---
title: "Creating HTTPS Record"
canonical: "https://docs.infoblox.com/space/BloxOneDDI/186369522/Creating%20HTTPS%20Record"
format: markdown
---
An HTTPS record is a DNS resource record type defined in RFC 9460 that lets HTTP clients discover an origin's connection parameters in a single DNS lookup. The HTTPS record is a specialized form of the SVCB record, dedicated to HTTP origins.

HTTPS records allow administrators to advertise capabilities such as supported application protocols (for example, HTTP/2 and HTTP/3), alternate HTTPS ports, IPv4 and IPv6 address hints, and Encrypted Client Hello (ECH) configuration. Publishing this information in DNS lets browsers and other HTTP clients connect over the most efficient and most secure transport on the first attempt, without additional negotiation round trips.

HTTPS records operate in two modes:

- AliasMode (priority 0): the record points to another service name. Unlike a CNAME, an HTTPS AliasMode record is permitted at the zone apex, which makes it useful for domains such as www.example.com that need to alias to a CDN or load balancer.
- ServiceMode (priority greater than 0): the record provides a target name and a set of SvcParams that describe how to connect to the origin.

### Supported SvcParam Keys

SvcParams are only used in ServiceMode (priority greater than 0). Each SvcParam is a key-value pair. The following keys are supported:

| Key | Value | Description |
| --- | --- | --- |
| `alpn` | Comma-separated protocol identifiers (e.g., `h2,h3`) | Supported application-layer protocols. At least one protocol identifier is required. |
| `port` | An integer from 0 to 65535 (e.g., `8443`) | An alternate port for the service. |
| `ipv4hint` | Comma-separated IPv4 addresses (e.g., `192.0.2.1,192.0.2.2`) | IPv4 address hints to reduce additional DNS lookups. |
| `ipv6hint` | Comma-separated IPv6 addresses (e.g., `2001:db8::1,2001:db8::2`) | IPv6 address hints to reduce additional DNS lookups. |
| `ech` | Base64-encoded value | Encrypted Client Hello configuration. |
| `dohpath` | Relative URI template (e.g., `/dns-query{?dns}`) | DNS-over-HTTPS path template. Must start with `/` and contain the `{?dns}`variable. |
| `ohttp` | *(no value)* | Indicates Oblivious HTTP support. This key must have an empty value. |

For private or experimental use, generic keys in the form `keyNNNNN` are also accepted (e.g., `key65400`). The IANA private-use range is 65280–65534. It is recommended to use keys within this range to avoid conflicts with current or future IANA-registered keys.

## Before You Begin

- You must have permission to create resource records in the target authoritative zone.
- The authoritative zone in which you are creating the record must already exist.
- Identify the application protocols (alpn values) supported by your origin server, such as h2 for HTTP/2 or h3 for HTTP/3.
- To advertise Encrypted Client Hello (ECH), obtain the ECH configuration value from your TLS termination service or CDN.
- To improve first-connection performance, determine the IPv4 and IPv6 addresses you want to publish as hints.

To create an HTTPS Record, complete the following:

1. From the Infoblox Portal, click **Network > DNS  > Zones**.
2. Click the DNS view.
3. Click the zone.
4. Click **Create **>** Record **and select **HTTPS Record **from the drop-down list.

       On the *Create HTTPS Record* page, specify the following and click **Save & Close**:

> Macro (excerpt)
> 
> - **Name**: The owner name (FQDN) of the HTTPS origin, such as www.example.com . HTTPS records can also be published at the zone apex (for example, www.example.com ), which is not possible with a CNAME.
> - **Select Zone**: Select an associated zone from the column selector.
> - **Priority (SvcPriority)**: A numeric value from 0 through 65535 that defines the record mode. A value of 0 indicates AliasMode, where the record points to another service name. Any non-zero value indicates ServiceMode, where the record provides connection parameters. Lower non-zero values indicate higher precedence.
> - **Target Name**: The FQDN of the target endpoint. In AliasMode, this is the alias target. In ServiceMode, you can specify "." to reference the owner name itself.
> - **SvcParams**: A list of key-value parameters that describe how to connect to the HTTPS origin. Common keys include alpn (supported application protocols, such as h2 for HTTP/2 or h3 for HTTP/3), port (alternate HTTPS port), ipv4hint and ipv6hint (address hints to reduce DNS lookups), ech (Encrypted Client Hello configuration), and no-default-alpn. SvcParams are not used in AliasMode.
> - **Record Protection**: The record protection options are only displayed when you modify a resource record. The option to enable record protection is also only visible when you are the Global Admin or are a DDI Admin. For detailed information about this feature, see *[DNS Record Protection](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/2056815453)*. Choose one of the following options for the role-based access control:
>   - **None**: Choose this option if you do not want any protection for this record. If you choose this option, any user can modify this record.
>   - **Global Admin Only**: Only the Global Admin will be able to modify this record. If a DDI Admin or a non-admin views this record, the fields will be greyed out and they will not be able to modify this record.
>   - **DDI Admin Only**: Only the DDI Admin and the Global Admin will be able to modify this record. If a non-admin views this record, the fields will be greyed out and they will not be able to modify this record.
> - **Description**: Enter a descriptive comment about the HTTPS Record.
> - **TTL**: Enter a numeric value and select Hours, Minutes, or Seconds from the drop-down.
> - **Disable for DNS Protocol**: Click this check box to temporarily disable for DNS Protocol.
> - **Tags**: Click **Add** to associate keys with values. Specify the following details:
>   - **KEY**: Enter a meaningful name for the key, such as a location or a department.
>   - **VALUE**: Enter a value for the key such as San Jose (for location), or Accounts (for department).
>   - To remove a tag, select the respective check box and click **Remove** to delete the associated tag. For more information about tags, see *[Managing Tags](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneDDI/pages/186745865)*.