diff --git a/doc/api/dns.md b/doc/api/dns.md
index d8b1839d9736..fd7e29c34499 100644
--- a/doc/api/dns.md
+++ b/doc/api/dns.md
@@ -123,12 +123,14 @@ The following methods from the `node:dns` module are available:
 * [`resolver.resolveAny()`][`dns.resolveAny()`]
 * [`resolver.resolveCaa()`][`dns.resolveCaa()`]
 * [`resolver.resolveCname()`][`dns.resolveCname()`]
+* [`resolver.resolveHttps()`][`dns.resolveHttps()`]
 * [`resolver.resolveMx()`][`dns.resolveMx()`]
 * [`resolver.resolveNaptr()`][`dns.resolveNaptr()`]
 * [`resolver.resolveNs()`][`dns.resolveNs()`]
 * [`resolver.resolvePtr()`][`dns.resolvePtr()`]
 * [`resolver.resolveSoa()`][`dns.resolveSoa()`]
 * [`resolver.resolveSrv()`][`dns.resolveSrv()`]
+* [`resolver.resolveSvcb()`][`dns.resolveSvcb()`]
 * [`resolver.resolveTlsa()`][`dns.resolveTlsa()`]
 * [`resolver.resolveTxt()`][`dns.resolveTxt()`]
 * [`resolver.reverse()`][`dns.reverse()`]
@@ -445,12 +447,14 @@ records. The type and structure of individual results varies based on `rrtype`:
 | `'ANY'`   | any records                    | {Object}    | [`dns.resolveAny()`][]   |
 | `'CAA'`   | CA authorization records       | {Object}    | [`dns.resolveCaa()`][]   |
 | `'CNAME'` | canonical name records         | {string}    | [`dns.resolveCname()`][] |
+| `'HTTPS'` | HTTPS service bindings         | {Object}    | [`dns.resolveHttps()`][] |
 | `'MX'`    | mail exchange records          | {Object}    | [`dns.resolveMx()`][]    |
 | `'NAPTR'` | name authority pointer records | {Object}    | [`dns.resolveNaptr()`][] |
 | `'NS'`    | name server records            | {string}    | [`dns.resolveNs()`][]    |
 | `'PTR'`   | pointer records                | {string}    | [`dns.resolvePtr()`][]   |
 | `'SOA'`   | start of authority records     | {Object}    | [`dns.resolveSoa()`][]   |
 | `'SRV'`   | service records                | {Object}    | [`dns.resolveSrv()`][]   |
+| `'SVCB'`  | service bindings               | {Object}    | [`dns.resolveSvcb()`][]  |
 | `'TLSA'`  | certificate associations       | {Object}    | [`dns.resolveTlsa()`][]  |
 | `'TXT'`   | text records                   | {string\[]} | [`dns.resolveTxt()`][]   |
 
@@ -546,12 +550,14 @@ will be present on the object:
 | `'AAAA'`  | `address`/`ttl`                                                                                                                                  |
 | `'CAA'`   | Refer to [`dns.resolveCaa()`][]                                                                                                                  |
 | `'CNAME'` | `value`                                                                                                                                          |
+| `'HTTPS'` | Refer to [`dns.resolveHttps()`][]                                                                                                                |
 | `'MX'`    | Refer to [`dns.resolveMx()`][]                                                                                                                   |
 | `'NAPTR'` | Refer to [`dns.resolveNaptr()`][]                                                                                                                |
 | `'NS'`    | `value`                                                                                                                                          |
 | `'PTR'`   | `value`                                                                                                                                          |
 | `'SOA'`   | Refer to [`dns.resolveSoa()`][]                                                                                                                  |
 | `'SRV'`   | Refer to [`dns.resolveSrv()`][]                                                                                                                  |
+| `'SVCB'`  | Refer to [`dns.resolveSvcb()`][]                                                                                                                 |
 | `'TLSA'`  | Refer to [`dns.resolveTlsa()`][]                                                                                                                 |
 | `'TXT'`   | This type of record contains an array property called `entries` which refers to [`dns.resolveTxt()`][], e.g. `{ entries: ['...'], type: 'TXT' }` |
 
@@ -624,6 +630,26 @@ will contain an array of certification authority authorization records
 available for the `hostname` (e.g. `[{critical: 0, iodef:
 'mailto:pki@example.com'}, {critical: 128, issue: 'pki.example.com'}]`).
 
+## `dns.resolveHttps(hostname, callback)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+<!--lint disable no-undefined-references list-item-bullet-indent-->
+
+* `hostname` {string}
+* `callback` {Function}
+  * `err` {Error}
+  * `records` {Object\[]}
+
+<!--lint enable no-undefined-references list-item-bullet-indent-->
+
+Uses the DNS protocol to resolve `HTTPS` records ([RFC 9460][]) for the
+`hostname`. `HTTPS` records use the same format as `SVCB` records, so the
+`records` argument passed to the `callback` function has the same structure as
+in [`dns.resolveSvcb()`][].
+
 ## `dns.resolveMx(hostname, callback)`
 
