HTTPS DNS Record Support

calendar Aug 8, 2024 · 9 min read · dns https svcb dns https https rr rfc9460  ·
Share on: linkedin copy

The HTTPS DNS record has delivered a capability in DNS that a surprisingly large cohort of domain owners/operators have desired for many years. I should know, I wrote about it 2 years ago and that post remains the most viewed on my site, getting more than 10x the views of any other article each week.

I could wallow in my failure to write any other content of mass appeal, or I could give the people what they want and write an update. And so here is my sellout to populism. As much as an obscure record in a little understood protocol can be considered a topic of broad interest.

A Quick Recap

HTTPS records are used in 1 of 2 modes

  1. Service Mode: This mode will provide a consumer details of the endpoint they wish to connect to. For example the record might indicate that the webserver supports the QUIC protocol. There can be more than one Service Mode record for the same domain name.
  2. Alias Mode: This mode allows a domain owner to indicate that the domain a consumer has just looked up, has its webhost managed by another organisation. There should not be more than one Alias Mode record for a domain name nor should there be a Service Mode record. Alias Mode does not supply additional details regarding the endpoint, unlike Service Mode.

If you want a deeper understanding of how to set things up, check out my initial article on the HTTPS DNS record. I've also written up a HTTPS record use case post that may help you visualise each mode and how they interact.

What do we want?

The most in-demand capability, based on my continuing unscientific method of measuring the vibe 🧘‍♂️, is Alias Mode. Most people visiting this site or commenting on technical threads want Alias Mode support. Effective support for Encrypted Client Hello (ECH) is a close second when it comes to interest. These two features together, probably represent the bulk of the discussions around the HTTPS record. So until complete support for both of these features is delivered, there'll be questions and complaints to vendors.

Browsers

Most of you reading this article are here for the current state of browser support for the HTTPS record. As of writing, the story isn't very good. Not very much has changed and the likelihood of near term improvements are low in my opinion.

Native DNS

I first saw HTTPS record support in browsers only when DNS over HTTPS (DoH) was configured. The documented reasoning behind this seemed a bit strange, with developers not wanting to trust a user's local DNS. On reflection I suspect that for all browsers DoH DNS resolution code is more recent than the bulk of their networking code. So it stands to reason that introducing a new capability was easiest in the newest code. DoH also allowed the capability to be isolated to a smaller set of use cases. Recently there have been discussions amongst browsers to add HTTPS support to regular DNS resolution or 'Native DNS'. Where possible, I'll note whether a browser has added native DNS support for HTTPS records or if it is imminent.

SvcParams, IP Hints, Port and ECH

Service Mode records tell clients about protocol support at endpoints and include useful information in establishing a connection to those endpoints. SvcParams will be very useful to clients in identifying an appropriate endpoint to connect to. The IP Hints component of a Service Mode record is not strictly required and browser vendors can ignore this data without impacting interoperability, so I suspect most will. When ECH is widely deployed (it isnt today) this component of a Service Mode record will be critical in establishing a fully private connection to the endpoint.

Safari

Let's start with the good news first. Safari appears to offer full support for both Service Mode and Alias Mode and this is not restricted to DoH usage. I have not found when the functionality was added, but it was at least early 2022 and probably much earlier than that. If you know contact me and I'll update this post.

CapabilitySupport Notes
Service ModeSupports SvcParams. Have not tested individual params. Multiple Service Mode records and TargetName supported
Alias ModeFull support
Native DNSFull support

Chromium

Chromium has had some progress in adding support for the HTTPS record, but misunderstandings of the protocol and some odd judgment calls mean that the result is poor. It is important to remember that developers of browsers may not correctly perceive the intended uses cases for DNS protocol enhancements. Better descriptions of what a correct implementation of HTTPS support looks like, may help in this regard.

CapabilitySupport Notes
Service ModePartial support, possibly broken. It appears that Service Priority and returning multiple Service Mode records may not behave as expected in the RFC1,2. IP Hints not supported
Alias ModeNo support. There is an open feature request3, but little progress in more than a year.
Native DNSApparently full support. I couldn't find a release note, but tcpdump shows HTTPS queries to the OS configured resolver. Also used prior to connecting to a configured DoH server.

The feature request for Alias mode support also mentions supporting TargetName for Service Mode. The TargetName of a Service Mode record allows you to offer clients different endpoints, depending on the client's support for the protocols offered. The absence of current support for TargetName in Service Mode appears to be backed up by comments in another thread I saw. It is important to realise that without that support, the usage envisaged in the RFC whereby multiple Service Mode records are present and the client chooses the endpoint that supports its desired capabilities, would not work.

