # value

example.com.   SVCB   1 foo.example.com. (
                      ipv6hint="2001:db8::1,2001:db8::53:1"
                      )

\# 55 (
00 01                                              ; priority
03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 63 6f 6d 00 ; target
00 06                                              ; key 6
00 20                                              ; length 32
20 01 0d b8 00 00 00 00 00 00 00 00 00 00 00 01    ; first address
20 01 0d b8 00 00 00 00 00 00 00 00 00 53 00 01    ; second address
)

\x00\x01                                           # priority
\x03foo\x07example\x03com\x00                      # target
\x00\x06                                           # key 6
\x00\x20                                           # length 32
\x20\x01\x0d\xb8\x00\x00\x00\x00
     \x00\x00\x00\x00\x00\x00\x00\x01              # first address
\x20\x01\x0d\xb8\x00\x00\x00\x00
     \x00\x00\x00\x00\x00\x53\x00\x01              # second address

example.com.   SVCB   1 example.com. ipv6hint="2001:db8:122:344::192.0.2.33"

\# 35 (
00 01                                              ; priority
07 65 78 61 6d 70 6c 65 03 63 6f 6d 00             ; target
00 06                                              ; key 6
00 10                                              ; length 16
20 01 0d b8 01 22 03 44 00 00 00 00 c0 00 02 21    ; address
)

\x00\x01                                           # priority
\x07example\x03com\x00                             # target
\x00\x06                                           # key 6
\x00\x10                                           # length 16
\x20\x01\x0d\xb8\x01\x22\x03\x44
     \x00\x00\x00\x00\xc0\x00\x02\x21              # address

example.com.   SVCB   16 foo.example.org. (
                      alpn=h2,h3-19 mandatory=ipv4hint,alpn
                      ipv4hint=192.0.2.1
                      )

\# 48 (
00 10                                              ; priority
03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 6f 72 67 00 ; target
00 00                                              ; key 0
00 04                                              ; param length 4
00 01                                              ; value: key 1
00 04                                              ; value: key 4
00 01                                              ; key 1
00 09                                              ; param length 9
02                                                 ; alpn length 2
68 32                                              ; alpn value
05                                                 ; alpn length 5
68 33 2d 31 39                                     ; alpn value
00 04                                              ; key 4
00 04                                              ; param length 4
c0 00 02 01                                        ; param value
)

\x00\x10                                           # priority
\x03foo\x07example\x03org\x00                      # target
\x00\x00                                           # key 0
\x00\x04                                           # param length 4
\x00\x01                                           # value: key 1
\x00\x04                                           # value: key 4
\x00\x01                                           # key 1
\x00\x09                                           # param length 9
\x02                                               # alpn length 2
h2                                                 # alpn value
\x05                                               # alpn length 5
h3-19                                              # alpn value
\x00\x04                                           # key 4
\x00\x04                                           # param length 4
\xc0\x00\x02\x01                                   # param value

example.com.   SVCB   16 foo.example.org. alpn="f\\\\oo\\,bar,h2"
example.com.   SVCB   16 foo.example.org. alpn=f\\\092oo\092,bar,h2

\# 35 (
00 10                                              ; priority
03 66 6f 6f 07 65 78 61 6d 70 6c 65 03 6f 72 67 00 ; target
00 01                                              ; key 1
00 0c                                              ; param length 12
08                                                 ; alpn length 8
66 5c 6f 6f 2c 62 61 72                            ; alpn value
02                                                 ; alpn length 2
68 32                                              ; alpn value
)

\x00\x10                                           # priority
\x03foo\x07example\x03org\x00                      # target
\x00\x01                                           # key 1
\x00\x0c                                           # param length 12
\x08                                               # alpn length 8
f\oo,bar                                           # alpn value
\x02                                               # alpn length 2
h2                                                 # alpn value

D.3. Failure cases

This subsection contains test vectors which are not compliant with this document. The various reasons for non-compliance are explained with each example.¶

example.com.   SVCB   1 foo.example.com. (
                       key123=abc key123=def
                       )

example.com.   SVCB   1 foo.example.com. mandatory
example.com.   SVCB   1 foo.example.com. alpn
example.com.   SVCB   1 foo.example.com. port
example.com.   SVCB   1 foo.example.com. ipv4hint
example.com.   SVCB   1 foo.example.com. ipv6hint

example.com.   SVCB   1 foo.example.com. no-default-alpn=abc

example.com.   SVCB   1 foo.example.com. mandatory=key123

example.com.   SVCB   1 foo.example.com. mandatory=mandatory

example.com.   SVCB   1 foo.example.com. (
                      mandatory=key123,key123 key123=abc
                      )