 <!-- YAML
@@ -804,6 +830,63 @@ be an array of objects with the following properties:
 });
 ```
 
+## `dns.resolveSvcb(hostname, callback)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+<!--lint disable no-undefined-references list-item-bullet-indent-->
+
+* `hostname` {string}
+* `callback` {Function}
+  * `err` {Error}
+  * `records` {Object\[]}
+
+<!--lint enable no-undefined-references list-item-bullet-indent-->
+
+Uses the DNS protocol to resolve service binding records (`SVCB` records, as
+defined in [RFC 9460][]) for the `hostname`. The `records` argument passed to
+the `callback` function is an array of objects with these properties:
+
+* `priority` {integer} The `SvcPriority`. `0` indicates AliasMode, in which
+  case `target` is an alias and `params` is empty.
+* `target` {string} The `TargetName`. An empty string represents the root
+  name (`.`), which in ServiceMode means the owner name of the record itself.
+* `params` {Object} The `SvcParams`, keyed by their presentation name. Known
+  keys are decoded as follows:
+
+  * `mandatory` {string\[]} Names of the keys the client must understand.
+  * `alpn` {string\[]} ALPN protocol identifiers, e.g. `['h2', 'h3']`.
+  * `no-default-alpn` {boolean} Always `true` when present.
+  * `port` {integer}
+  * `ipv4hint` {string\[]} IPv4 addresses.
+  * `ech` {ArrayBuffer} The `ECHConfigList`.
+  * `ipv6hint` {string\[]} IPv6 addresses.
+  * `dohpath` {string} The DoH URI template ([RFC 9461][]).
+  * `ohttp` {boolean} Always `true` when present ([RFC 9540][]).
+
+  Any other key is reported as `keyNNNNN`, where `NNNNN` is the numeric key,
+  with the raw value as an {ArrayBuffer}. This includes keys in the
+  private-use range (65280-65534).
+
+```js
+({
+  priority: 1,
+  target: 'svc.example.com',
+  params: {
+    alpn: ['h2', 'h3'],
+    port: 8443,
+    ipv4hint: ['192.0.2.1'],
+    key65400: [ArrayBuffer],
+  },
+});
+```
+
+If any record in the response has a malformed `SvcParams` field, the query
+fails with `EBADRESP`. In [`dns.resolveAny()`][] results, a malformed set of
+`SVCB` or `HTTPS` records is omitted instead.
+
 ## `dns.resolveTlsa(hostname, callback)`
 
 <!-- YAML
@@ -1039,12 +1122,14 @@ The following methods from the `dnsPromises` API are available:
 * [`resolver.resolveAny()`][`dnsPromises.resolveAny()`]
 * [`resolver.resolveCaa()`][`dnsPromises.resolveCaa()`]
 * [`resolver.resolveCname()`][`dnsPromises.resolveCname()`]
+* [`resolver.resolveHttps()`][`dnsPromises.resolveHttps()`]
 * [`resolver.resolveMx()`][`dnsPromises.resolveMx()`]
 * [`resolver.resolveNaptr()`][`dnsPromises.resolveNaptr()`]
 * [`resolver.resolveNs()`][`dnsPromises.resolveNs()`]
 * [`resolver.resolvePtr()`][`dnsPromises.resolvePtr()`]
 * [`resolver.resolveSoa()`][`dnsPromises.resolveSoa()`]
 * [`resolver.resolveSrv()`][`dnsPromises.resolveSrv()`]
+* [`resolver.resolveSvcb()`][`dnsPromises.resolveSvcb()`]
 * [`resolver.resolveTlsa()`][`dnsPromises.resolveTlsa()`]
 * [`resolver.resolveTxt()`][`dnsPromises.resolveTxt()`]
 * [`resolver.reverse()`][`dnsPromises.reverse()`]
@@ -1241,12 +1326,14 @@ based on `rrtype`:
 | `'ANY'`   | any records                    | {Object}    | [`dnsPromises.resolveAny()`][]   |
 | `'CAA'`   | CA authorization records       | {Object}    | [`dnsPromises.resolveCaa()`][]   |
 | `'CNAME'` | canonical name records         | {string}    | [`dnsPromises.resolveCname()`][] |
+| `'HTTPS'` | HTTPS service bindings         | {Object}    | [`dnsPromises.resolveHttps()`][] |
 | `'MX'`    | mail exchange records          | {Object}    | [`dnsPromises.resolveMx()`][]    |
 | `'NAPTR'` | name authority pointer records | {Object}    | [`dnsPromises.resolveNaptr()`][] |
 | `'NS'`    | name server records            | {string}    | [`dnsPromises.resolveNs()`][]    |
 | `'PTR'`   | pointer records                | {string}    | [`dnsPromises.resolvePtr()`][]   |
 | `'SOA'`   | start of authority records     | {Object}    | [`dnsPromises.resolveSoa()`][]   |
 | `'SRV'`   | service records                | {Object}    | [`dnsPromises.resolveSrv()`][]   |
+| `'SVCB'`  | service bindings               | {Object}    | [`dnsPromises.resolveSvcb()`][]  |
 | `'TLSA'`  | certificate associations       | {Object}    | [`dnsPromises.resolveTlsa()`][]  |
 | `'TXT'`   | text records                   | {string\[]} | [`dnsPromises.resolveTxt()`][]   |
 
@@ -1307,12 +1394,14 @@ present on the object:
 | `'AAAA'`  | `address`/`ttl`                                                                                                                                          |
 | `'CAA'`   | Refer to [`dnsPromises.resolveCaa()`][]                                                                                                                  |
 | `'CNAME'` | `value`                                                                                                                                                  |
+| `'HTTPS'` | Refer to [`dnsPromises.resolveHttps()`][]                                                                                                                |
 | `'MX'`    | Refer to [`dnsPromises.resolveMx()`][]                                                                                                                   |
 | `'NAPTR'` | Refer to [`dnsPromises.resolveNaptr()`][]                                                                                                                |
 | `'NS'`    | `value`                                                                                                                                                  |
 | `'PTR'`   | `value`                                                                                                                                                  |
 | `'SOA'`   | Refer to [`dnsPromises.resolveSoa()`][]                                                                                                                  |
 | `'SRV'`   | Refer to [`dnsPromises.resolveSrv()`][]                                                                                                                  |
+| `'SVCB'`  | Refer to [`dnsPromises.resolveSvcb()`][]                                                                                                                 |
 | `'TLSA'`  | Refer to [`dnsPromises.resolveTlsa()`][]                                                                                                                 |
 | `'TXT'`   | This type of record contains an array property called `entries` which refers to [`dnsPromises.resolveTxt()`][], e.g. `{ entries: ['...'], type: 'TXT' }` |
 
@@ -1362,6 +1451,18 @@ Uses the DNS protocol to resolve `CNAME` records for the `hostname`. On success,
 the `Promise` is resolved with an array of canonical name records available for
 the `hostname` (e.g. `['bar.example.com']`).
 
+### `dnsPromises.resolveHttps(hostname)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `hostname` {string}
+
+Uses the DNS protocol to resolve `HTTPS` records ([RFC 9460][]) for the
+`hostname`. On success, the `Promise` is resolved with an array of objects with
+the same structure as in [`dnsPromises.resolveSvcb()`][].
+
 ### `dnsPromises.resolveMx(hostname)`
 
 <!-- YAML
@@ -1488,6 +1589,56 @@ the following properties:
 });
 ```
 
+### `dnsPromises.resolveSvcb(hostname)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `hostname` {string}
+
+Uses the DNS protocol to resolve service binding records (`SVCB` records, as
+defined in [RFC 9460][]) for the `hostname`. On success, the `Promise` is
+resolved with an array of objects with these properties:
+
+* `priority` {integer} The `SvcPriority`. `0` indicates AliasMode, in which
+  case `target` is an alias and `params` is empty.
+* `target` {string} The `TargetName`. An empty string represents the root
+  name (`.`), which in ServiceMode means the owner name of the record itself.
+* `params` {Object} The `SvcParams`, keyed by their presentation name. Known
+  keys are decoded as follows:
+
+  * `mandatory` {string\[]} Names of the keys the client must understand.
+  * `alpn` {string\[]} ALPN protocol identifiers, e.g. `['h2', 'h3']`.
+  * `no-default-alpn` {boolean} Always `true` when present.
+  * `port` {integer}
+  * `ipv4hint` {string\[]} IPv4 addresses.
+  * `ech` {ArrayBuffer} The `ECHConfigList`.
+  * `ipv6hint` {string\[]} IPv6 addresses.
+  * `dohpath` {string} The DoH URI template ([RFC 9461][]).
+  * `ohttp` {boolean} Always `true` when present ([RFC 9540][]).
+
+  Any other key is reported as `keyNNNNN`, where `NNNNN` is the numeric key,
+  with the raw value as an {ArrayBuffer}. This includes keys in the
+  private-use range (65280-65534).
+
+```js
+({
+  priority: 1,
+  target: 'svc.example.com',
+  params: {
+    alpn: ['h2', 'h3'],
+    port: 8443,
+    ipv4hint: ['192.0.2.1'],
+    key65400: [ArrayBuffer],
+  },
+});
+```
+
+If any record in the response has a malformed `SvcParams` field, the query
+fails with `EBADRESP`. In [`dnsPromises.resolveAny()`][] results, a malformed
+set of `SVCB` or `HTTPS` records is omitted instead.
+
 ### `dnsPromises.resolveTlsa(hostname)`
 
