HTTPS resource records (HTTPS RRs) are a new type of DNS record. The standard is still in progress and covers various intended use cases, mostly around delivering configuration information and parameters for how to access a service. In this post, I’m going to ignore all that and focus on one very simple use case: an HTTPS RR, on its own, can signal that a domain supports HTTPS, allowing the browser to upgrade connections to that domain from http:// to https://. In theory, browsers could look up HTTPS RRs alongside the A/AAAA lookup for a hostname, and if an HTTPS RR is present, then the browser would send the request over https:// and not http://. The idea is to prevent sslstrip-style attacks where a request to a site over http:// gets rewritten by the attacker, before the server even has a chance to redirect the http:// request to https://.

Learn how you can use our Anuta ATOM network automation partnership to simplify automation and improve services assurance with low code workflows and machine learning analytics.