< Alt-Svc: h3=":443"; ma=86400

TL;DR: Alt-Svc is how a server says “I am also reachable over this other protocol or port.” In practice it is the header that moves browsers from HTTP/2 over TCP to HTTP/3 over QUIC, typically Alt-Svc: h3=":443"; ma=86400. The first visit still uses TCP unless you also publish an HTTPS DNS record.

What a response looks like

HTTP/2 200
content-type: text/html
alt-svc: h3=":443"; ma=86400

Each entry is protocol-id="authority" plus parameters (RFC 7838 section 3). The protocol id is an ALPN token: h3 for HTTP/3 (RFC 9114), h2 for HTTP/2. The authority is a quoted host:port; leaving the host empty (":443") means the same host as the origin. The port is mandatory, and for QUIC it is a UDP port.

Several alternatives can be listed, most preferred first:

Alt-Svc: h3=":443"; ma=86400, h2=":443"; ma=86400

Parameters

• ma is the freshness in seconds. The default is 86400 (24 hours). A client subtracts the response Age from it.
• persist=1 asks the client to keep the entry across network changes such as moving from Wi-Fi to cellular. Without it, a client is allowed to drop alternatives when its network configuration changes.
• clear is a standalone value, not a parameter. Alt-Svc: clear wipes all cached alternatives for the origin.

How the switch to HTTP/3 happens

1. The browser connects with TCP and TLS (HTTP/1.1 or HTTP/2) because it cannot know the server speaks QUIC.
2. The response includes Alt-Svc: h3=":443".
3. For later requests to that origin, the browser attempts QUIC against the advertised endpoint.
4. If UDP 443 is blocked (common on corporate networks and some firewalls) or the QUIC handshake fails, the browser keeps using TCP.

This is why “is HTTP/3 working?” checks that look only at the first load are misleading. Reload, or look at the protocol column in DevTools on the second navigation.

Alt-Svc versus the HTTPS DNS record

Alt-Svc is learned after a connection exists. RFC 9460 defines the HTTPS DNS record, which carries the same kind of information (an alpn list such as h3,h2) at resolution time, so a capable client can open QUIC on the very first request.

example.com. 300 IN HTTPS 1 . alpn="h3,h2"

The two are complementary. RFC 9460 section 9.3 covers their interaction: when both are present the client has to satisfy the constraints of both, not treat them independently. Keep them consistent. Advertising h3 in DNS while the server stops answering QUIC gives clients a failed attempt and a fallback on every visit.

Enabling it

nginx (HTTP/3 support arrived in 1.25.0 and needs a build with QUIC; http2 on is the 1.25.1+ syntax):

server {
    listen 443 ssl;
    listen 443 quic reuseport;
    http2 on;
    http3 on;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;
}

Open UDP 443 in the firewall and security group too. The header alone does nothing if the port is closed. If a CDN terminates TLS for you and has HTTP/3 enabled, check the response for an alt-svc header before adding your own.

Rolling it back

Removing the header does not disable HTTP/3 for clients that already cached the entry; they keep trying until ma expires. To retire QUIC cleanly, send Alt-Svc: clear for at least as long as your previous ma, then stop serving QUIC. A short ma during a rollout (for example 3600) keeps this cheap.

Alt-Used

When a client sends a request over an alternative service it can include Alt-Used: example.com:443 (RFC 7838 section 5) so the server can detect loops and balance load. Do not treat it as authentication.

Verify

curl -sI https://example.com | grep -i alt-svc
curl -sI --http3 https://example.com | head -1

The second command needs a curl built with HTTP/3 support. If it fails while Alt-Svc is present, suspect UDP 443 filtering before suspecting the server config.

Related

• Connection, Via
• HTTP/1.1 vs HTTP/2