 <!-- YAML
@@ -1698,6 +1849,9 @@ uses. For instance, they do not use the configuration from `/etc/hosts`.
 [Implementation considerations section]: #implementation-considerations
 [RFC 5952]: https://tools.ietf.org/html/rfc5952#section-6
 [RFC 8482]: https://tools.ietf.org/html/rfc8482
+[RFC 9460]: https://www.rfc-editor.org/rfc/rfc9460
+[RFC 9461]: https://www.rfc-editor.org/rfc/rfc9461
+[RFC 9540]: https://www.rfc-editor.org/rfc/rfc9540
 [`--dns-result-order`]: cli.md#--dns-result-orderorder
 [`Error`]: errors.md#class-error
 [`UV_THREADPOOL_SIZE`]: cli.md#uv_threadpool_sizesize
@@ -1710,12 +1864,14 @@ uses. For instance, they do not use the configuration from `/etc/hosts`.
 [`dns.resolveAny()`]: #dnsresolveanyhostname-callback
 [`dns.resolveCaa()`]: #dnsresolvecaahostname-callback
 [`dns.resolveCname()`]: #dnsresolvecnamehostname-callback
+[`dns.resolveHttps()`]: #dnsresolvehttpshostname-callback
 [`dns.resolveMx()`]: #dnsresolvemxhostname-callback
 [`dns.resolveNaptr()`]: #dnsresolvenaptrhostname-callback
 [`dns.resolveNs()`]: #dnsresolvenshostname-callback
 [`dns.resolvePtr()`]: #dnsresolveptrhostname-callback
 [`dns.resolveSoa()`]: #dnsresolvesoahostname-callback
 [`dns.resolveSrv()`]: #dnsresolvesrvhostname-callback
+[`dns.resolveSvcb()`]: #dnsresolvesvcbhostname-callback
 [`dns.resolveTlsa()`]: #dnsresolvetlsahostname-callback
 [`dns.resolveTxt()`]: #dnsresolvetxthostname-callback
 [`dns.reverse()`]: #dnsreverseip-callback
@@ -1729,12 +1885,14 @@ uses. For instance, they do not use the configuration from `/etc/hosts`.
 [`dnsPromises.resolveAny()`]: #dnspromisesresolveanyhostname
 [`dnsPromises.resolveCaa()`]: #dnspromisesresolvecaahostname
 [`dnsPromises.resolveCname()`]: #dnspromisesresolvecnamehostname
+[`dnsPromises.resolveHttps()`]: #dnspromisesresolvehttpshostname
 [`dnsPromises.resolveMx()`]: #dnspromisesresolvemxhostname
 [`dnsPromises.resolveNaptr()`]: #dnspromisesresolvenaptrhostname
 [`dnsPromises.resolveNs()`]: #dnspromisesresolvenshostname
 [`dnsPromises.resolvePtr()`]: #dnspromisesresolveptrhostname
 [`dnsPromises.resolveSoa()`]: #dnspromisesresolvesoahostname
 [`dnsPromises.resolveSrv()`]: #dnspromisesresolvesrvhostname
+[`dnsPromises.resolveSvcb()`]: #dnspromisesresolvesvcbhostname
 [`dnsPromises.resolveTlsa()`]: #dnspromisesresolvetlsahostname
 [`dnsPromises.resolveTxt()`]: #dnspromisesresolvetxthostname
 [`dnsPromises.reverse()`]: #dnspromisesreverseip
diff --git a/lib/internal/dns/utils.js b/lib/internal/dns/utils.js
index dcc2828b0f91..f04c0e878d14 100644
--- a/lib/internal/dns/utils.js
+++ b/lib/internal/dns/utils.js
@@ -246,12 +246,14 @@ const resolverKeys = [
   'resolveAny',
   'resolveCaa',
   'resolveCname',
+  'resolveHttps',
   'resolveMx',
   'resolveNaptr',
   'resolveNs',
   'resolvePtr',
   'resolveSoa',
   'resolveSrv',
+  'resolveSvcb',
   'resolveTlsa',
   'resolveTxt',
   'reverse',
@@ -303,11 +305,13 @@ function createResolverClass(resolver) {
   Resolver.prototype.resolve6 = resolveMap.AAAA = resolver('queryAaaa');
   Resolver.prototype.resolveCaa = resolveMap.CAA = resolver('queryCaa');
   Resolver.prototype.resolveCname = resolveMap.CNAME = resolver('queryCname');
+  Resolver.prototype.resolveHttps = resolveMap.HTTPS = resolver('queryHttps');
   Resolver.prototype.resolveMx = resolveMap.MX = resolver('queryMx');
   Resolver.prototype.resolveNs = resolveMap.NS = resolver('queryNs');
   Resolver.prototype.resolveTlsa = resolveMap.TLSA = resolver('queryTlsa');
   Resolver.prototype.resolveTxt = resolveMap.TXT = resolver('queryTxt');
   Resolver.prototype.resolveSrv = resolveMap.SRV = resolver('querySrv');
+  Resolver.prototype.resolveSvcb = resolveMap.SVCB = resolver('querySvcb');
   Resolver.prototype.resolvePtr = resolveMap.PTR = resolver('queryPtr');
   Resolver.prototype.resolveNaptr = resolveMap.NAPTR = resolver('queryNaptr');
   Resolver.prototype.resolveSoa = resolveMap.SOA = resolver('querySoa');
diff --git a/src/cares_wrap.cc b/src/cares_wrap.cc
index 5cfae82f47b1..880d5f062ef3 100644
--- a/src/cares_wrap.cc
+++ b/src/cares_wrap.cc
@@ -48,6 +48,14 @@
 #define T_TLSA 52 /* TLSA certificate association */
 #endif
 
+#ifndef T_SVCB
+#define T_SVCB 64 /* General purpose service binding */
+#endif
+
+#ifndef T_HTTPS
+#define T_HTTPS 65 /* Service binding for HTTPS */
+#endif
+
 #ifndef T_CAA
 # define T_CAA    257 /* Certification Authority Authorization */
 #endif
@@ -86,6 +94,7 @@ using v8::Nothing;
 using v8::Null;
 using v8::Object;
 using v8::String;
+using v8::True;
 using v8::Uint32;
 using v8::Undefined;
 using v8::Value;
@@ -602,6 +611,253 @@ Maybe<int> ParseTlsaReply(Environment* env,
   return Just<int>(ARES_SUCCESS);
 }
 
