I am trying to provision a DNS zone to include a very simple use of the new record type HTTPS.

The provisioned records take essentially the following form, where the zone name is being represented as example.tld:

To simplify the discussion, the only IP addresses being considered are IPv4.

The objective of the two records in the zone is that HTTPS requests on either subdomain, foo.example.tld or bar.example.tld, would be sent to address 1.2.3.4.

In particular, I expected the following. If a browser were visiting a page on domain bar.example.tld, then it would start by querying the name server for name bar.example.tld and record type HTTPS. Upon receiving the answer that represents an alias to foo.example.org, the browser would query for the new name, and again, record type HTTPS. Since the second query would not return a match, the browser would proceed to query for the same name, but this time, record type A.

Finally, since the last query would be answered with the numeric address, it would be the address resolved for sending HTTPS requests.

However, testing has failed in both Chromium and Firefox, which report no server is unreachable.

A packet capture reveals that once the browser queries for name foo.example.tld and record type HTTPS, receiving no match, it concludes simply that the domain is unreachable. It actually starts by sending three queries, for types A, AAAA, and HTTPS. The HTTPS answer seems to prompt the further query for record type HTTPS, but not any for type for A (or AAAA).

It is difficult to find clear information on the usage of the new record type, but the sources I have been able to understand make no mention of a requirement that a HTTPS record must be provided for every name that is the target of another HTTPS record. Rather, they seem to imply that the the client should be satisfied if an A record is found for the target name.

I am at a loss trying to discover the reason that the browser is failing to carry the sequence of queries to its full conclusion.