FROM DISCOVERY TO VERIFICATION
HTTPS DNS records and ECH
An HTTPS record describes how to reach an HTTPS service. It can advertise a service target, application protocols and ECH configuration. It is the HTTPS-specific form of a service binding; querying a generic SVCB record is not a substitute for HTTPS discovery.
The ech parameter
The ech parameter carries an ECHConfigList with public configuration for the TLS client. Use the configuration supplied by the operator of your TLS endpoint. An unrelated or stale value cannot make a server accept ECH.
Aliases, priorities and protocols
Priority zero denotes AliasMode: follow its target for discovery and ignore additional parameters on that alias. Positive priorities describe services; lower values are preferred. The alpn parameter advertises application protocols. For HTTPS, HTTP/1.1 remains in the default set unless no-default-alpn disables it. A record advertising h3 alone therefore does not necessarily exclude TCP.
Inspect your published answer
dig example.com HTTPSRun this read-only lookup for your own domain. In an ECHScan report, expand “DNS records & measurement details” to inspect the answers used for that measurement. The report identifies its resolver; another resolver may return different cached answers.
For a missing or rejected configuration, continue with deployment guidance or troubleshooting. A published record still needs a verified handshake.
References: RFC 9460: service bindings and RFC 9848: ECH discovery through DNS.