+// SvcParamKeys that c-ares does not have a constant for.
+constexpr uint16_t kSvcbParamDohPath = 7;  // RFC 9461
+constexpr uint16_t kSvcbParamOhttp = 8;    // RFC 9540
+
+std::string SvcbParamKeyName(uint16_t key) {
+  switch (key) {
+    case ARES_SVCB_PARAM_MANDATORY:
+      return "mandatory";
+    case ARES_SVCB_PARAM_ALPN:
+      return "alpn";
+    case ARES_SVCB_PARAM_NO_DEFAULT_ALPN:
+      return "no-default-alpn";
+    case ARES_SVCB_PARAM_PORT:
+      return "port";
+    case ARES_SVCB_PARAM_IPV4HINT:
+      return "ipv4hint";
+    case ARES_SVCB_PARAM_ECH:
+      return "ech";
+    case ARES_SVCB_PARAM_IPV6HINT:
+      return "ipv6hint";
+    case kSvcbParamDohPath:
+      return "dohpath";
+    case kSvcbParamOhttp:
+      return "ohttp";
+    default:
+      // Generic presentation format, RFC 9460 Section 2.1.
+      return "key" + std::to_string(key);
+  }
+}
+
+// Decodes a single SvcParamValue from its wire format. Keys without a
+// dedicated representation, including private-use keys, are returned as an
+// ArrayBuffer holding the raw value. Returns false if the value is malformed.
+bool ParseSvcbParamValue(Environment* env,
+                         uint16_t key,
+                         const unsigned char* val,
+                         size_t len,
+                         Local<Value>* out) {
+  Isolate* isolate = env->isolate();
+  switch (key) {
+    case ARES_SVCB_PARAM_MANDATORY: {
+      if (len == 0 || len % 2 != 0) return false;
+      LocalVector<Value> keys(isolate);
+      keys.reserve(len / 2);
+      // The listed keys must be strictly increasing and must not include
+      // "mandatory" (key 0) itself, RFC 9460 Section 8.
+      uint32_t prev = 0;
+      for (size_t i = 0; i < len; i += 2) {
+        uint16_t k = (val[i] << 8) | val[i + 1];
+        if (k <= prev) return false;
+        prev = k;
+        keys.push_back(OneByteString(isolate, SvcbParamKeyName(k)));
+      }
+      *out = Array::New(isolate, keys.data(), keys.size());
+      return true;
+    }
+    case ARES_SVCB_PARAM_ALPN: {
+      if (len == 0) return false;
+      LocalVector<Value> ids(isolate);
+      size_t i = 0;
+      while (i < len) {
+        size_t id_len = val[i++];
+        if (id_len == 0 || id_len > len - i) return false;
+        ids.push_back(OneByteString(isolate, val + i, id_len));
+        i += id_len;
+      }
+      *out = Array::New(isolate, ids.data(), ids.size());
+      return true;
+    }
+    case ARES_SVCB_PARAM_NO_DEFAULT_ALPN:
+    case kSvcbParamOhttp:
+      if (len != 0) return false;
+      *out = True(isolate);
+      return true;
+    case ARES_SVCB_PARAM_PORT:
+      if (len != 2) return false;
+      *out = Integer::NewFromUnsigned(isolate, (val[0] << 8) | val[1]);
+      return true;
+    case ARES_SVCB_PARAM_IPV4HINT:
+    case ARES_SVCB_PARAM_IPV6HINT: {
+      const bool v4 = key == ARES_SVCB_PARAM_IPV4HINT;
+      const size_t addr_len = v4 ? 4 : 16;
+      if (len == 0 || len % addr_len != 0) return false;
+      LocalVector<Value> addrs(isolate);
+      addrs.reserve(len / addr_len);
+      for (size_t i = 0; i < len; i += addr_len) {
+        char ip[INET6_ADDRSTRLEN];
+        if (uv_inet_ntop(v4 ? AF_INET : AF_INET6, val + i, ip, sizeof(ip)))
+          return false;
+        addrs.push_back(OneByteString(isolate, ip));
+      }
+      *out = Array::New(isolate, addrs.data(), addrs.size());
+      return true;
+    }
+    case kSvcbParamDohPath:
+      if (!String::NewFromUtf8(isolate,
+                               reinterpret_cast<const char*>(val),
+                               v8::NewStringType::kNormal,
+                               len)
+               .ToLocal(out)) {
+        return false;
+      }
+      return true;
+    case ARES_SVCB_PARAM_ECH:
+      if (len == 0) return false;
+      [[fallthrough]];
+    default: {
+      Local<ArrayBuffer> ab = ArrayBuffer::New(isolate, len);
+      if (len > 0) memcpy(ab->Data(), val, len);
+      *out = ab;
+      return true;
+    }
+  }
+}
+
+// Parses SVCB and HTTPS records (RFC 9460). Both types share the same RDATA
+// format; rec_type selects which one is extracted from the answer section.
+Maybe<int> ParseSvcbReply(Environment* env,
+                          const unsigned char* buf,
+                          int len,
+                          Local<Array> ret,
+                          ares_dns_rec_type_t rec_type,
+                          bool need_type = false) {
+  HandleScope handle_scope(env->isolate());
+
+  auto tmpl = env->svcb_record_template();
+  if (tmpl.IsEmpty()) {
+    static constexpr std::string_view names[] = {
+        "priority",
+        "target",
+        "params",
+    };
+    tmpl = DictionaryTemplate::New(env->isolate(), names);
+    env->set_svcb_record_template(tmpl);
+  }
+
+  ares_dns_record_t* dnsrec = nullptr;
+  int status = ares_dns_parse(buf, len, 0, &dnsrec);
+  if (status != ARES_SUCCESS) {
+    ares_dns_record_destroy(dnsrec);
+    return Just<int>(status);
+  }
+  DeleteFnPtr<ares_dns_record_t, ares_dns_record_destroy> free_me(dnsrec);
+
+  const bool https = rec_type == ARES_REC_TYPE_HTTPS;
+  const ares_dns_rr_key_t priority_key =
+      https ? ARES_RR_HTTPS_PRIORITY : ARES_RR_SVCB_PRIORITY;
+  const ares_dns_rr_key_t target_key =
+      https ? ARES_RR_HTTPS_TARGET : ARES_RR_SVCB_TARGET;
+  const ares_dns_rr_key_t params_key =
+      https ? ARES_RR_HTTPS_PARAMS : ARES_RR_SVCB_PARAMS;
+
+  MaybeLocal<Value> values[] = {
+      Undefined(env->isolate()),  // priority
+      Undefined(env->isolate()),  // target
+      Undefined(env->isolate()),  // params
+  };
+
+  // A malformed RR invalidates the whole RRset (RFC 9460 Section 2.4.3). For
+  // ANY queries only this RRset is dropped so other record types survive.
+  const int malformed = need_type ? ARES_ENODATA : ARES_EBADRESP;
+
+  const size_t rr_count = ares_dns_record_rr_cnt(dnsrec, ARES_SECTION_ANSWER);
+  LocalVector<Value> records(env->isolate());
+  for (size_t i = 0; i < rr_count; i++) {
+    const ares_dns_rr_t* rr =
+        ares_dns_record_rr_get(dnsrec, ARES_SECTION_ANSWER, i);
+    if (ares_dns_rr_get_type(rr) != rec_type) continue;
+
+    const uint16_t priority = ares_dns_rr_get_u16(rr, priority_key);
+    Local<Object> params = Object::New(env->isolate());
+    // Recipients MUST ignore any SvcParams of AliasMode records, RFC 9460
+    // Section 2.4.2.
+    const size_t param_count =
+        priority == 0 ? 0 : ares_dns_rr_get_opt_cnt(rr, params_key);
+    int32_t prev_key = -1;
+    for (size_t j = 0; j < param_count; j++) {
+      const unsigned char* val = nullptr;
+      size_t val_len = 0;
+      uint16_t key = ares_dns_rr_get_opt(rr, params_key, j, &val, &val_len);
+      // SvcParamKeys must appear in strictly increasing order. c-ares does
+      // not enforce this. Note that c-ares silently merges duplicate keys
+      // (the last value wins), so duplicates cannot be detected here.
+      if (key <= prev_key) return Just<int>(malformed);
+      prev_key = key;
+      Local<Value> value;
+      if (!ParseSvcbParamValue(env, key, val, val_len, &value)) {
+        return Just<int>(malformed);
+      }
+      // Every key listed in "mandatory" must be present in the RR.
+      if (key == ARES_SVCB_PARAM_MANDATORY) {
+        for (size_t k = 0; k < val_len; k += 2) {
+          if (!ares_dns_rr_get_opt_byid(rr,
+                                        params_key,
+                                        (val[k] << 8) | val[k + 1],
+                                        nullptr,
+                                        nullptr)) {
+            return Just<int>(malformed);
+          }
+        }
+      }
+      if (params
+              ->Set(env->context(),
+                    OneByteString(env->isolate(), SvcbParamKeyName(key)),
+                    value)
+              .IsNothing()) {
+        return Nothing<int>();
+      }
+    }
+
+    values[0] = Integer::NewFromUnsigned(env->isolate(), priority);
+    values[1] =
+        OneByteString(env->isolate(), ares_dns_rr_get_str(rr, target_key));
+    values[2] = params;
+
+    Local<Object> svcb_record;
+    if (!NewDictionaryInstance(env->context(), tmpl, values)
+             .ToLocal(&svcb_record)) {
+      return Nothing<int>();
+    }
+
+    // The type is only reported for ANY queries, so it is not part of the
+    // template.
+    if (need_type &&
+        svcb_record
+            ->Set(env->context(),
+                  env->type_string(),
+                  https ? env->dns_https_string() : env->dns_svcb_string())
+            .IsNothing()) {
+      return Nothing<int>();
+    }
+
+    records.push_back(svcb_record);
+  }
+
+  if (records.empty()) return Just<int>(ARES_ENODATA);
+
+  // Only append once the whole RRset has been validated.
+  const uint32_t offset = ret->Length();
+  for (size_t i = 0; i < records.size(); i++) {
+    if (ret->Set(env->context(), offset + i, records[i]).IsNothing()) {
+      return Nothing<int>();
+    }
+  }
+  return Just<int>(ARES_SUCCESS);
+}
+
 Maybe<int> ParseTxtReply(Environment* env,
                          const unsigned char* buf,
                          int len,
@@ -1177,6 +1433,11 @@ int CnameTraits::Send(QueryWrap<CnameTraits>* wrap, const char* name) {
   return ARES_SUCCESS;
 }
 
