> 2. For most users, the domain name already leaks in the DNS request, does it not? That is, SNI provides no less security. This is true, although you can use

> 2. For most users, the domain name already leaks in the DNS request, does it not? That is, SNI provides no less security. This is true, although you can use something like dns-crypt to give you some degree of shielding. There are two additional benefits to it also: - your ISP can’t hijack non-existent domains - you can block IDNs like so: https://flawed.net.nz/2017/07/22/how-and-why-you-should-disable-internationalized-domains/ https://flawed.net.nz/2017/07/22/how-and-why-you-should-disa...