The Cloudflare TRR endpoint is mapped to a subdomain that indicates the user agent, i.e., browser, was distributed by Mozilla: mozilla.cloudflare-dns.com. The

The Cloudflare TRR endpoint is mapped to a subdomain that indicates the user agent, i.e., browser, was distributed by Mozilla: mozilla.cloudflare-dns.com. The IP address for the subdomain is the same as for cloudflare-dns.com. Would this subdomain be leaked in SNI.^1 Presumably it serves to enable someone, maybe Cloudflare, to track queries as coming from Firefox. Will the endpoints for other TRRs have special subdomains. Perhaps another "privacy enhancement" would be to avoid using a browser-specific subdomain. 1. ESNI is still experimental and if I am not mistaken it is disabled by default in Firefox.