+int HttpsTraits::Send(QueryWrap<HttpsTraits>* wrap, const char* name) {
+  wrap->AresQuery(name, ARES_CLASS_IN, ARES_REC_TYPE_HTTPS);
+  return ARES_SUCCESS;
+}
+
 int MxTraits::Send(QueryWrap<MxTraits>* wrap, const char* name) {
   wrap->AresQuery(name, ARES_CLASS_IN, ARES_REC_TYPE_MX);
   return ARES_SUCCESS;
@@ -1187,6 +1448,11 @@ int NsTraits::Send(QueryWrap<NsTraits>* wrap, const char* name) {
   return ARES_SUCCESS;
 }
 
+int SvcbTraits::Send(QueryWrap<SvcbTraits>* wrap, const char* name) {
+  wrap->AresQuery(name, ARES_CLASS_IN, ARES_REC_TYPE_SVCB);
+  return ARES_SUCCESS;
+}
+
 int TlsaTraits::Send(QueryWrap<TlsaTraits>* wrap, const char* name) {
   wrap->AresQuery(name, ARES_CLASS_IN, ARES_REC_TYPE_TLSA);
   return ARES_SUCCESS;
@@ -1489,6 +1755,24 @@ Maybe<int> AnyTraits::Parse(QueryAnyWrap* wrap,
     return Just<int>(status);
   }
 
+  /* Parse SVCB records */
+  if (!ParseSvcbReply(env, buf, len, ret, ARES_REC_TYPE_SVCB, true)
+           .To(&status)) {
+    return Nothing<int>();
+  }
+  if (status != ARES_SUCCESS && status != ARES_ENODATA) {
+    return Just<int>(status);
+  }
+
+  /* Parse HTTPS records */
+  if (!ParseSvcbReply(env, buf, len, ret, ARES_REC_TYPE_HTTPS, true)
+           .To(&status)) {
+    return Nothing<int>();
+  }
+  if (status != ARES_SUCCESS && status != ARES_ENODATA) {
+    return Just<int>(status);
+  }
+
   wrap->CallOnComplete(ret);
   return Just<int>(ARES_SUCCESS);
 }
@@ -1614,6 +1898,40 @@ Maybe<int> CnameTraits::Parse(QueryCnameWrap* wrap,
   return Just<int>(ARES_SUCCESS);
 }
 
