HTTP/3 and IPv6 on the edge

What is on, for whom

• HTTP/3 runs on QUIC, a transport over UDP port 443 with TLS 1.3 built in. Browsers learn about it from the Alt-Svc header on their first HTTP/2 response and move over on the next connection.
• IPv6 is dual-stack: the CDN hostnames carry AAAA records next to the A records, and the edge accepts both. Your origin can stay IPv4-only; the edge fetches from it over IPv4 as before.
• Both apply to every account and hostname on the edge. They are not per-account switches and cannot be turned off for one site.
• Clients that cannot use them lose nothing: HTTP/2 over TLS 1.2 or 1.3 and IPv4 keep working exactly as before.

See it in the browser

Open DevTools → Network, right-click a column header and enable Protocol. The first page load shows h2; reload and the same requests show h3. Chrome, Edge, Firefox and Safari all do this on their own.

• h3 in the Protocol column means the request travelled over HTTP/3.
• The very first request of a session is expected to be h2 — the browser has not yet seen the Alt-Svc header.
• If you never see h3, something between the browser and the edge drops UDP 443 (see Troubleshooting). The site still works.

Check from the command line

curl 8 built with HTTP/3 support can force the protocol; dig shows the IPv6 records.

curl --http3 -sI https://www.example.com/ | head -1
curl -sI https://www.example.com/ | grep -i alt-svc
dig +short AAAA www.example.com
curl -6 -sI https://www.example.com/ | head -1

IPv6: what changes for you

• Nothing in the panel. If your site points at us with a CNAME, it inherits the AAAA records automatically.
• Visitors on IPv6-only networks (many mobile carriers) now reach the edge natively instead of through the carrier's translation layer.
• Analytics and logs show IPv6 client addresses. Per-IP rules you wrote for IPv4 do not match IPv6 visitors; add the IPv6 form if the rule matters.
• Your origin does not need IPv6. The edge talks to it over whatever it has today.

Troubleshooting

• No h3 ever: a corporate firewall or a home router that blocks outbound UDP 443. The browser silently stays on HTTP/2 — there is no error to look for, only the missing speed-up.
• h3 on the first visit but not later: the Alt-Svc hint is cached for a day; a network change can make the browser retry over TCP for a while. Normal.
• An IPv6 visitor cannot reach the site while IPv4 visitors can: the problem is on the visitor's path, not the edge. Ask for the output of curl -6 -v.
• A blocked request over HTTP/3 shows the same WAF block page as over HTTP/2; the Reference ID on it works the same way.

Logs and reports

• Requests over HTTP/3 are logged with the protocol HTTP/3.0; HTTP/2 stays HTTP/2.0.
• The share of HTTP/3 depends on your audience: on the first day it was between 6% and 27% of requests per site, mostly Chrome and Android.
• Bandwidth and request counting are unchanged; the protocol does not alter what you are billed for.