How to check alt-svc header

Run curl -sI https://www.cloudflare.com/ | grep -i '^alt-svc'. The answer here was alt-svc: h3=":443"; ma=86400, which tells a client that HTTP/3 is available on the same host and port for the next 86400 seconds. No header means no browser will ever attempt HTTP/3 there.

Why check this

Run this whenever HTTP/3 is part of the release story, and after any edge or reverse-proxy change. Alt-Svc is the only way a browser learns that HTTP/3 exists on a host. A server can answer QUIC perfectly and still be used over TCP by every visitor, because nothing advertised the alternative. The symptom is an HTTP/3 rollout that shows no traffic shift in the CDN dashboard, which reads as a failed rollout rather than a missing header.

Prerequisites

• curl 7.64.1 or later. Reading the header needs no HTTP/2 or HTTP/3 support, because it is an ordinary response header.
• A build with ngtcp2 if you want steps 3 to 5, which follow the advertisement instead of only reading it.
• The header definition in RFC 7838 and the curl alt-svc documentation.

Steps

1. 1

   Step 1.

   Read the header on a host that advertises HTTP/3.

   curl -sI https://www.cloudflare.com/ | grep -i '^alt-svc'
   

   alt-svc: h3=":443"; ma=86400

   h3 is the protocol, :443 is the port with the host left empty to mean "same host", and ma is how long the entry stays valid.

2. 2

   Step 2.

   Run the same read against a host that serves HTTP/2 only, so you know what absence looks like.

   curl -sI https://api.github.com/ | grep -ci '^alt-svc'; echo "exit=$?"
   

   0
   exit=1

   A count of 0 is the whole result. Use grep -c rather than grep in a script, because a plain grep with no match prints nothing and is easy to misread as a passing check.

3. 3

   Step 3.

   Make a first request with an empty cache and record the protocol it used.

   curl -s -o /dev/null --alt-svc as.txt -w '%{http_version}\n' https://www.cloudflare.com/
   

   2

   The advertisement arrives inside this response, so it cannot influence this request. The first contact with a host is always over TCP.

4. 4

   Step 4.

   Read what the client stored.

   cat as.txt
   

   # Your alt-svc cache. https://curl.se/docs/alt-svc.html
   # This file was generated by libcurl! Edit at your own risk.
   h2 www.cloudflare.com 443 h3 www.cloudflare.com 443 "20260912 19:11:57" 0 0

   The row reads: the protocol that carried the response, the origin, then the alternative and its expiry date.

5. 5

   Step 5.

   Repeat the identical request and read the protocol again.

   curl -s -o /dev/null --alt-svc as.txt -w '%{http_version}\n' https://www.cloudflare.com/
   

   3

   Same command, same host, different transport. That switch is the only proof the advertisement is usable rather than merely present.

How to read the result

| What you see | What it means | What to do | | --- | --- | --- | | h3=":443"; ma=86400 | HTTP/3 offered on the same host and port for 24 hours | Nothing. Confirm with step 5 that it can be followed. | | h3=":443" with no ma | The entry lasts 24 hours by default under RFC 7838 | Set ma explicitly so the value is a decision, not a default. | | h3="alt.example.com:443" | The alternative lives on another host | Check that host's certificate covers the original name, or clients reject it. | | No header at all | No browser will attempt HTTP/3 here | Enable the advertisement on the edge. Serving QUIC without it changes nothing. | | clear as the value | The server is withdrawing all previous advertisements | Expected during a rollback. Unexpected otherwise, and it disables HTTP/3 for cached clients. |

Common mistakes

Thresholds

What to check next

• How to check HTTP/3 support: what to run once the advertisement is confirmed.
• How to check if a website uses HTTP/2: the protocol that carries the advertisement on first contact.
• How to check cache-control header: the other response header whose max-age drives client behaviour for hours.
• How to check HTTP response headers with curl: reading headers without the grep mistakes in step 2.

FAQ

What does ma mean in alt-svc?

Max age, in seconds. It is how long a client may keep using the alternative service before asking again. RFC 7838 sets the default to 86400 when the field is absent, so omitting it does not disable caching.

Does alt-svc have to point at the same host?

No. The value can name another host and port. If it does, that host must present a certificate valid for the original hostname, otherwise clients fall back to TCP without an error the user can see.

Can I check alt-svc in a browser?

Open DevTools, Network tab, click the document request, then the Headers panel and read the response headers. Chrome also lists what it cached at chrome://net-internals/#alt-svc, which is the client side of step 4.

Why does the first page load never use HTTP/3?

The advertisement is delivered inside a response, so the client has to complete one TCP request before it knows an alternative exists. An HTTPS DNS record can shorten that, but the header on its own always costs one TCP round.

Verified