+// Shared by SvcbTraits and HttpsTraits, which only differ in the record type.
+template <typename Wrap>
+Maybe<int> ParseSvcbQuery(Wrap* wrap,
+                          const std::unique_ptr<ResponseData>& response,
+                          ares_dns_rec_type_t rec_type) {
+  if (response->is_host) [[unlikely]] {
+    return Just<int>(ARES_EBADRESP);
+  }
+
+  unsigned char* buf = response->buf.data;
+  int len = response->buf.size;
+
+  Environment* env = wrap->env();
+  HandleScope handle_scope(env->isolate());
+  Context::Scope context_scope(env->context());
+
+  Local<Array> records = Array::New(env->isolate());
+  int status;
+  if (!ParseSvcbReply(env, buf, len, records, rec_type).To(&status)) {
+    return Nothing<int>();
+  }
+  if (status != ARES_SUCCESS) {
+    return Just<int>(status);
+  }
+
+  wrap->CallOnComplete(records);
+  return Just<int>(ARES_SUCCESS);
+}
+
+Maybe<int> HttpsTraits::Parse(QueryHttpsWrap* wrap,
+                              const std::unique_ptr<ResponseData>& response) {
+  return ParseSvcbQuery(wrap, response, ARES_REC_TYPE_HTTPS);
+}
+
 Maybe<int> MxTraits::Parse(QueryMxWrap* wrap,
                            const std::unique_ptr<ResponseData>& response) {
   if (response->is_host) [[unlikely]] {
@@ -1668,6 +1986,11 @@ Maybe<int> NsTraits::Parse(QueryNsWrap* wrap,
   return Just<int>(ARES_SUCCESS);
 }
 
+Maybe<int> SvcbTraits::Parse(QuerySvcbWrap* wrap,
+                             const std::unique_ptr<ResponseData>& response) {
+  return ParseSvcbQuery(wrap, response, ARES_REC_TYPE_SVCB);
+}
+
 Maybe<int> TlsaTraits::Parse(QueryTlsaWrap* wrap,
                              const std::unique_ptr<ResponseData>& response) {
   if (response->is_host) [[unlikely]] {
diff --git a/src/cares_wrap.h b/src/cares_wrap.h
index fd66a67164b3..1b4c4f75beb8 100644
--- a/src/cares_wrap.h
+++ b/src/cares_wrap.h
@@ -442,12 +442,14 @@ class QueryWrap final : public AsyncWrap {
   V(Aaaa, resolve6, queryAaaa)                                                 \
   V(Caa, resolveCaa, queryCaa)                                                 \
   V(Cname, resolveCname, queryCname)                                           \
+  V(Https, resolveHttps, queryHttps)                                           \
   V(Mx, resolveMx, queryMx)                                                    \
   V(Naptr, resolveNaptr, queryNaptr)                                           \
   V(Ns, resolveNs, queryNs)                                                    \
   V(Ptr, resolvePtr, queryPtr)                                                 \
   V(Srv, resolveSrv, querySrv)                                                 \
   V(Soa, resolveSoa, querySoa)                                                 \
+  V(Svcb, resolveSvcb, querySvcb)                                              \
   V(Tlsa, resolveTlsa, queryTlsa)                                              \
   V(Txt, resolveTxt, queryTxt)
 
diff --git a/src/env_properties.h b/src/env_properties.h
index c4e3bc5c72a0..1e931e5ec80d 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -128,12 +128,14 @@
   V(dns_aaaa_string, "AAAA")                                                   \
   V(dns_caa_string, "CAA")                                                     \
   V(dns_cname_string, "CNAME")                                                 \
+  V(dns_https_string, "HTTPS")                                                 \
   V(dns_mx_string, "MX")                                                       \
   V(dns_naptr_string, "NAPTR")                                                 \
   V(dns_ns_string, "NS")                                                       \
   V(dns_ptr_string, "PTR")                                                     \
   V(dns_soa_string, "SOA")                                                     \
   V(dns_srv_string, "SRV")                                                     \
+  V(dns_svcb_string, "SVCB")                                                   \
   V(dns_tlsa_string, "TLSA")                                                   \
   V(dns_txt_string, "TXT")                                                     \
   V(done_string, "done")                                                       \
@@ -459,6 +461,7 @@
   V(sqlite_session_constructor_template, v8::FunctionTemplate)                 \
   V(srv_record_template, v8::DictionaryTemplate)                               \
   V(streambaseoutputstream_constructor_template, v8::ObjectTemplate)           \
+  V(svcb_record_template, v8::DictionaryTemplate)                              \
   V(tcp_constructor_template, v8::FunctionTemplate)                            \
   V(tlsa_record_template, v8::DictionaryTemplate)                              \
   V(tty_constructor_template, v8::FunctionTemplate)                            \
diff --git a/test/common/dns.js b/test/common/dns.js
index 214b925128ef..8744e1da0d3c 100644
--- a/test/common/dns.js
+++ b/test/common/dns.js
@@ -14,6 +14,8 @@ const types = {
   MX: 15,
   TXT: 16,
   SRV: 33,
+  SVCB: 64,
+  HTTPS: 65,
   ANY: 255,
   CAA: 257,
 };
@@ -289,6 +291,26 @@ function writeDNSPacket(parsed) {
         buffers.push(target);
         break;
       }
+      case 'SVCB':
+      case 'HTTPS':
+      {
+        // SvcPriority (2) + TargetName + SvcParams. `params` is an array of
+        // [key, value] pairs written in the given order, so tests can also
+        // produce malformed records.
+        const target = rr.target === '.' ?
+          Buffer.alloc(1) : writeDomainName(rr.target);
+        const params = (rr.params ?? []).map(([key, value]) => {
+          const header = Buffer.alloc(4);
+          header.writeUInt16BE(key, 0);
+          header.writeUInt16BE(value.length, 2);
+          return Buffer.concat([header, value]);
+        });
+        const rdata = Buffer.concat([target, ...params]);
+        rdLengthBuf[0] = 2 + rdata.length;
+        buffers.push(new Uint16Array([rr.priority]));
+        buffers.push(rdata);
+        break;
+      }
       default:
         throw new Error(`Unknown RR type ${rr.type}`);
     }
diff --git a/test/common/internet.js b/test/common/internet.js
index fd55ccd14cdd..4d61badac75b 100644
--- a/test/common/internet.js
+++ b/test/common/internet.js
@@ -36,6 +36,8 @@ const addresses = {
   CAA_HOST: 'google.com',
   // A host with CNAME records registered
   CNAME_HOST: 'blog.nodejs.org',
+  // A host with HTTPS records registered
+  HTTPS_HOST: 'cloudflare.com',
   // A host with NS records registered
   NS_HOST: 'nodejs.org',
   // A host with TLSA records registered
diff --git a/test/internet/test-dns-any.js b/test/internet/test-dns-any.js
index 986e2bb283cc..86194bcd8a53 100644
--- a/test/internet/test-dns-any.js
+++ b/test/internet/test-dns-any.js
@@ -80,6 +80,18 @@ const checkers = {
     assert.strictEqual(typeof r.weight, 'number');
     assert.strictEqual(r.type, 'SRV');
   },
+  checkSVCB(r) {
+    assert.strictEqual(typeof r.priority, 'number');
+    assert.strictEqual(typeof r.target, 'string');
+    assert.strictEqual(typeof r.params, 'object');
+    assert.strictEqual(r.type, 'SVCB');
+  },
+  checkHTTPS(r) {
+    assert.strictEqual(typeof r.priority, 'number');
+    assert.strictEqual(typeof r.target, 'string');
+    assert.strictEqual(typeof r.params, 'object');
+    assert.strictEqual(r.type, 'HTTPS');
+  },
 };
 /* eslint-enable node-core/must-call-assert */
 
