You don’t need the DNS query to get the host name/domain: The hostname is sent in clear before the TLS connection is established, otherwise name based virtual h

You don’t need the DNS query to get the host name/domain: The hostname is sent in clear before the TLS connection is established, otherwise name based virtual hosting would break with TLS. The host would not know which certificate to present. The feature is called SNI - Server Name Indication. AFAIK encrypted SNI is being worked on, but I haven’t followed the latest developments.