Why Your HTTPS DNS Record Is the Secret Weapon Your Website Is Missing

The HTTP/3 Discovery Problem Nobody Talks About

Here's a scenario playing out on millions of websites right now: A visitor types your domain into their browser. The browser resolves the DNS, opens a TCP connection, completes a TLS handshake, sends an HTTP request... and only then learns "hey, I also support HTTP/3!" The very protocol that would have made everything faster? It arrives too late.

This isn't a browser limitation—it's a fundamental architectural constraint. The traditional way to advertise HTTP/3 support is through the Alt-Svc HTTP header, which can only reach clients after they've already established a connection. By then, you've already committed to HTTP/1.1 or HTTP/2.

Enter the HTTPS DNS Record (RFC 9460)

Here's where things get interesting. The HTTPS resource record, standardized in November 2023, does something remarkable: it lets you announce HTTP/3 support before the browser opens any connection at all.

When a client performs DNS resolution—which it was going to do anyway—it can simultaneously learn:

• Which ALPN protocols you support (h3, h2, http/1.1)
• Your ECH (Encrypted Client Hello) public keys
• IP address hints to start connecting immediately

This means the very first connection to your site can use QUIC and HTTP/3. No wasted handshake. No round trip spent discovering a protocol you could have used from the start.

Why This Matters More Than You Think

Think about every first-time visitor to your site. They don't have a cached connection. They haven't learned about your HTTP/3 support from previous visits. They're starting cold, and with the old Alt-Svc approach, they're paying a latency penalty just to discover what you support.

With an HTTPS record, that discovery happens during the DNS lookup they're already performing. The protocol negotiation happens before connection establishment, not after.

But Wait, There's More: Encrypted Client Hello

The HTTPS record solves another critical problem that HTTP headers simply cannot touch. Encrypted Client Hello (ECH) encrypts the TLS ClientHello itself, including the SNI server name. This prevents network observers from seeing which specific site you're visiting.

Here's the catch: you need the ECH public key before you send the first ClientHello. But there's no connection yet to receive that key through. This is a chicken-and-egg problem that only an out-of-band channel can solve—and the HTTPS DNS record is that channel.

HTTP headers will never be able to deliver ECH. The DNS can.

Publishing Your HTTPS Record

Curious what this looks like? Here's a complete ServiceMode HTTPS record:

example.com.  3600  IN  HTTPS  1  .  alpn="h3,h2"  ipv4hint=203.0.113.10  ipv6hint=2001:db8::10

Breaking this down:

• example.com. — Your domain (fully qualified with the trailing dot)
• 3600 — TTL in seconds (how long resolvers can cache this)
• HTTPS — The record type
• 1 — Priority of 1 or higher means ServiceMode (carries parameters)
• . — Target host; a dot means "use the owner name itself"
• alpn="h3,h2" — Supported protocols, best first
• ipv4hint / ipv6hint — Address hints for early connection start

At NameOcean, we're making it increasingly straightforward to manage these records alongside your other DNS configuration. It's one more signal that shows we're paying attention to where web performance is heading.

What About Old Clients?

Publishing an HTTPS record is strictly additive. Clients that don't understand it simply ignore it and fall back to ordinary A/AAAA lookups. They might miss out on HTTP/3 optimization, but nothing breaks.

This means you can publish your HTTPS record today without worrying about compatibility. It's a progressive enhancement—modern browsers read it, older ones don't notice it.

Should You Remove Your Alt-Svc Header?

No. Keep sending it.

Think of the Alt-Svc header as a fallback for anything that doesn't receive your HTTPS record: legacy browsers, certain resolver configurations, or networks that filter DNS responses. With both in place, you're covered from every angle:

• Modern browsers + HTTPS-aware resolvers → Discover HTTP/3 from DNS, connect immediately with QUIC
• Older clients or filtered DNS → Fall back to Alt-Svc header after initial connection
• Subsequent visits → Even better; HTTP/3 connections can resume with 0-RTT, putting the first request on the wire with no handshake at all

The Bottom Line

The HTTPS DNS record is one of those rare optimizations that costs almost nothing to implement but can meaningfully improve connection performance for every new visitor to your site. It's a small configuration change that puts HTTP/3 discovery exactly where it needs to be: before the first byte is sent, not after.

If you're running a CDN, check whether they're already publishing this for you—Cloudflare does it automatically for proxied zones. If you're managing your own DNS, adding an HTTPS record is a fifteen-minute task that your visitors will appreciate on every cold connection.

The web is moving toward HTTP/3. Make sure your DNS is along for the ride.

Ready to optimize your DNS configuration? At NameOcean, we provide the tools and guidance to keep your infrastructure on the cutting edge. Your visitors' first connections don't have to wait.