Representative interview topic

Networking interview: How would you safely migrate HTTPS/SVCB DNS records and verify client compatibility?

GeneralHard
Offer.cc Editorial TeamPublished Updated

Question

You must migrate HTTPS/SVCB records for a domain serving HTTP/2 and HTTP/3. How do you preserve legacy clients, roll out safely, roll back, and diagnose regional failures?

Prompt

Design a migration for HTTPS (SVCB) records for a domain serving HTTP/2 and HTTP/3. The plan must support canary rollout, rollback, and diagnosis when resolver, client, and certificate settings disagree.

Scenario and constraints

Authoritative DNS is hosted by multiple providers, while legacy clients query only A/AAAA. Unsupported clients must remain available. DNS TTL is 300 seconds and the service cannot be taken offline during the change.

What this tests

The candidate should understand RFC 9460 AliasMode, ServiceMode, SvcPriority, and parameter processing, then connect DNS propagation, TLS certificates, HTTP/3 negotiation, and rollback to observable release steps.

Reference approach

Keep existing A/AAAA and TLS configuration first, and verify that authoritative servers answer type 65. Use AliasMode (priority 0 with a non-root target) for an apex alias; use ServiceMode for ALPN, port, or alternative endpoint parameters. Publish alpn=h2,h3 on a low-traffic subdomain, measure resolution success, handshake errors, and protocol mix, then expand to the primary domain.

Clients that ignore HTTPS records must continue using A/AAAA. Rollback removes the new record and waits for the old TTL plus recursive-resolver retention; deleting it authoritatively does not erase caches immediately.

Critical details

SvcPriority=0 means AliasMode; ServiceMode uses a non-zero priority. The target needs a matching certificate, and port and alpn must match listeners and firewalls. Query several recursive resolvers before and after the change and compare clients that do and do not support type 65.

Common traps

Deleting A/AAAA because HTTPS records look like CNAMEs; testing only a local cache; treating h3 advertisement as proof that QUIC works; overlooking certificate SANs for an AliasMode target; using one region as evidence of global propagation.

Evaluation rubric

Strong answers trace authoritative DNS, recursive resolvers, clients, and TLS endpoints; define canary metrics, rollback windows, and a compatibility matrix; and predict symptoms for priority and parameter mistakes. Weaker answers provide one record without explaining legacy clients or caching.

Follow-up questions

How do you validate an AliasMode target and certificate?

Query the target's A/AAAA and HTTPS records, verify that the host used by the client satisfies certificate naming constraints, and inspect SNI in TLS logs.

What do you check when HTTP/3 fails only in some regions?

Break samples down by recursive resolver, Anycast DNS site, and access network. Compare returned HTTPS records, UDP 443 reachability, QUIC versions, and certificate chains before considering a global rollback.

When should you avoid publishing alpn=h3?

When QUIC listeners, certificates, path MTU, or firewalls have not been validated on target networks. Advertise only the stable protocol until end-to-end metrics meet the rollout gate.

Public sources

Related questions