Firefox

CapabilitySupport Notes
Service ModePartial support. Does not support TargetNames. No reference to IP hints. ECH supported4
Alias ModeInvalid support. Appear to be expecting service params in an Alias Mode response5.
Native DNSApparently full support, released only 2 days ago6 at time of writing

An early patch to Firefox added some experimental Alias support7, but this is not applicable to the HTTPS record as documented in the RFC. Looking at the code8 does suggest that the bulk of the experiment was conducted using the DoH feature. There appears to be a tracking9 site for the HTTPSSVC draft RFC. That draft was later merged into the SVCB RFC which includes the HTTPS record. This means early use cases would need to be updated and validated again. I don't see a complete representation of the relevant functionality for the modern HTTPS record on that site. It is of course possible and likely that there are other issues covering additional uses cases, which I haven't found yet.

Webservers

Webservers should support the protocols that are expected to be placed in Service Mode records. While this isn't HTTPS support per se, it strikes me that there's little point in using HTTPS records or adding support for them in software if webservers only support ye olde https connections. Here's a list of protocols or protocol enhancements that Service Mode records can inform clients about, in order to maximise the security of a connection to a supporting webserver.

  • h2 (HTTP2) should be supported by all modern webservers.
  • h3 (HTTP3 over QUIC) not common. Webservers can be patched to support.
  • ech (Encrypted Client Hello) no mainstream support amongst webservers.

CDN/Webhosting Providers

Large CDN and webhosting organisations typically write their own or heavily customise their webserver code. So it's worth looking at them seperate to webserver software. I'm not bothering to evaluate HTTP2 support. If someone doesn't support it, I won't have them on this list. Since it is common (although not mandatory) to host DNS with these providers, I've listed whether their DNS hosting supports the HTTPS record.

ProviderDNS RecordH3ECH
CloudflareYesYesYes
AWS Cloudfront (inc Route 53)YesYesNo
Azure CDN (inc Azure DNS)NoYesNo
Akamai (inc Edge DNS)YesYesNo

For the table above, I reviewed each provider's product and developer documentation. So if the capability wasn't documented, it's a No in the table. If I learn that a provider does in fact support a capability, or they add it, I'll be sure to update this page.

Update 31st Oct 2024 AWS added support10 for the HTTPS record for zones hosted in Route 53. The record supports setting an ech value with a clear example in the UI. However there is no indication that CloudFront supports ECH.

How new is the SVCB/HTTPS Standard?

While reviewing support for the HTTPS (SVCB) record I noticed a common refrain from some vendors. Since the RFC was so new, how could they be expected to have deployed any code to support it? The draft was in flux right up until it was published as an RFC.

Well that isn't entirely correct. My first blog on HTTPS was just under 2 years before the draft was approved. That post and its complimentary code had several working examples showing the implementation of the record. I have not had to update a single example as a result of the draft changes in the intervening period. I got a little lucky at the timing of my post. Several blogs that I reviewed as part of my research were a little out of date. But that hardly indicates a protocol so unstable as to warrant avoiding it until it was too late.

This also applies to security vendors who drag their feet deploying support in their tools to avoid needlessly blocking legitimate traffic.

Conclusion

I'd been meaning to write an update to my original post for some time now. Initially I waited until the draft became a formal RFC, but as noted above, that shouldn't be the gatekeeping mechanism many organisations make it out to be. Since then, I've been waiting for the browser developers to finally introduce the full functionality of the record. Unfortunately very little has changed.

🤝 Thank you to several readers who took the time to contact me, either to ask questions or simply to express their appreciation for my initial article on HTTPS records. This update is largely because of your requests. I'll keep this post updated when significant capabilities are introduced, especially for browsers. But I may miss smaller updates.

As always Mastadon is the place to contact me. And when I promise to write an article, I will do so eventually - after a very long wait. 🙃

References

A simple guide to the HTTPS DNS record

The below post was written alongside this one.

HTTPS DNS use cases

Additional References

Below are my references used when researching this post. If I update this article with additional information, references will also be added here.

While not directly referenced in the article I found the discussion here quite useful: https://github.com/Fyrd/caniuse/issues/6091

  1. https://source.chromium.org/chromium/chromium/src/+/main:net/dns/dns_response_result_extractor.cc;l=522;drc=fb1fc1cd6cf3201fe93d866038a4aa9846db4981 ↩︎

  2. https://issues.chromium.org/issues/40937306#comment16 ↩︎

  3. https://issues.chromium.org/issues/40257146 ↩︎

  4. https://www.mozilla.org/en-US/firefox/119.0/releasenotes/ ↩︎

  5. https://bugzilla.mozilla.org/show_bug.cgi?id=1869075 ↩︎

  6. https://www.mozilla.org/en-US/firefox/129.0/releasenotes/ ↩︎

  7. https://bugzilla.mozilla.org/show_bug.cgi?id=1641222 ↩︎

  8. https://hg.mozilla.org/mozilla-central/rev/083212102e96 ↩︎

  9. https://bugzilla.mozilla.org/show_bug.cgi?id=1634793 ↩︎

  10. https://aws.amazon.com/blogs/networking-and-content-delivery/improving-security-and-performance-with-additional-dns-resource-record-types-in-amazon-route-53/ ↩︎