HTTPS Record Lookup
Check HTTPS resource records (RFC 9460) including ALPN, port, and ECH config. Free DNS checker.
What is an HTTPS record?
An HTTPS record (RFC 9460) is the modern DNS record for telling clients how to reach a service over HTTPS. It can advertise ALPN protocols (h2, h3, http/1.1), an alternate port, and — increasingly important — Encrypted Client Hello (ECH) public keys. Browsers like Chrome and Firefox use HTTPS records to upgrade to HTTP/3 and enable ECH automatically.
Why HTTPS records matter
- Enables HTTP/3 + QUIC discovery without an Alt-Svc header round-trip
- Carries ECH config so browsers can encrypt the SNI
- Replaces older mechanisms like ALIAS/ANAME for service-binding at the apex
Reading the results
An HTTPS record value has the form priority target params. Priority 0 is special ("AliasMode") — the record points at another name. Non-zero priority ("ServiceMode") includes parameters like alpn="h3,h2", port=8443, or ech=... (Encrypted Client Hello config).
Common errors and pitfalls
- HTTPS record exists but browser doesn't use HTTP/3 — make sure the
alpnparameter actually advertises h3, and the server actually speaks QUIC on the right port. - ECH not working — Encrypted Client Hello requires both an
ech=parameter and DNSSEC validation. Without DNSSEC, browsers fall back to plain SNI. - Wire-format resolvers return raw bytes — some DoH resolvers don't parse HTTPS records yet. WhereIsDNS shows hex output in that case; cross-check with a JSON-capable resolver (Cloudflare, Google) for a readable answer.
FAQ
Is HTTPS the same as the SVCB record?
HTTPS is a subtype of SVCB (RFC 9460) specifically for HTTPS-style services. Same wire format, different type codes. Most CDNs auto-publish HTTPS records once you enable HTTP/3.
Do I need to publish an HTTPS record?
No, but you should if you serve HTTPS over HTTP/3 or want to enable ECH. CDNs like Cloudflare publish them automatically.
What's AliasMode (priority 0)?
An HTTPS record with priority 0 acts like an apex CNAME — it points at another hostname whose HTTPS records the client should use. Resolves the long-standing "no CNAME at apex" pain point for service-binding.
Background reading
See the DNS Records Explained guide for context on modern service-binding records.
All record-type lookups
WhereIsDNS has dedicated pages for each common DNS record type. Each one defaults the tool to that record type and includes background on what the record means and what to look for.
- A Record Lookup — IPv4 addresses for a hostname
- AAAA Record Lookup — IPv6 addresses for a hostname
- CNAME Lookup — Aliases pointing one hostname to another
- MX Record Lookup — Mail servers for a domain (with priorities)
- NS Record Lookup — Authoritative nameservers for a domain
- TXT Record Lookup — SPF, DKIM, DMARC, and other text records
- SOA Record Lookup — Authority metadata for a DNS zone
- CAA Record Lookup — Which CAs may issue certs for the domain
- SRV Record Lookup — Service location records (SIP, XMPP, _autodiscover, etc.)
- DNSKEY Record Lookup — DNSSEC public keys for a zone
- DS Record Lookup — DNSSEC delegation signer at the parent zone
- SVCB Record Lookup — Generic service binding (RFC 9460)
- PTR (Reverse DNS) Lookup — Reverse DNS — IP back to a hostname
- Home (defaults to A records)