6 min read
SNI (Server Name Indication) is a field in the first packet of a secure connection where the browser states, in the clear, which domain it is reaching. Encryption starts after that, so the site name is visible to any equipment along the path before protection exists. ECH (Encrypted Client Hello) is the mechanism that hides this field. Below: how SNI-based blocking works, what ECH actually changes, and why switching it on sometimes makes things worse.
Because at the moment SNI is sent, there is nothing to encrypt it with. The TLS handshake begins with a ClientHello message in which the client lists supported algorithms and names the domain. The server uses that name to pick the right certificate — thousands of sites live on a single IP address, and without SNI it would not know whose certificate to serve. The shared key only appears at the next step.
The practical consequence: the page address, passwords and request contents really are hidden, while the domain name is not. This is what the "turn on DoH and become invisible" guides leave out: private DNS closes the DNS query, but SNI follows it in the clear.
The equipment reads ClientHello, compares the domain against a list, and drops the connection before it is established. Technically this is cheaper than every other method: no decryption, no behavioural analysis — a string comparison suffices.
| Method | What it reads | What defeats it | |---|---|---| | By IP address | destination address | changing address, CDN | | By DNS | the name query | DoH/DoT | | By SNI | the domain in ClientHello | ECH, a tunnel | | By protocol signature | packet shape | a protocol with no signature |
The mechanics behind the earlier rows are covered separately: what DPI is.
ECH encrypts the entire ClientHello, SNI included. All that stays in the clear is an outer name, shared by every site behind the same provider — usually the name of the CDN itself. An observer sees a connection to a "cloud", but not which of the sites hosted there was requested.
The client takes the key for that encryption from DNS: the domain publishes an HTTPS-type record carrying an ech parameter. Hence two conditions, without which ECH simply will not engage:
Per public release notes, support arrived in Firefox from version 118 and in Chrome from version 117 — both shipped in autumn 2023.
Because rare things stand out. While only a small share of connections use ECH, its very presence is a distinguishing feature, and a filtering system can act on it exactly as it acted on the domain: without examining what is inside, drop everything that looks like ECH.
This already happened to its predecessor. ESNI, the early version of the mechanism, was reported by censorship research groups to have been cut off in China in 2020 — wholesale, as a class. Similar reports about ECH connections surfaced later, in other countries.
Hence a conclusion that is awkward for short advice: ECH is the right mechanism, but it solves privacy from your provider, not circumvention of blocking. On a network where it gets cut, the browser checkbox has the opposite effect.
Inside a tunnel the SNI question disappears: the handshake with the site happens at the exit server, and the provider sees only a connection to a single address. But a different signal then goes out — the tunnel protocol itself, and everything depends on whether it has a recognisable shape.
Here two approaches diverge. A classic VPN hides the domain but gives itself away by packet pattern. VLESS with Reality masking performs the handshake with a real, popular site and presents its SNI — it does not hide the name, it shows a plausible one. To the filter this looks like an ordinary visit to an ordinary site, and the domain-list comparison passes normally. The mechanics: Reality and VLESS in plain language; what follows from it in hard regions: BessyConnect in Iran, Russia and China.
What is SNI in plain words? A field in the first packet of a secure connection where the browser names, in the clear, the domain it is connecting to. The server needs it to pick the right certificate, and everyone along the path can see it, because it is sent before encryption exists.
Does HTTPS hide the site name? No. HTTPS hides the page address, query parameters and contents, but the domain name itself goes out in SNI in the clear. Only ECH or a tunnel can hide it.
How does ECH differ from ESNI? ESNI encrypted only the name field and was the early version of the mechanism; ECH encrypts the whole ClientHello and replaced it. ESNI is considered obsolete.
Is turning on ECH enough to get around blocking? No. ECH reduces what the provider sees, but on heavily filtered networks connections carrying ECH can be dropped wholesale — precisely because there are few of them and they stand out.
Is SNI visible when a VPN is on? Not to your provider: the handshake with the site happens at the exit server. The provider sees only a connection to the server's address and decides based on the signals of the tunnel protocol itself.
Instagram won't open or keeps lagging? BessyConnect VPN on VLESS+Reality restores access to Instagram so your feed, stories, and Reels load block-free. More
BessyConnect is a VPN for Telegram: restore chats and calls when Telegram isn't working. The VLESS+Reality protocol bypasses blocks and DPI on all devices. More
BessyConnect is a VPN for WhatsApp that restores voice and video calls when they're blocked. The VLESS + Reality protocol beats DPI. Get it for iOS and Android. More