diff --git a/test/internet/test-dns-cares-domains.js b/test/internet/test-dns-cares-domains.js
index 3312a0e3f8ca..4b3cd4b18f98 100644
--- a/test/internet/test-dns-cares-domains.js
+++ b/test/internet/test-dns-cares-domains.js
@@ -9,11 +9,13 @@ const domain = require('domain');
   'resolve4',
   'resolve6',
   'resolveCname',
+  'resolveHttps',
   'resolveMx',
   'resolveNs',
   'resolveTlsa',
   'resolveTxt',
   'resolveSrv',
+  'resolveSvcb',
   'resolvePtr',
   'resolveNaptr',
   'resolveSoa',
diff --git a/test/internet/test-dns.js b/test/internet/test-dns.js
index 86fb99611f50..add74db4b450 100644
--- a/test/internet/test-dns.js
+++ b/test/internet/test-dns.js
@@ -485,6 +485,31 @@ test(async function test_resolveTlsa(done) {
   checkWrap(req);
 });
 
+test(async function test_resolveHttps(done) {
+  function validateResult(result) {
+    assert.ok(Array.isArray(result));
+    assert.ok(result.length >= 1);
+    for (const record of result) {
+      assert.strictEqual(typeof record.priority, 'number');
+      assert.strictEqual(typeof record.target, 'string');
+      assert.strictEqual(typeof record.params, 'object');
+      if (record.params.alpn !== undefined) {
+        assert.ok(Array.isArray(record.params.alpn));
+      }
+    }
+  }
+
+  validateResult(await dnsPromises.resolveHttps(addresses.HTTPS_HOST));
+
+  const req = dns.resolveHttps(addresses.HTTPS_HOST,
+                               common.mustSucceed((records) => {
+                                 validateResult(records);
+                                 done();
+                               }));
+
+  checkWrap(req);
+});
+
 test(function test_resolveTlsa_failure(done) {
   assert.rejects(
     dnsPromises.resolveTlsa(addresses.NOT_FOUND),
@@ -776,6 +801,10 @@ test(function test_empty_srv_records(done) {
   testEmptyRecords('resolveSrv', done);
 });
 
