I Tried Out the Alias Configuration and Behavior of CloudFront and Route 53 with HTTPS Record Support
This article was published more than one year ago. Please be aware that the information may be outdated.
This page has been translated by machine translation. View original
On July 1, 2025, Amazon CloudFront was updated to support HTTPS DNS records.
An HTTPS record is a DNS record that notifies clients of supported protocols (such as HTTP/2 and HTTP/3) and IP address hints before they connect to the server. This streamlines connection negotiation and improves performance.
To verify this CloudFront support for HTTPS records, I had the opportunity to create an alias HTTPS record targeting CloudFront in a Route 53 hosted zone and check how it behaves, so I will introduce it here.
CloudFront Settings
I created a single website (default) distribution.
Using a wildcard certificate issued in ACM in the Virginia region for CloudFront, I prepared a CloudFront distribution for verification.
As the supported HTTP versions, I enabled HTTP/2, HTTP/3, and IPv6.
Route53 Settings
In the hosted zone settings, I created an alias HTTPS record targeting CloudFront.
This time, I created the following three types of alias records.
- A
- AAAA
- HTTPS
Verification
I verified the behavior of the HTTPS record configured as an alias by using the drill command included in the ldns-utils package on Ubuntu.
$ drill https xxx.example.com.
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 3329
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; xxx.example.com. IN HTTPS
;; ANSWER SECTION:
xxx.example.com. 60 IN HTTPS 1 . alpn=h2,h3
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 5 msec
;; SERVER: 127.0.0.53
;; WHEN: Wed Jul 2 04:11:17 2025
;; MSG SIZE rcvd: 70
The record configured as an alias targeting CloudFront returned the expected response.
- SvcPriority: "1" (the highest priority value in service mode)
- SvcParams (service parameters): As ALPN (Application-Layer Protocol Negotiation), the HTTP/2 (h2) and HTTP/3 (h3) settings configured in CloudFront were reflected.
I confirmed that changing the supported HTTP versions in the CloudFront settings is reflected in the ALPN of the HTTPS record.
- When the HTTP/2 checkbox is cleared (only alpn=h3)
;; ANSWER SECTION:
xxx.example.com. 60 IN HTTPS 1 . alpn=h3
- When both the HTTP/2 and HTTP/3 checkboxes are cleared
;; ANSWER SECTION:
xxx.example.com. 60 IN HTTPS 1 . alpn=http/1.1
Summary
By setting up an HTTPS record that notifies clients in advance of supported protocols and so on, connection negotiation is optimized in browsers that support HTTPS records, and performance improvements can be expected.
Route 53 had already supported HTTPS records in the October 2023 update, but with this CloudFront support, HTTPS records can now be used as aliases, so no additional Route 53 charges are required and it can be used with simpler configuration.
If you use Route 53 for name resolution of CloudFront, please try setting up an HTTPS record as an alias in addition to the A and AAAA records.
