In the current designs, plaintext domain names are mainly exposed through two channels: the SNI extension in TLS, and traditional DNS name resolutions—the deplo

In the current designs, plaintext domain names are mainly exposed through two channels: the SNI extension in TLS, and traditional DNS name resolutions—the deployment of DoH/DoT is thus a prerequisite for ESNI. Equivalently, the use of DoH/DoT will not provide any meaningful privacy if domain names are still exposed through the (unencrypted) SNI extension in TLS handshake traffic. Recently, there is a push for the deployment of DoH/DoT, with major organizations already supporting it (e.g., Google, Cloudflare, Firefox), though this has not been followed by an equivalent effort for the deployment of ESNI, which is now being reworked in an Internet draft called Encrypted Client Hello (ECH: https://www.ietf.org/archive/id/draft-ietf-tls-esni-12.txt https://www.ietf.org/archive/id/draft-ietf-tls-esni-12.txt). Unless the confidentiality of domain names is preserved on both channels (SNI and DNS), neither technology can provide any actual privacy benefit if deployed individually. Also many websites hosted on IP addresses that do not host any other domains, the IP information can be used to infer which domain was visited. We have carried out some studies to investigate the extent to which domain name inference can be done through IP address information. For more technical details pls have a look at these papers: "Assessing the Privacy Benefits of Domain Name Encryption" https://arxiv.org/pdf/1911.00563.pdf https://arxiv.org/pdf/1911.00563.pdf "Domain name encryption is not enough: privacy leakage via IP-based website fingerprinting" https://petsymposium.org/2021/files/papers/issue4/popets-2021-0078.pdf https://petsymposium.org/2021/files/papers/issue4/popets-202...