+test(function test_empty_svcb_records(done) {
+  testEmptyRecords('resolveSvcb', done);
+});
+
 test(function test_empty_tlsa_records(done) {
   testEmptyRecords('resolveTlsa', done);
 });
diff --git a/test/internet/test-trace-events-dns.js b/test/internet/test-trace-events-dns.js
index eafc2764ac04..36b8ea5bdfa7 100644
--- a/test/internet/test-trace-events-dns.js
+++ b/test/internet/test-trace-events-dns.js
@@ -32,11 +32,13 @@ const tests = {
   'resolve6': 'dns.resolve6("example.com", (err, res) => {});',
   'resolveCaa': 'dns.resolveCaa("example.com", (err, res) => {});',
   'resolveCname': 'dns.resolveCname("example.com", (err, res) => {});',
+  'resolveHttps': 'dns.resolveHttps("example.com", (err, res) => {});',
   'resolveMx': 'dns.resolveMx("example.com", (err, res) => {});',
   'resolveNs': 'dns.resolveNs("example.com", (err, res) => {});',
   'resolveTlsa': 'dns.resolveTlsa("example.com", (err, res) => {});',
   'resolveTxt': 'dns.resolveTxt("example.com", (err, res) => {});',
   'resolveSrv': 'dns.resolveSrv("example.com", (err, res) => {});',
+  'resolveSvcb': 'dns.resolveSvcb("example.com", (err, res) => {});',
   'resolvePtr': 'dns.resolvePtr("example.com", (err, res) => {});',
   'resolveNaptr': 'dns.resolveNaptr("example.com", (err, res) => {});',
   'resolveSoa': 'dns.resolveSoa("example.com", (err, res) => {});',
diff --git a/test/parallel/test-dns-resolve-null-bytes.js b/test/parallel/test-dns-resolve-null-bytes.js
index ef091d06a0d4..67de06c830c5 100644
--- a/test/parallel/test-dns-resolve-null-bytes.js
+++ b/test/parallel/test-dns-resolve-null-bytes.js
@@ -26,12 +26,14 @@ const methods = [
   'resolveAny',
   'resolveCaa',
   'resolveCname',
+  'resolveHttps',
   'resolveMx',
   'resolveNaptr',
   'resolveNs',
   'resolvePtr',
   'resolveSoa',
   'resolveSrv',
+  'resolveSvcb',
   'resolveTlsa',
   'resolveTxt',
 ];
@@ -42,12 +44,14 @@ const rrtypes = [
   'ANY',
   'CAA',
   'CNAME',
+  'HTTPS',
   'MX',
   'NAPTR',
   'NS',
   'PTR',
   'SOA',
   'SRV',
+  'SVCB',
   'TLSA',
   'TXT',
 ];
diff --git a/test/parallel/test-dns-resolvesvcb.js b/test/parallel/test-dns-resolvesvcb.js
new file mode 100644
index 000000000000..e3f4e1e2a1c0
--- /dev/null
+++ b/test/parallel/test-dns-resolvesvcb.js
@@ -0,0 +1,216 @@
+'use strict';
+// Tests dns.resolveSvcb() and dns.resolveHttps() (RFC 9460) against a local
+// DNS server.
+
+const common = require('../common');
+const dnstools = require('../common/dns');
+const dns = require('dns');
+const assert = require('assert');
+const dgram = require('dgram');
+const dnsPromises = dns.promises;
+
+const u16 = (n) => Buffer.from([n >> 8, n & 0xff]);
+const alpn = (...ids) =>
+  Buffer.concat(ids.map((id) => Buffer.from([id.length, ...Buffer.from(id)])));
+const ech = Buffer.from('0045fe0d0041', 'hex');
+
+const zone = {
+  // ServiceMode SVCB record carrying private-use keys, as used by DNS-AID.
+  '_index._mcp._agents.example.org': [{
+    type: 'SVCB',
+    priority: 1,
+    target: 'mcp.example.org',
+    params: [
+      [1, alpn('mcp')],
+      [3, u16(443)],
+      [65400, Buffer.from('https://aid.example.org/cap')],
+      [65404, Buffer.from('tenant-42')],
+    ],
+  }],
+  'example.org': [{
+    type: 'HTTPS',
+    priority: 1,
+    target: '.',
+    params: [
+      [0, Buffer.concat([u16(1), u16(3)])],
+      [1, alpn('h2', 'h3')],
+      [2, Buffer.alloc(0)],
+      [3, u16(8443)],
+      [4, Buffer.from([192, 0, 2, 1, 192, 0, 2, 2])],
+      [5, ech],
+      [6, Buffer.from('20010db8000000000000000000000001', 'hex')],
+      [7, Buffer.from('/dns-query{?dns}')],
+      [8, Buffer.alloc(0)],
+    ],
+  }],
+  'alias.example.org': [{
+    type: 'HTTPS',
+    priority: 0,
+    target: 'svc.example.net',
+  }],
+  'bad-alpn.example.org': [{
+    type: 'SVCB',
+    priority: 1,
+    target: '.',
+    params: [[1, Buffer.from([5, 0x68, 0x32])]],
+  }],
+  'bad-order.example.org': [{
+    type: 'SVCB',
+    priority: 1,
+    target: '.',
+    params: [[3, u16(443)], [1, alpn('h2')]],
+  }],
+  'bad-port.example.org': [{
+    type: 'SVCB',
+    priority: 1,
+    target: '.',
+    params: [[3, Buffer.from([1, 2, 3])]],
+  }],
+  // "mandatory" must not list itself.
+  'bad-mandatory-self.example.org': [{
+    type: 'SVCB',
+    priority: 1,
+    target: '.',
+    params: [[0, Buffer.concat([u16(0), u16(1)])], [1, alpn('h2')]],
+  }],
+  // Keys listed in "mandatory" must be in increasing order.
+  'bad-mandatory-order.example.org': [{
+    type: 'SVCB',
+    priority: 1,
+    target: '.',
+    params: [
+      [0, Buffer.concat([u16(3), u16(1)])],
+      [1, alpn('h2')],
+      [3, u16(443)],
+    ],
+  }],
+  // Keys listed in "mandatory" must be present.
+  'bad-mandatory-missing.example.org': [{
+    type: 'SVCB',
+    priority: 1,
+    target: '.',
+    params: [[0, u16(3)], [1, alpn('h2')]],
+  }],
+  // SvcParams of AliasMode records are ignored, even if malformed.
+  'alias-params.example.org': [{
+    type: 'SVCB',
+    priority: 0,
+    target: 'svc.example.net',
+    params: [[3, Buffer.from([1])]],
+  }],
+  // A malformed HTTPS RRset must not hide other records from resolveAny().
+  'any-mixed.example.org': [{
+    type: 'A',
+    address: '192.0.2.1',
+  }, {
+    type: 'HTTPS',
+    priority: 1,
+    target: '.',
+    params: [[3, Buffer.from([1])]],
+  }],
+};
+
+const server = dgram.createSocket('udp4');
+
+server.on('message', common.mustCallAtLeast((msg, { address, port }) => {
+  const parsed = dnstools.parseDNSPacket(msg);
+  const { domain, type } = parsed.questions[0];
+  const answers = (zone[domain] ?? [])
+    .filter((rr) => type === 'ANY' || rr.type === type)
+    .map((rr) => ({ domain, ttl: 300, ...rr }));
+
+  server.send(dnstools.writeDNSPacket({
+    id: parsed.id,
+    questions: parsed.questions,
+    answers,
+  }), port, address);
+}));
+
+function assertArrayBuffer(actual, expected) {
+  assert.ok(actual instanceof ArrayBuffer);
+  assert.deepStrictEqual(Buffer.from(actual), expected);
+}
+
+function validateDnsAid(records) {
+  assert.strictEqual(records.length, 1);
+  const [record] = records;
+  assert.strictEqual(record.priority, 1);
+  assert.strictEqual(record.target, 'mcp.example.org');
+  assert.strictEqual(Object.hasOwn(record, 'type'), false);
+  assert.deepStrictEqual(Object.keys(record.params),
+                         ['alpn', 'port', 'key65400', 'key65404']);
+  assert.deepStrictEqual(record.params.alpn, ['mcp']);
+  assert.strictEqual(record.params.port, 443);
+  assertArrayBuffer(record.params.key65400,
+                    Buffer.from('https://aid.example.org/cap'));
+  assertArrayBuffer(record.params.key65404, Buffer.from('tenant-42'));
+}
+
+function validateHttps(records) {
+  assert.strictEqual(records.length, 1);
+  const [{ priority, target, params }] = records;
+  assert.strictEqual(priority, 1);
+  assert.strictEqual(target, '');
+  assert.deepStrictEqual(params.mandatory, ['alpn', 'port']);
+  assert.deepStrictEqual(params.alpn, ['h2', 'h3']);
+  assert.strictEqual(params['no-default-alpn'], true);
+  assert.strictEqual(params.port, 8443);
+  assert.deepStrictEqual(params.ipv4hint, ['192.0.2.1', '192.0.2.2']);
+  assertArrayBuffer(params.ech, ech);
+  assert.deepStrictEqual(params.ipv6hint, ['2001:db8::1']);
+  assert.strictEqual(params.dohpath, '/dns-query{?dns}');
+  assert.strictEqual(params.ohttp, true);
+}
+
+server.bind(0, common.mustCall(async () => {
+  const servers = [`127.0.0.1:${server.address().port}`];
+  const resolver = new dnsPromises.Resolver();
+  resolver.setServers(servers);
+  dns.setServers(servers);
+
+  validateDnsAid(await resolver.resolveSvcb('_index._mcp._agents.example.org'));
+  validateDnsAid(
+    await resolver.resolve('_index._mcp._agents.example.org', 'SVCB'));
+  validateHttps(await resolver.resolveHttps('example.org'));
+  validateHttps(await resolver.resolve('example.org', 'HTTPS'));
+
+  assert.deepStrictEqual(await resolver.resolveHttps('alias.example.org'), [{
+    priority: 0,
+    target: 'svc.example.net',
+    params: {},
+  }]);
+
+  // Only resolveAny() reports the record type.
+  const any = await resolver.resolveAny('example.org');
+  assert.strictEqual(any.length, 1);
+  assert.strictEqual(any[0].type, 'HTTPS');
+  validateHttps(any);
+
+  assert.deepStrictEqual(await resolver.resolveSvcb('alias-params.example.org'),
+                         [{ priority: 0, target: 'svc.example.net', params: {} }]);
+
+  const anyMixed = await resolver.resolveAny('any-mixed.example.org');
+  assert.deepStrictEqual(anyMixed.map(({ type }) => type), ['A']);
+
+  for (const host of ['bad-alpn', 'bad-order', 'bad-port',
+                      'bad-mandatory-self', 'bad-mandatory-order',
+                      'bad-mandatory-missing']) {
+    await assert.rejects(resolver.resolveSvcb(`${host}.example.org`), {
+      code: 'EBADRESP',
+      syscall: 'querySvcb',
+    });
+  }
+
+  await assert.rejects(resolver.resolveSvcb('alias.example.org'), {
+    code: 'ENODATA',
+  });
+
+  dns.resolveSvcb('_index._mcp._agents.example.org', common.mustSucceed(
+    (records) => {
+      validateDnsAid(records);
+      dns.resolveHttps('example.org', common.mustSucceed((records) => {
+        validateHttps(records);
+        server.close();
+      }));
+    }));
+}));