How to check HTTPS and SVCB DNS records with dig

Modern clients can learn a service endpoint's preferred protocol, port, and address hints before opening a connection. HTTPS and SVCB records publish that information as one priority, one target name, and an optional set of service parameters that dig can display directly.

The HTTPS type applies the Service Binding format to web origins, while SVCB supports service-specific names such as _dns.resolver.arpa. Priority 0 means AliasMode and points the lookup to another name of the same record type; a nonzero priority means ServiceMode, where lower compatible values are preferred and parameters such as alpn or port describe the endpoint.

A target of . in ServiceMode means the record owner itself. Address hints can reduce connection delay, but they do not replace A or AAAA lookups when those records are available; resolver caches can also return different TTLs or answer ordering without changing the published endpoint.

Steps to check HTTPS and SVCB DNS records with dig:

Query the HTTPS record for the web origin.
```
$ dig +noall +answer cloudflare.com HTTPS
cloudflare.com.        377 IN HTTPS 1 . alpn="h3,h2" ipv4hint=104.16.132.229,104.16.133.229 ipv6hint=2606:4700::6810:84e5,2606:4700::6810:85e5
```
The answer is ServiceMode because its priority is 1. The . target keeps cloudflare.com as the effective endpoint, while alpn=“h3,h2” advertises HTTP/3 and HTTP/2. The hint addresses and TTL can vary by resolver, location, and query time.
Inspect the SVCB choices published for designated DNS resolvers.
```
$ dig +noall +answer _dns.resolver.arpa SVCB
_dns.resolver.arpa.    377 IN SVCB 1 one.one.one.one. alpn="h2,h3" port=443 ipv4hint=1.1.1.1,1.0.0.1 ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001 key7="/dns-query{?dns}"
_dns.resolver.arpa.    377 IN SVCB 2 one.one.one.one. alpn="dot" port=853 ipv4hint=1.1.1.1,1.0.0.1 ipv6hint=2606:4700:4700::1111,2606:4700:4700::1001
```
Both rows are ServiceMode records. A compatible client considers priority 1 before priority 2; alpn identifies the offered protocol and port overrides that protocol's normal authority port. dig can print a registered parameter numerically, such as key7, when its local registry table does not contain the parameter name.
Resolve the selected ServiceMode target to confirm its IPv4 addresses.
```
$ dig +noall +answer one.one.one.one A
one.one.one.one.       4502 IN A 1.0.0.1
one.one.one.one.       4502 IN A 1.1.1.1
```
The target's A answers contain the same two IPv4 addresses advertised as ipv4hint in the observed SVCB records. A mismatch can be legitimate because hints are advisory and DNS answers may vary by resolver or location, so the target lookup remains the address source for later connections.