Unless the DNS is also encrypted. In fact, the firefox implementation for ESNI, and I assume now for ECH, required DNS over HTTPS to be enabled in firefox for

Unless the DNS is also encrypted. In fact, the firefox implementation for ESNI, and I assume now for ECH, required DNS over HTTPS to be enabled in firefox for ESNI to work. That means that if ESNI is used the domain is never transmitted in plaintext. However, it has the signfificant downside that if you can't or don't want to use Firefox's DoH, and your system DNS is already encrypted (DoH, DoT, VPN, etc.), then you can't get ESNI. See https://bugzilla.mozilla.org/show_bug.cgi?id=1500289 https://bugzilla.mozilla.org/show_bug.cgi?id=1500289