HTTPS record support

Florian Weimer fweimer at redhat.com
Tue Sep 9 10:26:44 UTC 2025


I've got an RFE to add HTTPS/SVCB support to glibc's getaddrinfo
implementation.

To get an idea whether this makes sense given the getaddrinfo API
constraints, I need to know more about actual deployment.

Is there any data about it?  Are multiple alias names common?  Are
address hints common?

Browsers seem to query it.  I tend to get cache hits from larger
resolvers for HTTPS records for popular domains.

But there is no HTTPS additional section processing in most stub
resolvers that I encounter.  (Even if processing is present, it's
impossible to tell if RRsets are treated atomically as expected.)  Lack
of trustworthy additional section data means that the number of DNS
queries would go from two (A/AAAA) to 5 in case of two aliases (HTTPS,
followed by A/AAAA for each alias).  This isn't ideal for an API like
getaddrinfo, which would have to perform all this work upfront, whether
the application will use the data or not.

If address hints are common, we could add a mode (enabled by
applications for individual calls) where getaddrinfo returns with
address data from the HTTPS record itself if it is available, without
chasing for the additional data.  But I don't have evidence that hints
are widely available.

Thanks,
Florian



More information about the dns-operations mailing list