Prompt
Design a migration for HTTPS (SVCB) records for a domain serving HTTP/2 and HTTP/3. The plan must support canary rollout, rollback, and diagnosis when resolver, client, and certificate settings disagree.
Scenario and constraints
Authoritative DNS is hosted by multiple providers, while legacy clients query only A/AAAA. Unsupported clients must remain available. DNS TTL is 300 seconds and the service cannot be taken offline during the change.
What this tests
The candidate should understand RFC 9460 AliasMode, ServiceMode, SvcPriority, and parameter processing, then connect DNS propagation, TLS certificates, HTTP/3 negotiation, and rollback to observable release steps.
Reference approach
Keep existing A/AAAA and TLS configuration first, and verify that authoritative servers answer type 65. Use AliasMode (priority 0 with a non-root target) for an apex alias; use ServiceMode for ALPN, port, or alternative endpoint parameters. Publish alpn=h2,h3 on a low-traffic subdomain, measure resolution success, handshake errors, and protocol mix, then expand to the primary domain.
Clients that ignore HTTPS records must continue using A/AAAA. Rollback removes the new record and waits for the old TTL plus recursive-resolver retention; deleting it authoritatively does not erase caches immediately.
Critical details
SvcPriority=0 means AliasMode; ServiceMode uses a non-zero priority. The target needs a matching certificate, and port and alpn must match listeners and firewalls. Query several recursive resolvers before and after the change and compare clients that do and do not support type 65.
Common traps
Deleting A/AAAA because HTTPS records look like CNAMEs; testing only a local cache; treating h3 advertisement as proof that QUIC works; overlooking certificate SANs for an AliasMode target; using one region as evidence of global propagation.
Evaluation rubric
Strong answers trace authoritative DNS, recursive resolvers, clients, and TLS endpoints; define canary metrics, rollback windows, and a compatibility matrix; and predict symptoms for priority and parameter mistakes. Weaker answers provide one record without explaining legacy clients or caching.
Follow-up questions
How do you validate an AliasMode target and certificate?
Query the target's A/AAAA and HTTPS records, verify that the host used by the client satisfies certificate naming constraints, and inspect SNI in TLS logs.
What do you check when HTTP/3 fails only in some regions?
Break samples down by recursive resolver, Anycast DNS site, and access network. Compare returned HTTPS records, UDP 443 reachability, QUIC versions, and certificate chains before considering a global rollback.
When should you avoid publishing alpn=h3?
When QUIC listeners, certificates, path MTU, or firewalls have not been validated on target networks. Advertise only the stable protocol until end-to-end metrics meet the rollout gate.