> 1. Even if you don't do SNI, the hostname is on the certificate that the server sends. Not necessarily, think about things like *.tumblr.com or *.blogsp

> 1. Even if you don't do SNI, the hostname is on the certificate that the server sends. Not necessarily, think about things like *.tumblr.com or *.blogspot.tld And while for example Cloudflare's free TLS certificates are not wildcard certificates, they bundle dozens of unrelated sites in a single certificate. The DNS remark still applies, since wildcards themselves can't be cached by a caching DNS server, only individual instances of a wildcard can be cached (as usual). However, with a caching DNS server there will likely be many fewer DNS requests that can be observed compared to HTTP requests.